Published inTech @ GoCardless·Sep 6, 2021Using CIS benchmarks to set expectations in a DevOps environmentIn the old world there was often a divide between developers, security and operations working in their own silos. This is not an effective approach that can result in a wall of confusion. By embracing DevSecOps we can break down barriers between engineering, security and privacy teams; GoCardless is leveraging…Security4 min readSecurity4 min read
Mar 1, 2021Member-onlyRingZer0Team CTF SQLi challenges — Part 3Continuing on in my series of write ups of the RingZer0Team challenges it is time for my next instalment on SQL injection. I have previously written about Using CTF’s to learn and keep sharp , Javascript RingZer0Team CTF challenges and RingZer0Team SQLi Part 1. In this post I outline more…3 min read3 min read
Aug 9, 2020Member-onlyWin 10 1904 VirtualBox ConflictAfter a frustrating evening trying to setup a Ubuntu 20.04 VM and being unable to upgrade any packages I had to dig into the detail of what the issue was. TL;DR The issue turned out to be a conflict with Windows Subsystem for Linux (WSL) that uses Hyper-V behind the…Virtualbox1 min readVirtualbox1 min read
Sep 16, 2019Member-only44Con HackerOne CTF write upThis year’s 44Con was based on a Blade Runner theme and was built by Cody from HackerOne education. He did a great job building it and was certainly one of the highlights of the conference for me. It all starts with the registration portal on IP 34.89.17.97. The first step…Python11 min readPython11 min read
Sep 6, 2019Member-onlyExploiting simple network services in CTF’sFor those of you that enjoy CTF’s here are a few tips on how you can go about testing non HTTP network services. There are plenty of different services out there to test with, and this is by no means an exhaustive tutorial, but gives you a few tips to…Python3 min readPython3 min read
Apr 7, 2018BSides LDN 2018 CTF by Immersive LabsFortunately I have a ticket for BSidesLDN already, but wanted to have a play with the CTF. I haven’t used the immersive labs platform before and thought it a good opportunity to try it out too. https://www.immersivelabs.com is designed to be a cyber range to learn and practice skills in…Hacking3 min readHacking3 min read
Feb 9, 2018Member-onlyOwning the data centre – Cisco NX-OS VDC takeover vulnerabilityDuring testing of the Cisco Nexus 7000 series switch I identified a high impact (CVSS8.8) vulnerability within the OS which also formed the basis of my talk at Bsides Manchester. Note that the views are my own and don’t represent my employer. TL:DR I identified a vulnerability in the Cisco…Security10 min readSecurity10 min read
Dec 14, 2017Member-onlyRingZer0Team CTF SQLi challenges — Part 2Continuing on in my series of write ups of the RingZer0Team challenges it is time for my next instalment on SQL injection. I have previously written about Using CTF’s to learn and keep sharp , Javascript RingZer0Team CTF challenges and RingZer0Team SQLi Part 1. In this post I outline more…Sql Injection9 min readSql Injection9 min read
Dec 4, 2017Member-onlyRingZer0Team CTF SQLi challenges — Part 1I have been Using CTF’s to learn and keep sharp for a while and I am continuing on in my series of write ups of the RingZer0Team challenges it is time for an installment on SQL injection. I have previously written about the Javascript RingZer0Team CTF challenges. I have set…Ctf6 min readCtf6 min read
Sep 29, 2017RingZer0 Team Online CTF Javascript challengesThis is the second in my gradual series of write ups on CTF’s as I complete them. I previously wrote about using CTF’s to stay sharp and this is the next installment in my progress and focuses on some of the JavaScript challenges I have completed. 1. Client side validation is bad! On this challenge a…JavaScript6 min readJavaScript6 min read
