Awk Mail Merge

I had a project where I needed to reach out to a number companies to solicit bids for a catering contract. I found that sometimes the companies would expose their email addresses on their websites or have contact us forms. Email addresses directly on website, especially when they are readable by bots are a good way to get a large amount of spam, but it was quite helpful for this project.

December 23, 2022 - 5 minutes read

Install Docker with Ansible on Debian Bullseye

The following was how Docker was added to Debian Bullseye using Ansible. This could be helpful when adding Docker to a fleet of servers. Otherwise it’s much easier to copy paste commands from the official Docker install documentation and save from creating unnecessary automation. Code for this project is on github at ansible-docker. A new Docker group The first step was to create a new role for Ansible, this was so Docker could be added to specific systems specified in the hosts file of the Ansible project that contained many other types of systems not related to Docker.

April 25, 2022 - 1 minutes read

Better pentest reports with linux-util "script" command

An issue came up where the output of a terminal window was needed after that terminal was closed. This unfortunate situation can come up during penetration tests or certification tests like the OSCP. Some investigation into options revealed the ancient and reviled script linux-util program. It records input, output, and timings to file that allow the terminal session view to be replayed or grepped at a later time. The program was added to the ~/.

February 4, 2022 - 3 minutes read

Lag in VMWare Player Absent from Workstation Pro 16

A couple weeks ago I had installed VMWare Player to use the Offensive Security Kali Virtual Machine to go through the OSCP course. Upon installing the VM in VMWare player, I immediately began experiencing a bad issue on both my laptop and my desktop that I did not experience on my previous go-to desktop virtualization application Virtualbox. There was LAG Very bad input lag as seen below. The type of lag that kills productivity in a terminal window.

January 25, 2022 - 2 minutes read

Notes on Personal Websites

You probably don’t need a Wordpress blog, or a hosted website on Wix, Squarespace, or Weebly. I need to specify that you in this context is a human person, not a corporate thing with machiavellian corporate needs. Just a human that has a desire to publish musings on this great big thing called the internet. You likely don’t need to have comments. Let the comments be on another platform like Facebook, Twitter, email or wherever else you waste your life away.

January 25, 2022 - 3 minutes read

The Sad State of Mac Antivirus (2022)

You might need to pay for MacOS antivirus in 2022. Yes, your Apple laptop or desktop does need some form of antivirus. Apple products are not immune from spyware, malware, and viruses. The belief that they were immune was the result of millions of dollars in Apple advertising highlighting that Microsoft Windows was the dominant OS in the desktop market. Viruses and malware written for Apple products are less common because Windows is still ~75% of the global market share in operating systems.

January 23, 2022 - 4 minutes read

Crocodile on Hack the Box Write-up

Sometimes I like these quick, single vulnerability boxes because I can work on the speed of reporting. Find the flag, then go back and answer the questions required to submit the flag. Plus add a couple notes and modifications to the toolset in the notes, like the different wordlist for enumeration http. Executive Summary The target machine suffered from broken access control vulnerability that allow for the harvesting of active user credentials from FTP.

January 23, 2022 - 10 minutes read

Potato on Proving Grounds Write-up

What I liked most about this box was using information gained in the enumeration of one service to compromise other services. This was the first on Proving Grounds, besides getting kicked off their VPN a number of times for taking my sweet time, I found the box quite fun. Executive Summary The target server had broken access control for a file transfer service that gave away an insecure design vulnerability in the web login form.

January 22, 2022 - 9 minutes read

Blue on Try Hack Me Write-up

In experimenting more with how to effectively report, I’ve found that when I have issues with tools or access, I report less in realtime. Might need to fix that. I feel like I’m missing some in this report, but that’s fine. Penetration is report writing, with some fun mixed in. I want to get familar with OWASP and the other frameworks to be able immediately know what. Executive Summary The target machine was susceptible to a well known vulnerability in Windows file sharing and authentication.

Posts

List of Posts