#hack100days Day 1: Enumerate targets in a web application CTF. Explore potential sqli points. Look at SSTI for Werkzeug. Look at SSRF candidate. (dafuq is a gunicorn?)
#hack100days Day 2: Listened to @jhaddix@twitter talk about his #bugbounty methodology at NahamCon. Lot of good tools and some advice on things to pay attention to during enumeration. Need to re-watch and take notes--play with some tools. (Also was up to wee hours this a.m. working NahamCon ctf) #infosec
#hack100days Day 3: Reviewed shub's (@infosec_au@twitter) slides (https://drive.google.com/file/d/14OFU-B2CqnrNlMX9jis1ApRIAOlJNfbW/view) from NahamCon 2022 re: Finding 0days in Enterprise Software. I did not know Lotus Domino was still a thing. #ssrf #infosec
#hack100days Day 4: Installed k8s on Ubuntu lab box. Downloaded Kubernetes Goat (https://madhuakula.com/kubernetes-goat) to install later tonight or tomorrow. I wish to grok the networking better. #k8 #infosec
#hack100days Day 5: Virtually attended SANS CloudSecNext Summit. Really good Keynote by Sounil Yu (https://youtu.be/mEGqC1tuO4E). Also saw a preso on K8 security by Jay Beale.
#hack100days I fell down and broke the chain. Watched Nahamsec's Live Recon Sundays session today with Stök and JHaddix where they interviewed @lilc. That was fun and a good reminder to get back at it. Got run some errands and then back at it tonight. #infosec
#hack100days Day1a: New Chain. (Oof.) Today, started a multi-day #ctf by cmd+ctrl. Currently at 1570 points. Found a couple of pages susceptible to #idor, which led to #authbypass and sensitive data disclosure. Solved an encryption challenge and found a "published" DOS bug. Currently banging on an #sqli. #infosec #hashtag ;)
#hack100days Day2a: Continued #ctf. Solved crypto challenge and found hidden end point. Sqlmap continues chewing on user table. Used an idor and a script to enumerate all the users. #infosec #cososec
#hack100days Day3a: Continued #ctf. Solved an image forensics channel. Wrote some scripts to reap user account data and to reap all the images. Read part one of a three part blog on bulbs found in a CDN provider network. CDN Provider had their side published, as well. #infosec #cososec
#hack100days Day4a: Continued #ctf. Poked at login page and got an interesting error. Still tinkering with that between meetings. There's an auth bypass here, I can *smell* it. Also had some vigorous discussion on what Domain Isolation" is and isn't. #infosec #cososec
#hack100days Day5a: Continued #ctf, but haven't gotten much further. Watched Hack the Box's "Hands on Hacking" live-stream that's setting up Cyber Apocalypse CTF 2022, which starts tomorrow. Keep an eye on HtB's youtube channel, they'll be posting the videos. The ippsec interview was good and Sheeraz gave a good overview of K8s, which I found helpful. #infosec #cososec (One more meeting and then I can focus on the auth bypass sqli...)
#hack100days Day6: The new chain is longer than the old chain! Started Cyber Apocalypse CTF 2022 this morning and worked on it for a couple of hours. Got the 'intro' flag. Worked on two of the challenges, but haven't gotten anywhere--oof. Slight blow to psyche. Good weather today, so worked on container gardening. Now that dinner is done and have whisky on the side table, getting back at it. #infosec #cososec
#hack100days Day7: Continued banging on Cyber Apocalypse CTF '22. Finally "really" on the board with a solved web challenge. Downloaded the code for a bunch of other challenges, so it's time to practice code analysis. #infosec #cososec #ctf
#hack100days Day8: Continued Cyber Apocalypse CTF. Getting *way* more acquainted w/JavaScript. I've got an XSS, but I'm still working out weaponization. Still no additional points, but the day ain't done yet. #infosec #ctf #cososec
#hack100days Day9: Continued Cyber Apocalypse #ctf. Moved to a new challenge. Enumerated site, but not finding entry point. Spent good part of day working on groking MSFT Defender for Cloud Apps. #infosec #cososec
#hack100days Day 1b: Dropped the ball yesterday, busy day. Cyber Apocalypse #ctf is done. Working on a #hackthebox machine today. New day, new chain. #infosec #cososec
#hack100days Day 2b: Kept at the #hackthebox machine. Working out a good #ssti payload. Interesting injection point. Also reworking note taking process. Still slow. #infosec #cososec
#hack100days Day 3b: More reading about #ssti, still need to find right payload. Found an article that walks through a process to find a way to the OS module. #infosec #cososec
#hack100days Day5b: Read about hacking today. Finished 3-part series on a Cloudflare bug bounty. (https://blog.assetnote.io/2022/05/06/cloudflare-pages-pt1/) #infosec #cososec
#hack100days Day6b: Hack the Box Academy. I like the UI for Burp, but I like not having to pay to get the goodness that ZAP brings. Also took a minute to break the rust off for using Metasploit. Can't remember the last time I looked at that. #infosec #cososec
#hack100days Day7b: Read the Verizon DBIR. Interesting graphs in there. Nothing really new under the sun. Which isn't a bad thing.
#hack100days Day8b: Power went out for a couple of hours today. So, went analogue and read two chapters of Hacking APIs by Corey J. Ball (https://nostarch.com/hacking-apis) #infosec #cososec
#hack100days Day9b: Decided "hacking" myself counts today. Started using LYT (https://www.linkingyourthinking.com) note-taking. Moved a bunch of notes from old program to the new. #selfdevelopment #selfimprovement #lyt
#hack100days Day10: New chain, longer than the old chain! Read more of Hacking APIs, by Corey Ball. Looking forward to learning more about GraphQL—want to understand the AuthZ patterns and techniques. Also learned about Broken Object Level Authorization (BOLA). The examples look a lot like IDOR, but I think I grok the diff. You can have an IDOR that’s not a BOLA, but I reckon you could get a BOLA as a result of an IDOR. Still need to think and tinker with this one a bit. #infosec #cosocec
#hack100days Day11: Continued working on Hacking APIs. Next up is working on the labs. Created a postman account. #infosec #cososec
#hack100days Day12: Worked on _Hacking APIs_, Lab 1. Didn't use Burpsuite, used Zap instead. Compared and contrasted with Postman. Slow going at first as I get acquainted with Postman. #infosec #cososec
#hack100days Day13: The chain continues... Another chapter down in _hacking APIs_. Installing deliberately vulnerable apps for the next lab and will bang on them later this evening. In the meantime, kidlet has prepared dinner.
#infosec #cososec
#hack100days Day14: SANS ICS Summit CTF. I'm on the board! No where near top 10, but I'm not sussed since I'm learning more about ICS this way. #infosec #cososec #ctf #ics
#hack100days Day15: Back to _Hacking APIs_. Got Juice Shop installed and tucked behind an nginx reverse proxy, along with DVGA. Now have some #hackthebox systems to put on my list of targets. Next chapter down. #infosec #cososec
#hack100days Day16: Continuing reading _Hacking APIs_. Installed OWASP crAPI app on lab machine. Getting some touches with docker. Need to troubleshoot an error w/one of the crAPI containers. Then, time to hack it! #infosec #cososec
#hack100days Day 17: Lab in _Hacking APIs_ wants working version of crAPI. Getting crAPI turned out to be fail. Nuked, paved, and re-started that effort. Same result. Documented steps and results. Opened an issue. Got a quick response for additional info, so we'll see how this goes. In retrospect, I should have anticipated the question. #infosec #cososec #sysadmin101
#hack1000days Day18: Finally managed to get crAPI working. Needed to move to from docker 20.10.14 to 20.10.16, because of course. (I am not enamored of docker.) Finished the first crAPI lab. #infosec #cososec #sysadmin101
#hack100days Day19: Tested the other deliberately vulnerable apps I had issues with on the new version of docker. All good! Wrote a wrapper script to start/stop the apps as needed. (They're supposed to be cows, not pets ya?) Chapters 7 & 8 read of _Hacking APIs_. #infosec #cososec #mmmmsteak
#hack100days Day20: Published my start/stop script to github (https://github.com/stop-a/misc_scripts/blob/8d8c820922f579e6641b118235269af200f9b7f3/runlab2). Bashed at https://github.com/DevSlop/Pixi in my lab. Got a little more acquainted with Postman. #infosec #cososec
#hack100days Day21: Enumeration and attacks on crAPI. Error message on one of the screens suggested I might be able to brute force 'a thing'. Used ZAP's regex fuzzer for the first time. Didn't get a hit, so I've either mis-inferred what the message meant or it's a lie. After registering a user, attacked jwt with jwtcrack to see if I could get the secret. Success! JWT payload may be an unfortunate decision, so next step is to find other users to see if I can impersonate them. #infosec #cososec
#hack100days Day22: Found some users. With the secret from "my" jwt and was able forge tokens for each user. With the forged tokens, I could reset their passwords. However, logging in yielded a blank page. Trying out kiterunner to find other API endpoints while I watch the Jan 6 hearings. #infosec #cososec
@scottlink here are some tools
https://github.com/arainho/awesome-api-security
I just saw your post I will keep close
@ketchup9080 Thanks! I’ll check the site out.
@scottlink hack the box has modules in the academy program, there is API module
@ketchup9080 Thx for pointer. Unlocked and in the queue!
@scottlink I need to work on my API testing. Very bad currently lol.
@scottlink Is _Hacking APIs_ a good book?
@willc So far, so good. I'm through chapter six, not quite half-way and I've been happy with it. Only gripe is his inclusion of Pixi as a lab app. It's base image doesn't appear to be available any more, so it won't install. I'm not strong enough with Docker and all its ancillary 'stuff' to fix that. Otherwise, I like the level he started with and the organization. If the beginning is stuff you already know, you can easily skip ahead.
@scottlink Thanks for the review! I may just grab a copy and get to hacking. Pixi does look rather old though...
@willc Yeah, I think the issue is that docker config file is referencing a node image that isn't available. It looks like the process falls through to grab an alpine image instead, which is missing some things the rest of the process is assuming is there. I stopped analyzing further lest this turn into a squirrel chase. It would be a good exercise to get more proficient at docker. But, not yet.
@scottlink The author of Pixi is on Twitter @shehackspurple and is really nice. Maybe ask her, or file an Issue on the repository, or even hunt down the book author on Twitter. I just bought it, so maybe I will do those things when I get to that problem 😄
@willc Thanks for the tip on @shehackspurple. I'll revisit this thread once I'm done with the book... ...unless it's needed for a future lab in the book.
#hack100days Day4b: Testing #ssti payloads. Trying to figure out if I’m overthinking it. Tokens matter. #infosec #cososec