Our new scanner for Text4Shell
Some say, CVE-2022-42889 is the new Log4Shell, for which we developed our own tool to enumerate affected hosts back in 2021. Others like Rapid7 argue that it may not be as easy to exploit like...
View ArticleAnother Tale of IBM i (AS/400) Hacking
Our next journey takes us into the infrastructure of a bank. One element of the infrastructure was an IBM i (AS/400) server, and the only piece of information we got to conduct the penetration test was...
View ArticleSimple IBM i (AS/400) hacking
When you get the chance to take a look at the IT systems of financial institutions, telcos, and other big companies, where availability has been a key business concern for decades, you’ll find, that...
View ArticleOur new tool for enumerating hidden Log4Shell-affected hosts
Log4Shell, formally known as CVE-2021-44228 seems to be the next big vulnerability that affects a huge number of systems, and the affected component, Log4j gets involved in logging untrusted data by...
View ArticleFuzzy Snapshots of Firefox IPC
In January Mozilla published a post on their Attack & Defense blog about Effectively Fuzzing the IPC Layer in Firefox. In this post the authors pointed out that testing individual components of...
View ArticleAdding XCOFF Support to Ghidra with Kaitai Struct
It’s not a secret that we at Silent Signal are hopeless romantics, especially when it comes to classic Unix systems (1, 2, 3). Since some of these systems – that still run business critical...
View ArticleAbusing JWT public keys without the public key
This blog post is dedicated to those to brave souls that dare to roll their own crypto The RSA Textbook of Horrors This story begins with an old project of ours, where we were tasked to verify (among...
View ArticleUnexpected Deserialization pt.1 – JMS
On a recent engagement our task was to assess the security of a service built on IBM Integration Bus, an integration platform for Java Messaging Services. These scary looking enterprise buzzwords...
View ArticleTips and scripts for reconnaissance and scanning
Renewal paper of my GIAC Web Application Penetration Tester certification: Tips and scripts for reconnaissance and scanning
View ArticleDecrypting and analyzing HTTPS traffic without MITM
Sniffing plaintext network traffic between apps and their backend APIs is an important step for pentesters to learn about how they interact. In this blog post, we’ll introduce a method to simplify...
View ArticleUninitialized Memory Disclosures in Web Applications
While we at Silent Signal are strong believers in human creativity when it comes to finding new, or unusual vulnerabilities, we’re also constantly looking for ways to transform our experience into...
View ArticleUnix-style approach to web application testing
SANS Institute accepted my GWAPT Gold Paper about Unix-style approach to web application testing, the paper is now published in the Reading Room. The paper introduces several problems I’ve been facing...
View ArticleWide open banking: PSD2 and us
With the advent of PSD2 APIs, we had the opportunity to test some of them upon request from our clients. Although internet-facing APIs were already a thing thanks to smartphone apps, it seems that...
View ArticlePatching Android apps: what could possibly go wrong
Many tools are timeless: a quality screwdriver will work in ten years just as fine as yesterday. Reverse engineering tools, on the other hand need constant maintenance as the technology we try to...
View ArticleEvading Cisco AnyConnect blocking LAN connections
Some VPNs allow split tunneling, however, Cisco AnyConnect and many other solutions offer a way for network administrators to forbid this. When that happens, connecting to the VPN seals off the client...
View ArticleSelf-defenseless – Exploring Kaspersky’s local attack surface
I had the pleasure to present my research about the IPC mechanisms of Kaspersky products at the IV. EuskalHack conference this weekend. My main motivation for this research was to further explore the...
View ArticleDecrypting Eazfuscator.NET encrypted symbol names
There are many obfuscators for different languages, and some of those offer reversible options for easier field debugging. Eazfuscator.NET is one of these and with a bit of reverse engineering, whole...
View ArticleDrop-by-Drop: Bleeding through libvips
During a recent engagement we encountered a quite common web application feature: profile image uploads. One of the tools we used for the tests was the UploadScanner Burp Suite extension, that reported...
View ArticleOur take on social engineering
Like many other offensive IT security companies, we also offer social engineering assessments. And like in other areas of our portfolio, we try to steer client needs in a way that they order something...
View ArticleThe curious case of encrypted URL parameters
As intra-app URLs used in web applications are generated and parsed by the same code base, there’s no external force pushing developers towards using a human-readable form of serialization. Sure, it’s...
View Article
![[-100%] Commodity Intelligence – (Android Apps)](http://play-lh.googleusercontent.com/j67-qJvmnn4xnVlYVZ9ZhtZUJIgwjKekJGoKQT6D1KHcWGZxtQaFroummEvwV17na7tyh1pGbbeWCRdWtTKqeg=w950-h950)
