Image for post
Image for post
Photo by Yancy Min on Unsplash

DevOps is an essential aspect of any software engineering project. On this note, CTF challenge design is no different. Being able to continuously push updates in a CTF challenge, and at the same time deploy it temporarily for testing, not only allows for better quality assurance practices, but it also gives the author the satisfaction (and bragging rights) when sending it over to fellow hackers to try it out!

In this context, this post provides a tutorial on how to continuously deploy your challenge by (ab)using the Github Workflows environment. Github’s Workflows feature allows developers to define and run workflow pipelines in a controlled environment using Github Actions as building blocks. Essentially, GitHub provides an ephemeral VM free-of-charge to run your workflows on. Interestingly, Github (or should I say… Microsoft) has been generous enough provide a workflow invocation timeout of 6 hours! Now the majority of the more common workflows that are used for packaging, deployment, testing do not exceed running times of an hour. But what if …. we make great use of this workflow time to host our challenge for a couple of hours? However, the problem is, that the workflow environment does not allow any ingress traffic, so how can people access the challenge, even if we host it there? Well…. …


A high-level project description of a P2P Mobile Tracker that can potentially assist COVID-19 pandemic control.

Image for post
Image for post
Photo by Viktor Forgacs on Unsplash

COVID-19 is spreading at an unprecedented rate all around the globe. Health care systems are experiencing a tremendous amount of pressure and health professionals work on exhausting shifts to deal with the demand. The virus does not distinguish between borders, races, or religion! It is, therefore, our duty to be united and stand up against this highly contagious disease.

The world has already several similar pandemics to COVID-19 however there is a notable difference this time: Mass collaboration, transparency and open discussion were not available at the time! …


🔏 Learn how to prove possession of a Sudoku solution with Zero-Knowledge and build a PoC with pure Python.

Original Photo by Logan Kirschner from Pexels
Original Photo by Logan Kirschner from Pexels
Original Photo by Logan Kirschner from Pexels

📖 Introduction

Without a doubt, we currently live in a data-driven society where in fact, data has become a more valuable resource than gold or oil. Seriously, consider the amount of personal data that we share online every minute, on a daily basis. Location, feelings, preferences, passwords, messages… and the list keeps growing…

Fortunately for us, symmetric and asymmetric modern crypto made it possible to protect our data against malicious adversaries attempting to eavesdrop on our communication channels. But what about the data controllers — the guys who we legitimately send the data to? How can consumers make sure that their data are not mishandled or abused? One way for sure is refusing to send data in the first place. But in reality, is not that simple. It’s an exchange. We exchange a bit of privacy for some kind of service that they provide right? …


Plug and play live reloading in docker-compose with docker-watchdog

Image for post
Image for post
Original photo by frank mckenna on Unsplash

Introduction

There is no doubt that Docker containers have become ubiquitous. Considering the flexibility and benefits that containerization provides. this was naturally expected.

What’s more, with all these new software-architecture paradigms. such as microservices and serverless, the need for self-contained, isolated software components is prominent. Even when things become more complicated and interconnected, there are complementary tools like docker-compose to make a developer’s life easier by managing and linking many containers together.

However, as this landscape evolves and new technologies are adopted and deployed, software-development methodologies, practices, and procedures must catch up as well. Otherwise, a significant amount of time is wasted on development, which ultimately defeats the purpose. …


FROM PROBABILISTIC TO DEEP LEARNING APPROACHES

Understand the differences between Naive Bayes model and Variational Autoencoders (VAE) in generative tasks.

Image for post
Image for post
Photo by Isis França on Unsplash

Introduction

Hello, once again this is the second part of the “Demystifying Generative Models” posts so if you haven’t read Part 1 yet, I really urge you to do so here.

In the previous post, we discussed the differences between discriminative and generative models, took a peek to the fascinating world of probabilities and used that knowledge to develop a working Naive Bayes that generates passwords for us. Now, we will change our methodologies a little bit and explore how Deep Learning can help us when probabilities fail.

Not so useful Naive-Bayes

Assuming that you have the context knowledge, of part 1, I will jump straight to the point. The Multinomial Naive Bayes model that was developed was based on the assumption that each feature is independent of each other and it worked quite well! But let’s change the problem formulation slightly and observe how it behaves. Instead of having 4 features, fixed order, and a limited amount of choices per features, let’s just define an alphabet with all the letters, digits and special characters that appear in our initial feature choices. …


From Probabilistic to Deep Learning approaches

Understand the differences between Naive Bayes model and Variational Autoencoders (VAE) in generative tasks.

Image for post
Image for post
Photo by Dan Meyers on Unsplash

Introduction

Machine Learning and Deep Learning models have been showcasing their capabilities in a wide spectrum of industries and Cyber Security is certainly no exception. A relatively recent research example is PassGAN, a Deep Learning model that could generate realistic passwords, thus improving the effectiveness of brute-force attacks [1].

In this post, I would like to borrow this idea and use it an example for explaining the differences between generative and discriminative models, as well as highlighting (and justifying) the superiority of Deep Learning over conventional probabilistic modelling when it comes to high dimensional data.

Discriminative vs Generative Models

There is a very well known taxonomy amongst ML/DL models that consists of Generative and Discriminative models, each one with its own distinct characteristics. Yet, it is extremely common to cause confusion to beginner Data Scientists. As a matter of fact, this is completely understandable, since the name can be misleading with regards to their use cases. Intuitively, you would think that a discriminative model would be used for discriminating between multiple classes and generative for generating new synthetic data, and of course, this is absolutely correct. However, this does not mean that a generative model cannot be used as a classifier, as initially implied by its name. …


Install all plugins at the same time and switch with a simple command.

Image for post
Image for post

There is no doubt, GDB is an amazing tool that almost every single cyber security professional, trainee, hobbyist and researcher has used it before. It is the swiss army knife of process debugging however there is one problem. Vanilla GDB sucks in terms of user experience.

This is the reason behind the development of many plug-ins that can make the process of reversing and debugging so much easier. Namely, three of the most popular are:

Pwndbg: https://github.com/pwndbg/pwndbg

Peda: https://github.com/longld/peda

GEF: https://github.com/hugsy/gef

Of course, all of them come with their pros and cons. Maybe for the task, maybe the features, or even the interface. We all have our preferences. Personally, I prefer Pwndbg’s interface more, but seriously Peda’s cyclic pattern creation and offset search functionality are extremely handy. …


Reversing using IDA Pro and inject shellcode with Python

Image for post
Image for post

Hey folks! As I am getting more and more involved with exploit development I am practising on various vulnerable by default software and one of them is VulnServer.

In a nutshell, VulnServer is a tiny server which exposes a set of commands with several bugs here and there ready to be exploited.


Building the hyped visualisation of 2019 using Python and Flourish

Image for post
Image for post
Photo by Lukas Blazek on Unsplash

2019 was the year of bar charts race animation. Of course, this type of animation has been around for a while, its popularity peaked in the early months of 2019. Although I am not a big fan — as the same insights can be interpreted with a simple line graph — it is an interesting visualisation and unarguably aesthetically pleasing to watch.

As a result, this post is a step by step tutorial about how to create a Bar Chart Race Animation with Python and Flourish. In fact, Flourish will be the main tool for creating the visualisation, but some python scripting will also be required for formatting the dataset. …


Image for post
Image for post
Photo by Irvan Smith on Unsplash

Why so serializable? (100)

Type: Java, Deserialization, Web Hacking

You are tasked with compromising the server running at http://192.168.125.200:58444/

Note: The server is firewalled and no outgoing connections are allowed

The link given leads to a Jenkins CI server.

About

Andreas Pogiatzis

☰ PhD Candidate @ UoG ● Combining Cyber Security with Data Science ● Writing to Understand

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store