Sandro Poppi – Medium

Apr 9

Using SANS SIFT Workstation or REMnux with SSL Decrypting Proxies

How corporate proxies can make live harder also for threat hunters and malware analysts. — Nowadays corporate environments more and more make use of SSL decrypting proxies to address blind spots due to the use of certificate-based encrypted connections. And malware also uses https for connecting to their C2 servers to download further payloads. As a normal user you won’t see any differences when accessing…

Cybersecurity

4 min read

Using SANS SIFT Workstation or REMnux with SSL Decrypting Proxies

Feb 22

A bad Combination: Unprivileged Remote Code Execution and privileged File Write

This post provides a nice little exploit chain I came up with in a recent penetration test. Application Overview The application I tested is providing a client to create workflows which communicates via REST API with the application server. This requires specific rights so not all users are able to create own…

Exploit

4 min read

A bad Combination: Unprivileged Remote Code Execution and privileged File Write

Jan 21

Using Microsoft Excel for URL Smuggling

Evading URL Filters so links reach the user’s inbox The majority of cyber attacks against corporate as well as private users nowadays start with a phishing email containing either an attachment or a link to a malicious document. Attackers increasingly strive to smuggle their payloads through existing security services as…

Excel

6 min read

Dec 28, 2021

Musings about further Log4Shell Attack Vectors

A post from the folks at Blumira caught my attention as they state that web sockets are another attack vector for the infamous log4j vulnerability CVE-2021-44228 whereby it extends the attack surface to even internal systems. While their attack works as described, I was wondering if there’s more to it…

Log 4 J Vulnerability

5 min read

Musings about further Log4Shell Attack Vectors