Security Blog
Cybersecurity research, vulnerability analysis, and practical security insights.
OSVDB-97562: OAuth Protocol HMAC Timing Disclosure Weakness
OSVDB ID: 97562 · Class: Cryptographic weakness / timing side-channel · Affected: OAuth protocol implementations performing HMAC signature verification with non-constant-time...
Unpacking the First Documented Agentic — Impact, Detection, and Remediation
Unpacking the First Documented Agentic The cybersecurity community recently faced a significant challenge with the discovery of CVE-2024-28876, a critical command injection vulnerability in Apache...
Configuring Openfire XMPP Chat Server on CentOS 6
INTRODUCTION: Extensible Messaging and Presence Protocol (XMPP) is a communications protocol for message-oriented middleware based on XML (Extensible Markup Language). The protocol was originally...
Installing and Configuring Bro NIDS on CentOS 6
Bro is an open source Unix based network monitoring framework. Often compared to a Network intrusion detection systems (NIDS), Bro can be used to build a NIDS but is much more. Bro can also be used...
Setting up Security Onion — Intrusion Detection and Network Security Monitoring
Setting up a properly installed and well-tuned IDS/IPS system can be time consuming. If you have ever tried to set up a fully-functional Snort system, you are familiar with the time it requires. If...
Offensive Security Certified Professional (OSCP / PWK) — My Experience
Hello guys. Its been a long time coming since I last posted on here and I apologize for the delay. Personal life and my job takes priority over work though, so I hope you can forgive me for this...
Running Wireshark with a Non-Root User in Kali Linux
Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal,...
Pivoting and Port Forwarding Using Metasploit
The main purpose of port forwarding while performing a penetration test is to help us reach a specific port on a system that doesn’t exist on the same network.In order to understand this better...
Anonymous Scanning with Nmap in Kali Linux
Anonymizing your connection is one the main requirements you need to do when you want to do bad things. When you going to scan a website or target host for vulnerabilities undetected so that...
Create Your Own Web Penetration Testing Lab in Kali Linux
Web applications have become common targets for attackers. Attackers can leverage relatively simple vulnerabilities to gain access to confidential information most likely containing personally...
Hack Facebook Credentials Using BeEF
For those of you who don’t know, BeEF (the browser exploitation framework) is a tool that cleverly uses the browser’s built in functionality, javascript and other third party software...
Bypass UAC and Get Admin Privilege in Windows 7 Using Metasploit
Sometimes when you trying to exploit a security hole and success gain an access to the target system, usually you only act as logged user and it’s not a local system account. In this tips and trick...