The Random Adventure That Is Life (RATIL)

The Random Adventure That Is Life (RATIL)

Sign in Subscribe

Docker Image Builds Behind ZScaler Proxy

Docker Image Builds Behind ZScaler Proxy

I recently ran into an issue while trying to build the DefectDojo Docker images due to being behind a corporate ZScaler Proxy. The issue is that the default DOcker images don't trust the ZScaler CA and therefore will fail any HTTPS interactions during the build process. There are

Tips For Coaching Youth Soccer

Tips For Coaching Youth Soccer

I am onto my second season coaching my son's soccer team and my third season as a youth coach overall. I doubt I am even near the top tier of coaches but I have learned a few things that have helped me out a ton! This is for

Lies My Youth Pastor Told Me

Lies My Youth Pastor Told Me

Sometimes in today's world, I wonder how self-avowed Christians can act the way they do, say the things they say, and support the people they support. There seems to be some major cognitive dissonance between the things we learned in church and how we act in the real

Hack The Box: GreenHorn

Hack The Box: GreenHorn

Initial Recon NMAP The service on port 3000 seems interesting. Web Port - 80 Clicking on admin at the bottom takes you to a login page that indicates the system is running pluc 4.7.18. Which is vulnerable to an RCE. Pluck v4.7.18 - Remote Code Execution

Hack The Box: Cicada

Initial Recon NMAP SMB SMB is exposed so let's try some common attacks there, including RID Brute forcing to find some valid users. * john.smoulder * sarah.dantella * michael.wrightson * david.orelious * Dev Support * emily.oscars These might be good users to start a brute force attack with. We

Hack The Box: PermX

Hack The Box: PermX

Initial Recon NMAP Web Port PermX Appears to be an eLearning Platform but does not load properly due to apparently Burp proxying the traffic. Disabling Burp lets the site load normally. Reviewing all the linked pages doesn't provide much other than the business model and some team member

Hack The Box: Sightless

Hack The Box: Sightless

Recon NMAP Interesting things: * FTP -ProFTPD * SSH * Web server at sightless.htb Web Server Did some virtual host brute forcing that did not turn up anything new. Directory scanning I found the icones directory. This just 403s, not useful. The page has a link to http://sqlpad.sightless.htb/ SQLPad

SANS 2024 Holiday Hack Challenge - Act 2

SANS 2024 Holiday Hack Challenge - Act 2

Continuing the challenge after the Prologue and Act 1 this set of challenges is set in the North Pole DMZ it seems. Mobile Analysis Eve Snowhoses has provided us with a debug and release version of an Android app called Santa Swipe for managing the Naughty/Nice List. The first

SANS 2024 Holiday Hack Challenge - Act 1

SANS 2024 Holiday Hack Challenge - Act 1

See my previous post for the Prologue. After departing the Geese Islands, we make our way back to the North Pole for some new challenges so help find Santa. cURLing The first part of this challenge is just some simple curl-foo that isn't too difficult. The man page

SANS 2024 Holiday Hack Challenge - Prologue

SANS 2024 Holiday Hack Challenge - Prologue

If you aren't familiar, I highly suggest taking a look at the 2024 SANS Holiday Hack Challenge and the previous years as well. These challenges are so well put together and cover very modern and applicable topics in security. This year, the challenge is split into four time-released

Hack The Box: Editorial

Hack The Box: Editorial

Recon NMAP Web Port The web page appears to be a book review site. The "Publish with us" page allows for some info entry and a file upload. The "About" page includes and additional domain tiempoarriba.htb Initial Access Upload Page The "Cover URL"

iPhone RCS With PFSense (or other firewalls)

iPhone RCS With PFSense (or other firewalls)

My wife's iPhone just got its update to allow for RCS chat, but we noticed it was not working as intended. My first assumption was a firewall rule, and sure enough, I was able to find the issue. Looking in the Firewall Logs, I see multiple blocks for

Databricks Security Alerts in Azure

Databricks Security Alerts in Azure

Introduction Through a LinkedIn connection at Obsidian Security, I found a link to a Security Best Practices For Azure Databricks document. The document includes threat models for 7 attack types as well as Protect, Detect, and Respond recommendations for each. 1. Account takeover or compromise 2. Data exfiltration 3. Insider

Hack The Box: BoardLight

Hack The Box: BoardLight

I just wanted a quick win, so I decided to go for one of the easy boxes today. Recon My initial scan reveals just SSH and a web site open. As expected, we have a website with some clues and functionality to test. * Email: [email protected] * Newsletter signup * Request

SolarLab

Recon Ooohhh, a Windows machine! The website is for an instant messaging app called SolarLab IM. Things to try from here: * Web app exploration * Subdomain brute * Path brute * Functionality * Host * SMB user/pass brute force * Interesting port 6791 Web App Exploration Potential usernames from employee names: * Alexander Knight * Claudia Springer

Hack The Box: Intuition

Hack The Box: Intuition

This is a big of a slog and rambling run through of this challenge. This one was hard for me due to the high number of avenues required to be investigated for root. There were red herrings and many necessary paths to explore. Recon Looks like the web service on

Hack The Box Sherlocks: CrownJewel2

Hack The Box Sherlocks: CrownJewel2

If you have not yet set up an environment for viewing logs, I suggest you check out my writeup on that process. I needed to use most of the hints on this one because I have not worked in a Windows domain environment for a while, but it was fun

Log Viewing Environment Setup

Log Viewing Environment Setup

I just discovered Hack The Box Sherlocks; defensive challenges that generally involve some sort of log analysis. To get ready to tackle these challenges, I needed an environment to parse and view the logs. For the easiest process, I decided to go with Security Onion. I have not used SO

Air Force/Industry Management Perspectives

Air Force/Industry Management Perspectives

I just finished up two weeks of Air Force duty to take our Cyber 300 Continuing Education course. The course was a great update for me about the latest changes across the Air Force cyber community. While there though, I noticed a handful of non-cyber discussions that seem to highlight

Manually Run Timer-Triggered Azure Functions

Manually Run Timer-Triggered Azure Functions

When developing and testing Azure Functions, it may be necessary to manually trigger the deployed function for testing purposes. I am simply documenting this here so that it is easier to find when I inevitably need it again. Microsoft has a great write up on how to do this, but

Flight Simulator and PilotEdge For IFR Training

Flight Simulator and PilotEdge For IFR Training

DISCLAIMER: I am not an instructor. Real flight training is necessary to maintain proficiency. I am in the middle of my Instrument Rating training. While the basics of instrument flying make sense to me, I still find myself jumbling up read backs, taking longer than I should to set up

Cobalt Strike C2 Profiles - HTTP

Cobalt Strike C2 Profiles - HTTP

Cobalt Strike does provide documentation on creating and editing C2 profiles but the documentation is limited and not clear in places. This is an attempt to clarify some of the areas that confused me initially. Context This specifically focuses on the HTTP GET and HTTP POST definitions; C2 Profiles control

Why Parental Leave Is So Important

Why Parental Leave Is So Important

Hopefully by this point, there is no confusion about how important parental leave is for new parents. While maternity leave is unique in that new mothers often require time to recover and recuperate from the mental and physical trauma of childbirth, the more general parental leave is also supremely important

Hack The Box: Sau

Hack The Box: Sau

Enumeration Port 80 doesn't give me anything but port 55555 reveals what looks like a Python-based web app. The application appears to be some sort of app to inspect HTTP requests that are sent to the application. There is a function to enter a master token that allows

Hack The Box: Keeper

Hack The Box: Keeper

Enumeration As always, start off with an NMAP Scan Just 80 and 22 open today. We will start by enumerating the web app. To make some of this work easier, I am going to add keeper.htb and tickets.keeper.htb to my hosts file. Navigating to the linked site