Testing Oracle Forms

SANS Institute accepted my GWAPT Gold Paper about testing Oracle Forms applications, the paper is now published in the Reading Room. Forms is a typical example of proprietary technology that back in the day might have looked a good idea from business perspective but years later causes serious headaches on...

1 minute read

CVE-2014-3440 - Symantec Critical System Protection Remote Code Execution

Today we release the details of CVE-2014-3440, a remote code execution vulnerability in Symantec Critical System Protection. You can get the detailed advisory on the following link: CVE-2014-3440 – Symantec Critical System Protection Remote Code Execution We reported the vulnerability with the help of Beyond Security, Symantec fixed the vulnerability...

3 minute read

The story of a pentester recruitment

Intro Last year we decided to expand our pentest team, and we figured that offering a hands-on challenge would be a good filter for possible candidates, since we’ve accumulated quite a bit of experience from organizing wargames and CTF at various events. We provided an isolated network with three hosts...

9 minute read

AIX for Penetration Testers

Renewal paper of my GIAC Penetration Tester certification: http://www.giac.org/paper/gpen/6684/aix-penetration-testers/125890 Enjoy!

1 minute read

Code Review on the Cheap

At the 31. Chaos Communication Congress I had the pleasure to watch the presentation of Fabian Yamaguchi about the code analysis platform Joern. I’ve heard about this tool before at Hacktivity but this time I could have deeper view on the internals and the capabilities of the software that inspired...

2 minute read

WebLogic undocumented hacking

During an external pentest – what a surprise – I found a WebLogic server with no interesting contents. I searched papers and tutorials about WebLogic hacking with little success. The public exploitation techniques resulted in only file reading. The OISSG tutorial only shows the following usable file reading solution: curl...

5 minute read

How to get root access on FireEye OS

1. Background A couple of months ago we had the opportunity to take a closer look at a FireEye AX 5400 malware analysis appliance. The systems of FireEye are famous for catching targeted attacks that tend to evade traditional security systems, so we were really excited to find out more...

3 minute read

HP-UX 0day local privilege escalation

We worked for a big company in Hungary and there were some HP-UX targets. I got local user access easily to the servers but the operating system was HP-UX 11.31 without public privilege escalation sploit. This is not a big deal, this happens very often. I checked the backups, the...

2 minute read