Penetration Testing

Trojan Source: Raw-Bin Hood Pick Pocketing Source Code with Unicode Bidirectional Control Characters

Date: November 5, 2021
Author: Joseph Lee
Comments: 0 Comments
Categories: General, Information Technology, IT Security, Penetration Testing

A new type of vulnerability has been disclosed by researchers at Cambridge University in the UK where Unicode Bidirectional Control Characters are used to change the way text appears in the IDE or text editor compared to how the compiler will interpret and compile the source code into an executable. Proof of concept code has been released for virtually every language including C, C#, C++, Go, Java, Ruby, Python, JavaScript, Rust, and more. Here is a link to the original paper, a GitHub repository released by the authors that includes proof-of-concept code samples for virtually every popular language and the issued CVEs CVE-2021-42574 and CVE-2021-42694, both having severity score of 9.8 “Critical”. Unicode Bidirectional Control Characters are needed in Unicode because Unicode is meant as a super encoding standard which allows all languages (and even emojis) to be contained in a single encoding standard as opposed to say, ASCII which…

CompTIA PenTest+ PT0-001 & PT0-002 Study Notes

Date: October 2, 2021
Author: Joseph Lee
Comments: 0 Comments
Categories: CompTIA Pentest+, Cybersecurity Introduction, IT Security, Penetration Testing, Pysical Penetration Testing

These study notes are provided for students of CompTIA Pentest+ exam. If you notice any problems with the notes, please let me know via email (joseph@ripplesoftware.ca). General Pentesting Engagement Scoping Information Gathering Vulnerability Scanning Exploitation Process Pentest Tools Exploit Specifics Post Exploit Communication Processes

Physical Pentesting – LockPicking Lawyer is the Guru with the Goods

Date: June 7, 2021
Author: Joseph Lee
Comments: 0 Comments
Categories: IT Security, Penetration Testing, Pysical Penetration Testing

The LockPicking Lawyer on Youtube is a highly skilled locker picking professional. His videos sure to amaze and are a wealth of knowledge to pentesters looking for physical penetration testing attacks. However, not all of his videos attack the keyway with a set of picks. His videos that use other technology to bypass locks and security devices tell a very interesting tale about the state of the art of technology. I have included some of his videos with a brief description, all of which demonstrate different aspects of lock bypassing. In the first video, you see a new device on the market which is specially designed to take images of the inside of a Kwikset Smartkey keyway. The product is from a company called LockTech LTKSD, and costs about $350 USD. The implication is that this could be used to quickly build a physical key that can work with a…

« 1 2