Offensive-Security on krash.dev

My Experiments with Raspberry Pi Pico - Poor Man's Rubber Ducky

Sat, 04 Feb 2023 00:00:00 +0000

Mr. Robot Season 2 Episode 9 - “Rubber Duckie, You’re The One” - I was fascinated by this piece of technology when I first saw it many years ago. Then I looked it up on the internet to learn more about it, and it turned out to be HID, or Human Interface Device. It basically imitates users and executes code or performs actions in their place.

Since the real rubber ducky was out of my budget, I looked for alternatives and discovered that similar behaviour to the rubber ducky can be achieved using a less expensive piece of hardware - the Raspberry Pi Pico (7$).

Anonymous Challenge Write-Up: WinjaCTF c0c0n 2021

Mon, 15 Nov 2021 00:00:00 +0000

WinjaCTF at c0c0n [2021]: I developed an easy challenge - called “Anonymous” - the challenge was based upon browser forensics.

TL;DR#

Intended Way - Download the zip > Extract it > Navigate the Linux directory structure > To find a directory called .config > google-chrome > Default > Open the History File in SQL Browser > Search for URLs and upon up the URL to get a file with the name - formatted like flag.

This is why you need a personal Collaborator Client!

Tue, 22 Jun 2021 00:00:00 +0000

If you have used Burp’s collaborator client for your Out-of-band testing, you know it’s awesome. Then why there is a need for a personal collaborator client? There are a few things that need to be addressed.

Companies have started to blacklist burp collaborator’s domain, making it difficult for OOB vulnerabilities detection. (Read here)
Collaborator client is not available for the community/free edition of BurpSuite.

This brings the need for having a personal collaborator client, with no to minimal investments, that will help us in the detection of any out-of-band/blind vulnerabilities, and I have linked an amazing cheatsheet below that will guide in OOB Exploitation. So, let’s get started. Below are the things required for our recipe to cook:

How does burp proxy work?

Mon, 07 Jun 2021 00:00:00 +0000

What’s a proxy?#

A proxy acts as a gateway between you and the internet. The internet traffic flow back and forth if a proxy is setup in the middle. So, what is the need of proxy? There are several reasons organizations and individuals use proxies:

Control and monitor internet usage
Proxy servers can give better speed and bandwidth by caching websites
Proxy servers can also be setup along with VPNs to provide anonymity and better security

There are different types of proxies, but a specific type of proxy that we are going to talk about in this blog is interception proxy.

Exam Experience: CEH v10

Fri, 27 Nov 2020 00:00:00 +0000

July 6th, 2020: It all started with this mail. I received a scholarship for CEH Practical (applied two times xD) and I had to pay $99 to take the exam.

I guess it was worth it. Battling with college and other stuff, I used to think I am not ready yet and kept on postponing it until 6th of November, 2020. I finally took the exam and passed it easily, and now that I look back, I could have done it then as well, but yeah.

Bug Bounty Summit CTF Writeup

Mon, 02 Nov 2020 00:00:00 +0000

The CTF is live on Hacker101 as Grayhatcon CTF – Hacker101 CTF

The CTF was built upon real vulnerabilities found during bug bounties. It had four flags – 250 points each.

Objective - Hackerone’s Username and Password database has been leaked and put on an auction. Our task was to delete the auction listing before anyone buys it.

We were given an IP, which resolved to a web application. On performing some basic information gathering, I found out some stuff.

Hacking Is Not Black & White

Sun, 01 Nov 2020 00:00:00 +0000

This is related to a talk given by me and pre & post-event activities, that were conducted at Developer Circles, Pune and Bengaluru.

It all started with DEFCON 2020 Red Team Village CTF, my team and I reached the Top 50 and it was just amazing for all of us. It was an enriching experience, solving challenges from a wide range of categories and learning new stuff in the process. One section of the CTF dealt with Malware Analysis and I was fascinated by this domain of security and have been learning about it.