https://www.gremwell.com/Penetration testers and toolmakers - Belgiumenhttps://www.gremwell.com/spring-n1ql-injectionSummary TL;DR Intro Testbed Couchbase Spring Project Build Experiments Exploitation Conclusion Summary Spring applications quite often use @Query annotation. It helps to control requests executed by database servers, like customising what data to extract. It is usually assumed that @Query is safe…Thu, 30 Sep 2021 12:14:31 +0200pavel967 at https://www.gremwell.comhttps://www.gremwell.com/qsslcaudit_v0.8.3A new version has been released of our tool which we use to assess TLS clients security: v0.8.3. The corresponding packages for various Ubuntu versions are prepared in ppa:gremwell/qsslcaudit. Packaging for Kali is handled by Kali maintainers. Each time you dive into the process of TLS handshake…Mon, 12 Apr 2021 15:55:20 +0200pavel966 at https://www.gremwell.comhttps://www.gremwell.com/jobsWe Are Hiring Pentesters We are looking for a penetration tester. Most of the work is in or around Brussels. At the moment due to COVID lockdowns all work is from home. We are looking for a full-time employee. You'll get a lot of opportunities to hack stuff. Actually, you'll be trying to break…Wed, 02 Dec 2020 10:36:57 +0100alla965 at https://www.gremwell.comhttps://www.gremwell.com/breaking-jcaptcha-tensorflow-aocrIntroduction In early 2020, we had a situation where we wanted to abuse a known username enumeration issue in Atlassian products. The vulnerability allows to enumerate valid username, but if an attacker wants to bruteforce the identified accounts, a CAPTCHA is displayed in the login page and…Mon, 05 Oct 2020 15:08:07 +0200quentin964 at https://www.gremwell.comhttps://www.gremwell.com/blog/reversing_pulse_secure_client_credentials_storeIn early 2019, I had to assess the latest version (9.1r3 at the time) of Pulse Secure Connect Client, an IPSEC/SSL VPN client developed by Juniper. Given that the client allow end users to save their credentials, one of my tests included verifying how an attacker could recover them. The attacker…Mon, 05 Oct 2020 14:50:49 +0200quentin963 at https://www.gremwell.comhttps://www.gremwell.com/firefox-xss-302Initial Discovery During a recent engagement I identified an open redirect where a GET parameter would be reflected as-is in the HTTP response Location header without any kind of sanitization. Something similar to this: Trying multiple kinds of injections, I discovered that newlines and carriage…Wed, 30 Sep 2020 14:49:57 +0200quentin962 at https://www.gremwell.comhttps://www.gremwell.com/blog/remote-command-execution-on-remotepc-for-windowsIntroduction During an audit we executed in 2019, we had to test a deployment where a third party company had to remotely connect to special purpose computers to perform maintenance. At the time, they had chosen a software called RemotePC to remotely login into these special purpose computers…Fri, 08 May 2020 10:38:49 +0200quentin959 at https://www.gremwell.comhttps://www.gremwell.com/blog/dtls-srtpIntroduction TL;DR Twilio Platform Preparing Custom Setup Traffic Interception and Analysis Information Gathering DTLS Demultiplexing Intercepting Traffic to chunderm.gll.twilio.com Signalling Traffic Intercepting DTLS-SRTP Terminating DTLS with SRTP Extension Putting It All Together Spoofing DTLS…Thu, 26 Mar 2020 17:32:53 +0100pavel954 at https://www.gremwell.comhttps://www.gremwell.com/blog/introducing-qsslcauditproxyThe Qsslcaudit tool developed by my colleague Pavel provides an easy way for testing a client SSL implementation. To make testing of multiple connections even more straightforward, I created a proxy wrapper for this tool. How it works The user configures qsslcauditproxy as a proxy server on the…Wed, 18 Mar 2020 11:14:50 +0100sean953 at https://www.gremwell.comhttps://www.gremwell.com/blog/wps-office-casePreface In this post we demonstrate how to use our tool to assess client-side TLS implementation: qsslcaudit. qsslcaudit helps determine if a TLS client (mobile application, standalone application, web service) properly validates server's certificate and if only secure protocols are supported…Fri, 28 Feb 2020 16:24:51 +0100pavel952 at https://www.gremwell.com