Cover photo

EZPZ Complex Passphrases with Bitwarden

There's an uber-easy way to generate what I think are arguably great passphrases within Bitwarden that are actually easy for users to type out if they need to manually enter them, opposed to the random character generated slop that ends up with normal users writing it down on a sticky note and putting inside of their desk drawer (please don't do that). I'll keep this short and sweet. Navigate into the app for the password manager Bitwarden and select the "+" button at the bottom to add a new ...

#password#passphrase#bitwarden#security
Cover photo

An Infinite Free Trial of Pixelmator Pro

I fully intend to buy this software, I'm just making sure it doesn't go extinct first... As I'm not a fan of setting money on fire. No piracy (or whatever else) is endorsed here.For ages I used Canva like a pleb... and eventually moved to using Affinity Designer on my iPad. For the longest time something felt missing though, there was a gap in the middle between the two as Canva was much too simple and the perpetually online browser use sucked. Affinity was great locally, but the layout of th...

#cracking#patching#trial#pixelmator
Cover photo

Why is the Content-Security-Policy Header so Important?

TL;DR: Defense-in-depth. There's a reason a lot of these protections exist in the first place. Please use them.I know most places will auto-categorize a missing Content-Security-Policy (CSP) as an informational severity finding until cross-site scripting (XSS) is found, as there isn't technically a vulnerability (yet). I'm a huge fan of defense-in-depth, so while I support a default low rating, I know it'll never happen to the current specifications and rating schemes. Just keep in mind that ...

#csp#content-security-policy#headers#strict#defense-in-depth
Cover photo

🎉 More AppleScript Malware 🎉 via Web3 Game Rune/Rise Online

A new account shot me a DM in Twitter with some malware, so I figured "why not?". Of course the standard procedure applies:Do you want a job as an admin / moderator? Pays $500 a week!Sends a malicious link.Part of the requirement is creating an account through the software after you download it.Aaaaand of course it's just straight up malware that steals everything. EZPZ.Let's jump into it.InfoURLhttps[://]runeonline[.]gamesURLScan.iohttps://urlscan.io/result/cf8cb6ac-7428-4a21-b182-292e6fcd4a...

#malware#macos#web3#crypto
Cover photo

Don't Tie AuthZ to a Referer Header...

Recently I saw a vulnerability that was very new to me. I've seen authN and authZ tied to some super random things in the past; ad tracking IDs, the literal username in a header, etc, but this one takes the cake for being weird to spot. It also highlights why the headers and their values need to be interrogated for both requests and responses. Starting the test there was a previous instance of an IDOR related to accessing uploaded files. The original vulnerability was pretty bad as it allowed...

#authz#referer#mflac#file_upload#headers
Cover photo

Achieving an ATO via IDOR, then Reviewing the Fix

Welcome! Recently I've been pretty busy settling into a new role performing web application penetration testing and I thought I'd go over a...

#web application#penetration testing#pentesting#wapen#ato#idor
Cover photo

Using Golang to Launch AppleScript Through ARM64 Binaries

The past two macOS samples I've looked at (Poseidon and Atomic Stealer) have heavily utilized AppleScript for their functionality. While looking at t...

#macos#apple#go#golang#applescript
Cover photo

Sailing the High Seas with the Poseidon Info Stealer

I've been exploring the world of macOS malware analysis, and as a newbie I wanted some more samples to practice on. This prompted me to head over to ...

#malware#poseidon#analysis
Cover photo

Backing Up a Scam: Making Sure Malicious Websites & Binaries can still be Studied

Ephemeral Sites & InfrastructureEphemeral: lasting a very short time; short-lived; transitory:The nature of malicious sites and infrastructure leads ...

#malware#scam#methodology#web3
Cover photo

Party Royale / Party World Web3 Scam & Malware Analysis

Recently I've been reached out to two different parties on Twitter via DMs. Both advertising jobs, ranging from marketers, to ambassadors, to blockch...

#security#web3#malware#scam#discord#twitter#social media#phishing#social engineering