Automating the boring (pentest) stuff with Terraform and Ansible. Part 2: Scanning

A simple way to automate the repetitive parts of your pentest using typical DevOps tools.

January 28, 2023 · inf0junki3

Automating the boring (pentest) stuff with Terraform and Ansible. Part 1: Recon

A simple way to automate the repetitive parts of your pentest using typical DevOps tools.

January 18, 2023 · inf0junki3

Timesheet simplification with osquery, Splunk and Python!

This post walks through basic osquery and Splunk installation – but with a twist. I use these security tools to monitor for connections so as to keep track of my work hours.

May 17, 2020 · inf0junki3

Attack Jupyter!

A few tips on using jupyter for reverse engineering and pwn challenges.

August 18, 2019 · inf0junki3

Automating pentests with WebDriver

Using WebDriver to automate pentest activities - two use cases and some code.

August 18, 2019 · inf0junki3

Logging Nessus vulnerabilities to graylog

I’ve been beefing up the security of my home network recently. If you were to ask me why, I could rattle out a few good excuses, such as “it’s good to maintain good computer hygiene, especially at home” or “as a fan of CTF’s, I’m concerned that I’ll accidentally pick up something nasty which will own my network”. Oooo, hey, here’s a good one: “to be a good red teamer, you have to know how blue teams operate”....

July 8, 2017 · inf0junki3

Certificate Transparency as a recon technique

I’ve been using certificate transparency with increasing frequency during my network pentests. What a great source of information! I’ve found it so useful that I wrote a short standalone script to search for domains in a transparency log and resolve them to IP addresses. What’s certificate transparency? There’s an actual site dedicated to describing Certificate Transparency (https://www.certificate-transparency.org/), which I recommend you check out. In a nutshell, CT is a mechanism that provides real-time monitoring and auditing of certificate information....

November 4, 2016 · inf0junki3

Decompressing Android Backups With Python

A small script for decompressing android backups written in python, practically no deps.

February 12, 2016 · Inf0Junki3

Metasploit soul-searching: scanning with metasploit

I’ve been trying to expand my knowledge of Metasploit recently. I’ve gotten training which included quite extensive coverage of the framework, for which I’m grateful; but to really get how extensive the tool’s functionality is, there’s nothing quite like practice. With this in mind, I downloaded the metasploitable VM over at sourceforge (http://sourceforge.net/projects/metasploitable/files/Metasploitable2/) and began hacking away at it. When you start working on these things, it’s awful tempting to fall back into ‘CTF mode’, where your only objective is to get in....

April 22, 2015 · inf0junki3

WebSockets

WebSockets are a mechanism that allow a client (typically a web page) to talk to a server without the overhead and complications that web services may pose. The client first establishes a connection using http and then makes a request to switch over to websockets; the process is described in RFC 6455 <https://tools.ietf.org/html/rfc6455>__. Using this technology simplifies development of elaborate web based clients and reduces web traffic, which is pretty sweet for developed and admins alike...

March 14, 2014 · inf0junki3