Home / Archive: 2013
Notes first published in 2013.
A look at how attackers enumerate WordPress usernames and brute-force logins, and the defences that stop it: rate limiting, disabling XML-RPC multicall, and two-factor authentication.
Read moreTomcat's AJP connector on port 8009 trusts whoever connects to it; firewalling off the usual HTTP port while leaving AJP reachable quietly defeats the protection entirely.
Read moreA short conference note on an RF-focused security talk, and why software-defined radio made wireless protocol research accessible to far more researchers.
Read moreIf the negotiation traffic an IPSec/L2TP VPN needs to agree encryption is blocked, some clients fall back to an unencrypted tunnel instead of refusing to connect at all.
Read moreA conceptual walkthrough of how ping sweeps, threaded port scanning and service fingerprinting combine into a network reconnaissance workflow, and why it requires explicit authorisation.
Read moreApplication servers like JBoss and WebLogic encrypt stored credentials reversibly rather than hashing them, because the server must get the plaintext back to connect; that design has real limits.
Read moreOlder wireless keyboards transmitted keystrokes over radio with little real encryption; software-defined radio turned intercepting and decoding that signal into an accessible research exercise.
Read moreA short primer on why volatile memory, not just the disk, holds evidence forensic investigators need, and why capturing it correctly and early matters.
Read moreA tiny shell one-liner that hunts a compromised Linux box for config and history files shows why post-exploitation enumeration is cheap and effective.
Read moreAn old PHP scanning and credential-guessing concept, built to run from inside a compromised web host, illustrates internal-network risk after a breach.
Read moreCVE-2013-1464: an unsanitised flashvar in the Audio Player WordPress plugin's bundled SWF allowed script execution in the page context.
Read moreCVE-2013-1463: the zeroclipboard SWF shipped with WP-Table Reloaded passed an unsanitised id parameter into an ActionScript call, enabling script injection.
Read moreA brief look at why browsers and backends disagreeing on how to parse the same URL is still a quiet source of security bugs.
Read more