In this example, we will demonstrate how to exfiltrate secrets through command injection against a serverless function. Serverless functions listen for events or triggers to be run. It is possible to ...

In this example, we will demonstrate how to use the “template” control word to cause an RTF file to pop up the calculator app when opened. “Hold on... I can use the Start menu to do that. Why should ...

This article examines the two protocols NetBIOS and SMB. SMB ran on top of the NetBIOS protocol in early versions of Windows, but eventually moved to its own dedicated TCP port. While NetBIOS is the o...

Since January 6th, we have been looking at individual SSL/TLS vulnerabilities. This article will provide an overview of the series and provide background information on SSL/TLS for those who are unfam...

In this article, we will look at CVE-2013-0169, also known as the Lucky 13 vulnerability, which exists within SSL and TLS. The TLS protocols 1.1 and 1.2, as well as the DTLS protocols 1.0 and 1.2, do ...

Steampipe is a tool that lets us gather information from AWS (or other sources) and lets us interact with that data the same way we would a relational database via SQL style queries....

As OpenSSL has improved, it has become more challenging to use one binary for testing the full range of modern to legacy SSL/TLS configurations. The reason for that is following Heartbleed; the OpenSS...

This article serves as an introduction to the Secure Shell (SSH) protocol for Linux users. When you need to connect to Linux servers remotely, SSH is the most commonly used method. SSH provides a text...

In this article, we will look at the TLS Renegotiation Vulnerability in the SSL and TLS protocols. This is a plaintext injection attack into previously sent packets. TLS and SSL 3.0 do not correctly a...

In this article, we will look at CVE-2014-8730, also known as the Padding Oracle On Downgraded Legacy Over Transport Layer Security (POODLE over TLS) vulnerability. The vulnerability is caused by a TL...