Update 27 May 2020 @ 13:17 UTC - See bottom Update 27 May 2020 @ 19:48 UTC - Related post analyzing passwords in use: https://nullsec.us/livejournal-password-analysis/ [https://nullsec.us/livejournal-password-analysis/] There's a lot of talk about the LiveJournal breach going on right now. I wasn'

I'm a huge fan of https://makemeapassword.ligos.net/generate/readablepassphrase, and regularly advise people to use it when generating passwords that need to be memorized or typed frequently. However, there's been numerous times people have expressed concerns that they're effectively generating passwords on

I wanted to address a tweet posted today by the UK's National Cyber Security Centre advising people to use three random words as a passphrase. > When choosing your password, use #threerandomwords [https://twitter.com/hashtag/threerandomwords?src=hash&ref_src=twsrc%5Etfw]: memorable but not easy

There's a lot of useless posts going around about this right now. I hope mine is a little more useful since most of these don't mention if this is being exploited in the wild. TL;DR - no, it isn't, no need to panic

Or "Microsoft SQL Express and the Truly Terrible, Just Awful, No Good Downloader" TL;DR up front. 1. On a secondary machine/VM, setup a Burp proxy to use the non-localhost interface (192.168.1.230 in my case) as a proxy. Turn off intercept 2. On your

Update: This event appears for both binaries and websites in build 1809 and 1909, but only for binaries in 1903 (not web). So if you're looking for this event and not finding it, that may be why. I have not confirmed this myself, so if someone else comes

There's really nothing special here except a mildly updated example of the code found here: https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTTUT/RESTsearches#Python_example Basically, updated to python3 due to the impending end-of-life (print() adjustment, and urlencode had changed in Python3). While I was

Wireshark on Red Hat Enterprise Linux is, for some reason, about a decade out of date. The current version available via yum install is 1.10.14. This version was released in June 2013, and reached end of life in June 2015. Now, RHEL might be back-porting security patches (I&

From time to time I need to audit a large number of devices for default credentials. I typically use Metasploits http_login module for this. You can pass it a file of rhosts with something like set rhosts file://root/hosts.txt and have it check numerous systems quickly. However,

I thought this tweet [https://twitter.com/granick/status/1154137384906153985] might make a good blog post. I'm sure everyone in infosec will have their own answers, and all will be, generically, correct. Most of what I've seen is disagreements over one or two of the points,

This appears to be a somewhat recent problem, and when searching for an answer, a lot of posts reference solutions or VMWare KB's that don't help (enabling swap, checking inodes, etc.). This problem appeared somewhere between ESXi-6.7.0-20190104001-standard (Build 11675023) and ESXi-6.7.0-20190404001-standard (Build

TL;DR - I wanted to audit for the presence of a particular username, with a particular password, across every endpoint in our environment. As usual, I had a theory. The theory was that, when we applied LAPS several years ago, there were things that got missed (as their always

I've been in need of a tool that would take two different sets of port numbers, and subtract one set from the other. This would be similar to comm -13, but would be able to act upon ranges in a list (e.g. 8,12,23-56). Scenario Here&

I found a really cool thing several months ago. I was scanning my network from an external perspective (AWS specifically), and found a live host. The very odd thing about this finding is that there were no open ports, no listening services, and ICMP requests were disabled. I -nearly- chalked

I'm re-posting something from redleg/Memory Sieve [https://www.memorysieve.co.uk/2015/10/update-firmware-hp-officejet-6500a-plus.html] regarding HP firmware upgrades. In their case, it was a matter of not being able to install the latest firmware package. However, in my case I wanted to force the reinstall of

While reviewing Windows RDP event logs for the RDP project [https://nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/] , I noticed one in particular. Windows Event ID 1029 can be found under Microsoft-Windows-TerminalServices-RDPClient/Operational.evtx. This event is created on the computer initiating the connection, and contains a hash of the username being used. (update