<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
    <channel>
        <title>All Posts - Malicious Link - Blog by mubix - Rob Fuller</title>
        <link>https://malicious.link/posts/</link>
        <description>All Posts | Malicious Link - Blog by mubix - Rob Fuller</description>
        <generator>Hugo -- gohugo.io</generator><language>en</language><managingEditor>mubix@hak5.org (Rob Fuller)</managingEditor>
            <webMaster>mubix@hak5.org (Rob Fuller)</webMaster><lastBuildDate>Sun, 16 Apr 2023 04:00:00 -0500</lastBuildDate><atom:link href="https://malicious.link/posts/" rel="self" type="application/rss+xml" /><item>
    <title>Simple PHP webshell with php filter chains</title>
    <link>https://malicious.link/posts/2023/simple-php-webshell-with-php-filter-chains/</link>
    <pubDate>Sun, 16 Apr 2023 04:00:00 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2023/simple-php-webshell-with-php-filter-chains/</guid>
    <description><![CDATA[Recently found an LFI in a PHP application and one of the cool things I learned about recently was PHP filter chains. More info here: https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it.html
However, if you are using this in a URL, it&rsquo;s pretty hard to do anything too complicated since it expands the text to the point where web servers won&rsquo;t accept the URL anymore (8190 characters is default max in Apache).
So I used this:]]></description>
</item>
<item>
    <title>Beautiful Basics: Lesson 4</title>
    <link>https://malicious.link/posts/2022/beautiful-basics-lesson-04/</link>
    <pubDate>Wed, 22 Jun 2022 04:00:00 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2022/beautiful-basics-lesson-04/</guid>
    <description><![CDATA[Lesson 4 - User Blaming Security is NOT everyone&rsquo;s job in the company. Stop trying to force the issue. It&rsquo;s security&rsquo;s job to enable, incentivize and protect.
In the Marine Corps, I was taught that every Marine is a &ldquo;Rifleman&rdquo;, meaning that any Marine, no matter their MOS (Military Occupational Specialty) - aka their job, could be called upon to engage with the enemy using a rifle or other weapon.]]></description>
</item>
<item>
    <title>Beautiful Basics: Lesson 3</title>
    <link>https://malicious.link/posts/2022/beautiful-basics-lesson-03/</link>
    <pubDate>Sat, 28 May 2022 03:00:00 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2022/beautiful-basics-lesson-03/</guid>
    <description><![CDATA[Lesson 3 - Detection Reality People and Honey tokens are THE BEST detective tool you have.
Go buy a Thinkst Canary, they detect me more than any multi-million dollar EDR. Period.
Let me clarify something quickly before I get roasted. I am not saying that EDR (Endpoint Detection and Response) agents don&rsquo;t have a place, it&rsquo;s just that they have taken over for Anti-Virus for being mostly preventative and response oriented.]]></description>
</item>
<item>
    <title>Blocking ISO mounting</title>
    <link>https://malicious.link/posts/2022/blocking-iso-mounting/</link>
    <pubDate>Fri, 27 May 2022 03:00:00 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2022/blocking-iso-mounting/</guid>
    <description><![CDATA[Update: 10/15/2022
One of the hard parts of implementing a block like this is the concern that it will &ldquo;break something&rdquo;. The DFIR Report&rsquo;s post on Bumblebee Round 2 has a great suggestion on how to detect legitimate (and illegitimate) use of ISO mounting using Event ID 12 of the Microsoft-Windows-VHDMP-Operational logs. It&rsquo;s not one of the main Application/System/Security logs so you may have to configure your forwarders to start capturing it, but it will give you a good idea of how common it is for your organization to mount ISOs.]]></description>
</item>
<item>
    <title>LDAPSearch Reference</title>
    <link>https://malicious.link/posts/2022/ldapsearch-reference/</link>
    <pubDate>Sat, 14 May 2022 11:00:00 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2022/ldapsearch-reference/</guid>
    <description><![CDATA[ldapsearch is a extremely powerful tool, especially for Windows Active Directory enumeration. It&rsquo;s one of my primary tools when performing pentesting or red teaming against an environment with Active Directory, but also comes in quiet handy to know as many times it can come default installed or part of a base image, so its a bit Living-Off-The-Land-esq. Another point towards ldapsearch is that it&rsquo;s easy to forget that Active Directory isn&rsquo;t the only LDAP server in most environments and the ability to utilize a tool like this can come in extremely handy.]]></description>
</item>
<item>
    <title>Beautiful Basics: Lesson 2</title>
    <link>https://malicious.link/posts/2022/beautiful-basics-lesson-02/</link>
    <pubDate>Sun, 08 May 2022 02:00:00 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2022/beautiful-basics-lesson-02/</guid>
    <description><![CDATA[Lesson 2 - Least Privilege No one should have administrative access. All elevated access should be checked out when you need it and checked back in (automatically if possible). Just like UAC. MFA should be required, proximity or push based. And every use of a break glass account should be highly monitored
I think &ldquo;Least Privilege&rdquo; has been harped on at least &hellip; you know what, let me wager that you can&rsquo;t find a single infosec or hacking conference from 2000 until now (2022) that doesn&rsquo;t have 4 talks with the words &ldquo;least privilege&rdquo; in the talk.]]></description>
</item>
<item>
    <title>Beautiful Basics: Lesson 1</title>
    <link>https://malicious.link/posts/2022/beautiful-basics-lesson-01/</link>
    <pubDate>Sat, 07 May 2022 01:00:00 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2022/beautiful-basics-lesson-01/</guid>
    <description><![CDATA[Lesson 1 - YOU could be &ldquo;Legacy&rdquo; Stop thinking that just because it did or didn’t work X way when you learned it, it still does or doesn&rsquo;t. That could be 20 years ago. Technology changes faster than you do.
I guess that&rsquo;s a bit mean for a title but here&rsquo;s the thing:
One of the greatest yet most challenging things about doing any job in technology is staying current.]]></description>
</item>
<item>
    <title>Beautiful Basics - Series</title>
    <link>https://malicious.link/posts/2022/beautiful-basics/</link>
    <pubDate>Mon, 02 May 2022 00:00:00 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2022/beautiful-basics/</guid>
    <description><![CDATA[Today I keynoted @BSidesVancouver. It was an honor to be asked and I had a great time.
Conference Link: https://hopin.com/events/bsides-vancouver-2022/
I talked about 11 lessons learned over my career that contradict some of the edicts that are well known in the Cyber Security space.
Before we get into the lessons though, let me attack the things I know many of you reading this already have queued up in your head.]]></description>
</item>
<item>
    <title>User Empowerment: Password Security</title>
    <link>https://malicious.link/posts/2021/user-empowerment-password-security/</link>
    <pubDate>Tue, 27 Apr 2021 09:30:44 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2021/user-empowerment-password-security/</guid>
    <description><![CDATA[World Password Day (who knew that was a thing?) is upon us. It is the first Thursday of May every year, and that falls on May 6th this year.
I&rsquo;m not sure how to start this blog post, but the meat of what I want to get into is password security and the evolution over the years.
In the 1900s (&hellip; yes people are saying that now&hellip; feel old yet?), password security was pretty simple.]]></description>
</item>
<item>
    <title>SolarFlare Release: Password Dumper for SolarWinds Orion</title>
    <link>https://malicious.link/posts/2020/solarflare-release-password-dumper-for-solarwinds-orion/</link>
    <pubDate>Tue, 15 Dec 2020 00:30:44 -0500</pubDate>
    <author>Rob Fuller</author>
    <guid>https://malicious.link/posts/2020/solarflare-release-password-dumper-for-solarwinds-orion/</guid>
    <description><![CDATA[TL;DR Here are the concerns I have regarding the SolarWinds/FireEye breach:
The accounts stored in an organization&rsquo;s SolarWinds Orion may be underestimated. I recently did a pentest for a firm that had over 200 credentials stored in their SolarWinds Orion database, but only 15 showed in the interface (the SolarWinds credential interface is complicated with sections for each connection type and different panes for each, it may also not properly delete credentials from the database when &ldquo;removed&rdquo; from the interface, I am unsure).]]></description>
</item>
</channel>
</rss>
