https://silentrobots.com/page/Recent content in Pages on Willis VandevanterHugo -- gohugo.ioen-usMon, 16 May 2022 00:00:00 +0000https://silentrobots.com/advisories/Mon, 16 May 2022 00:00:00 +0000https://silentrobots.com/advisories/<ul> <li>CVE-2025-6031 - Amazon Cloud Cam</li> <li>Multiple Advisories in SAP Products</li> <li>CVE-2014-9320</li> </ul> <p>A critical privilege escalation vulnerability found using a fun fuzzing technique for BO</p> <ul> <li>SAP Advisory 2039905</li> </ul> <p><a class="link" href="https://www.ruby-lang.org/en/news/2014/10/27/rexml-dos-cve-2014-8080/" target="_blank" rel="noopener" >Denial of Service XML Expansion (CVE-2014-8080)</a></p> <ul> <li>For good reason it wasn&rsquo;t advertised, the PoC could remotely DoS any Rails installation with little effort.</li> </ul> <p><a class="link" href="https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-08-06/sa-core-2014-004-drupal-core-denial" target="_blank" rel="noopener" >CVE-2014-5265, CVE-2014-5266, CVE-2014-5267</a></p> <ul> <li>This impacted all versions of Drupal and Wordpress.</li> </ul> <p><a class="link" href="https://seclists.org/fulldisclosure/2014/Oct/36" target="_blank" rel="noopener" >SAP HANA Web-based Development Workbench Code Injection (SAP Advisory 2015446)</a></p> <p><a class="link" href="https://seclists.org/fulldisclosure/2014/Oct/42" target="_blank" rel="noopener" >Unauthenticated Username Enumeration in Business Objects (SAP Advisory 2001109)</a></p> <p><a class="link" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8310" target="_blank" rel="noopener" >Unauthenticated Remote Crash of Business Objects (CVE-2014-8310)</a></p> <ul> <li>Also found via the same fuzzing technique</li> <li>SAP Advisory 2001106</li> </ul> <p><a class="link" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8311" target="_blank" rel="noopener" >Information Disclosure in Business Objects (CVE-2014-8311)</a></p> <ul> <li>SAP Advisory 1998990</li> </ul> <p><a class="link" href="https://nvd.nist.gov/vuln/detail/CVE-2014-8308" target="_blank" rel="noopener" >XSS in Business Objects (CVE-2014-8308)</a></p> <ul> <li>SAP Advisory 1941562</li> </ul> <p><a class="link" href="https://nvd.nist.gov/vuln/detail/CVE-2014-8314" target="_blank" rel="noopener" >Multiple XSS in SAP HANA (CVE-2014-8314)</a></p> <ul> <li>SAP Advisory 2009696</li> </ul> <p><a class="link" href="https://nvd.nist.gov/vuln/detail/CVE-2014-5172" target="_blank" rel="noopener" >Multiple XSS in SAP HANA (CVE-2014-5172)</a></p> <ul> <li>SAP Advisory 1993349</li> </ul> <p><a class="link" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3134" target="_blank" rel="noopener" >Multiple XSS in SAP BO (CVE-2014-3134)</a></p> <ul> <li>SAP Advisory 1931399</li> </ul> <p><a class="link" href="https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=451071888" target="_blank" rel="noopener" >Multiple Advisories in SAP Products</a></p> <p><a class="link" href="https://nvd.nist.gov/vuln/detail/cve-2010-0219" target="_blank" rel="noopener" >CVE-2010-0219</a></p> <ul> <li>On paper, it was a default password issue 🤷. In practice, it was an application that was packaged with many products that allowed trivial RCE out of the box and a nice metasploit module.</li> <li>SAP Advisory 1432881</li> </ul> <p><a class="link" href="https://seclists.org/bugtraq/2010/Aug/359" target="_blank" rel="noopener" >FCKEditor.NET File Upload Code Execution</a></p> <h1 id="selected-bug-bounties">Selected Bug Bounties </h1><p>I have had a mixed experience with bug bounties. I think in total I have received a bounty or Hall of Fame from 40+ companies; not a ton but enough to see some of the good and bad. Below are some programs I really enjoyed participating with.</p> <ul> <li>AT&amp;T</li> </ul> <p>Top 50 hacker at one point.</p> <p><a class="link" href="https://www.bugcrowd.com/blog/the-2018-mvp-researchers/" target="_blank" rel="noopener" >Bugcrowd MVP 2018</a></p> <ul> <li>2019 I had the points and bugs, but one of the programs unfairly gave me a negative rating which dropped me below the threshold. As you can tell, I am still salty 👷.</li> </ul> <p><a class="link" href="https://www.mozilla.org/en-US/security/bug-bounty/web-hall-of-fame/" target="_blank" rel="noopener" >Mozilla</a></p> <ul> <li>I believe I had the highest payout for a Web bounty up to that point.</li> </ul> <p><a class="link" href="https://bugcrowd.com/tesla/hall-of-fame" target="_blank" rel="noopener" >Tesla</a> <a class="link" href="https://bugcrowd.com/" target="_blank" rel="noopener" >HP</a></p> <ul> <li>I had a handful of critical bugs in devices including RCE but the details are unfortunately private.</li> </ul> <p><a class="link" href="https://hackerone.com/ibm/thanks" target="_blank" rel="noopener" >IBM</a> <a class="link" href="https://hackerone.com/slack/thanks" target="_blank" rel="noopener" >Slack</a></p>https://silentrobots.com/presentations/Mon, 16 May 2022 00:00:00 +0000https://silentrobots.com/presentations/<h2 id="owasp-global-appsec-2024">OWASP Global AppSec 2024 </h2><ul> <li><a class="link" href="https://www.youtube.com/watch?v=1TdpDBZj7RA" target="_blank" rel="noopener" >GraphQL Exploitation: Secondary Context Attacks and Business Logic Vulnerabilities</a></li> </ul> <h2 id="defcon-recon-village-2024">Defcon Recon Village 2024 </h2><ul> <li><a class="link" href="https://www.youtube.com/watch?v=HY69ARr0b6M" target="_blank" rel="noopener" >Bypassing WHOIS Rate Limiting &amp; Tracking Fresh Domains</a></li> </ul> <h2 id="las-vegas-bsides-2024">Las Vegas BSides 2024 </h2><ul> <li><a class="link" href="https://www.youtube.com/watch?v=zGBty3bXORU" target="_blank" rel="noopener" >Bypassing WHOIS Rate Limiting &amp; Tracking Fresh Domains</a></li> </ul> <h2 id="black-hat-usa-trainings-2019-accepted">Black Hat USA Trainings 2019 (Accepted) </h2><ul> <li><a class="link" href="https://twitter.com/blackhatevents/status/1109123860555878401" target="_blank" rel="noopener" >&ldquo;The Web Application Hacker Level-Up Lab&rdquo;</a> <ul> <li>Unfortunately we couldn&rsquo;t fill the class in Las Vegas. It was delivered in Buenos Aires instead with the help of Include Security. Thank you!</li> </ul> </li> </ul> <h2 id="owasp-maine">OWASP Maine </h2><ul> <li>Best Fit Mapping Attacks</li> </ul> <h2 id="pluralsight-training-2017">Pluralsight Training 2017 </h2><ul> <li>Video: <a class="link" href="https://www.pluralsight.com/courses/writing-penetration-testing-reports" target="_blank" rel="noopener" >&ldquo;Writing Penetration Testing Reports&rdquo;</a></li> </ul> <h2 id="pluralsight-training-2016">Pluralsight Training 2016 </h2><ul> <li>Video: <a class="link" href="https://www.pluralsight.com/courses/external-footprinting-reconnaissance-mapping" target="_blank" rel="noopener" >&ldquo;External Footprinting: Reconnaissance and Mapping&rdquo;</a></li> </ul> <h2 id="black-hat-usa-arsenal-2016">Black Hat USA Arsenal 2016 </h2><ul> <li>Overview: <a class="link" href="https://www.blackhat.com/us-16/arsenal.html#serpico" target="_blank" rel="noopener" >&ldquo;SERPICO&rdquo;</a></li> </ul> <h2 id="black-hat-usa-2015">Black Hat USA 2015 </h2><ul> <li>Video: <a class="link" href="https://www.youtube.com/watch?v=LZUlw8hHp44" target="_blank" rel="noopener" >&ldquo;Exploiting XXE in File Upload Functionality&rdquo;</a></li> </ul> <h2 id="black-hat-webcast-november-2015">Black Hat Webcast November, 2015 </h2><ul> <li>Webinar: <a class="link" href="https://www.blackhat.com/html/webcast/11192015-exploiting-xml-entity-vulnerabilities-in-file-parsing-functionality.html" target="_blank" rel="noopener" >&ldquo;Exploiting XXE in File Upload Functionality&rdquo;</a> <ul> <li>The webinar was updated to include more file types; PDF, JPG, and GIF</li> </ul> </li> </ul> <h2 id="beacon-2015">BeaCon 2015 </h2><ul> <li>&ldquo;Building (Simple) Fuzzing Scripts from Wireshark Dissectors&rdquo;</li> </ul> <h2 id="black-hat-usa-arsenal-2015">Black Hat USA Arsenal 2015 </h2><ul> <li>Overview: <a class="link" href="https://www.blackhat.com/us-15/arsenal.html#serpico" target="_blank" rel="noopener" >&ldquo;SERPICO&rdquo;</a></li> </ul> <h2 id="black-hat-europe-2014">Black Hat Europe 2014 </h2><ul> <li>Video/Slides: <a class="link" href="https://www.blackhat.com/eu-14/briefings.html#blended-web-and-database-attacks-on-real-time-in-memory-platforms" target="_blank" rel="noopener" >&ldquo;Blended Web and Database Attacks on Real-Time, In-Memory Platforms&rdquo;</a> <ul> <li>I couldn&rsquo;t make the talk unfortunately.</li> </ul> </li> </ul> <h2 id="troopers-2014">Troopers 2014 </h2><ul> <li>Video: <a class="link" href="https://troopers.de/events/troopers14/41_hiding_the_breadcrumbs_anti-forensics_on_sap_systems/" target="_blank" rel="noopener" >&ldquo;Hiding the breadcrumbs: Anti-forensics on SAP systems&rdquo;</a> <ul> <li>Really fun presentation on hiding actions in SAP</li> </ul> </li> </ul> <h2 id="troopers-2014-1">Troopers 2014 </h2><ul> <li>Video: <a class="link" href="https://troopers.de/events/troopers14/39_sap_businessobjects_attacks_espionage_and_poisoning_of_business_intelligence_platforms/" target="_blank" rel="noopener" >&ldquo;SAP BusinessObjects Attacks: Espionage and Poisoning of Business Intelligence platforms&rdquo;</a> <ul> <li>Another round of BO research, quite a few advisories came from this.</li> </ul> </li> </ul> <h2 id="blackhat-arsenal-2014">BlackHat Arsenal 2014 </h2><ul> <li>Overview: <a class="link" href="https://www.blackhat.com/us-15/arsenal.html#serpico" target="_blank" rel="noopener" >&ldquo;SERPICO&rdquo;</a></li> </ul> <h2 id="rapid7-whiteboard-wednesday">Rapid7 Whiteboard Wednesday </h2><ul> <li>Post/Video: <a class="link" href="https://www.rapid7.com/blog/post/2013/03/27/open-s3-buckets/" target="_blank" rel="noopener" >&ldquo;There&rsquo;s a Hole in 1,951 Amazon S3 Buckets&rdquo;</a></li> </ul> <h2 id="defcon-skytalks-20-2012">Defcon Skytalks 20 (2012) </h2><ul> <li>&ldquo;Interface Puncher&rdquo; <ul> <li>This talk focused on fingerprinting web applications and bruteforcing credentials. Cool idea, but didn&rsquo;t really take off.</li> </ul> </li> </ul> <h2 id="defcon-19-2011">Defcon 19 (2011) </h2><ul> <li>Video: <a class="link" href="https://www.youtube.com/watch?v=LbzgHN5_BDM" target="_blank" rel="noopener" >&ldquo;Metasploit vSploit Modules&rdquo;</a> <ul> <li>Joint presentation with Marcus Carey and David Rude. Awesome idea and fun work. Presentation wasn&rsquo;t great though.</li> </ul> </li> </ul> <h2 id="defcon-skytalks-las-vegas-2011">Defcon Skytalks Las Vegas 2011 </h2><ul> <li>&ldquo;Distributed Denial of Service Attacks for Whitehats&rdquo; <ul> <li>Focused on testing DoS mitigations in place from vendors. Unfortunately can&rsquo;t find the slides or video.</li> </ul> </li> </ul> <h2 id="bsides-las-vegas-2011">BSides Las Vegas 2011 </h2><ul> <li>&ldquo;Distributed Denial of Service Attacks for Whitehats&rdquo; <ul> <li>Focused on testing DoS mitigations provided by vendors. Unfortunately can&rsquo;t find the slides or video.</li> </ul> </li> </ul> <h2 id="owasp-appsec-usa-2010">OWASP AppSec USA 2010 </h2><ul> <li>Video: <a class="link" href="https://www.youtube.com/watch?v=b8rE-eZsdTs" target="_blank" rel="noopener" >&ldquo;Hacking SAP Businessobjects&rdquo;</a></li> </ul> <h2 id="source-barcelona-2010">SOURCE Barcelona 2010 </h2><ul> <li>Video: <a class="link" href="https://www.youtube.com/watch?v=b8rE-eZsdTs" target="_blank" rel="noopener" >&ldquo;Hacking SAP Businessobjects&rdquo;</a></li> </ul>https://silentrobots.com/about/Sun, 15 May 2022 00:00:00 +0000https://silentrobots.com/about/ <blockquote> <p>“Always Student, Never Master”</p> </blockquote> <p>I use this site to publish technical content.</p>https://silentrobots.com/archives/Mon, 01 Jan 0001 00:00:00 +0000https://silentrobots.com/archives/https://silentrobots.com/search/Mon, 01 Jan 0001 00:00:00 +0000https://silentrobots.com/search/