DIY: Temporary Email Service
Posted on 2025-10-09by alexeiin Tools of the Trade
Every website requires you to register an account now, even when they don’t really need one. I mean, come on… Why do you need my email to deliver a pizza?
Tools of the Trade
Active Directory Hacking Speedrun
Posted on 2022-09-23by alexeiin Tools of the Trade
On Saturday 24th of September, I gave a presentation at CSECcon titled, “Active Directory Hacking Speedrun! 14 attacks in 30 minutes.” This post is here to provide some post-talk resources to those wanting to learn about any of these attacks, how they work and recreate them.
Continue reading
5 methods for Bypassing XSS Detection in WAFs
Posted on 2022-08-09by karelin Tools of the Trade
Ever since the 1990s, Cross-Site Scripting (XSS) vulnerabilities have plagued the world wide web. It’s been a difficult problem to solve because of the many ways that it can introduce itself in applications. This, and other application level attacks, contributed to the rise of Web Application Firewalls (WAFs). However, like any other solution that does not tackle the problem by its roots, it’s not ideal. Pentesters, red teamers, bug hunters and malicious actors alike have been playing cat and mouse with vendors to find ways around these additional defence mechanisms. In this post, we’ll be discussing a few fundamental techniques that you can use to bypass these firewalls.
Continue reading
Basic security for humans in 4 Fridays
Posted on 2022-03-09by alexeiin Tools of the Trade
This post is going to be a little different. Instead of talking about the industry or business security, I’m going to share my guide on how to set up your own basic personal security. It is intended to be followed by non-technical people in 4 Fridays. My goal is to get as many people on this basic programme as I can, so I do ask you to share it with your friends and family. And, if you are a bit more tech-savvy, please help them along the way. 🙂
Continue reading
How to Share Social Media Credentials Securely
Posted on 2022-03-01by jessicain Tools of the trade
Social media has become the platform that companies all over the world use to communicate with their customers, clients, critics, and investors. An attacker who gains access to an organisation’s social media accounts is able to send any message that they wish, posing as the organisation. Sending the wrong message on social media can cause a backlash, bad publicity, and in rare cases even be illegal as Elon Musk found out in 2018 when he was sued by the SEC over one of his tweets.
Continue reading
Cracking Passwords with Michael McIntyre
Posted on 2020-10-14by billyin Tools of the Trade
I was watching the comedian Michael McIntyre’s most recent Netflix special “Showman” when he began a segment on the evolution of the online password. He described an algorithm that would’ve cracked most of my pre-teen online passwords. I decided to dig further and see how effective this algorithm is against some real world data.
Continue reading
Board Mounting Devices for Fun & Hacker Feels
Posted on 2020-08-25by alexeiin Tools of the trade
Disclaimer: There is nothing about security in this post. Just a bit of fun!
Continue reading
The money conscious, yet secure company
Posted on 2020-01-07by alexeiin Tools of the trade
Let’s face it, security in an organisation can be expensive. You need corporate antivirus, firewalls, a SIEM, a Vulnerability Management solution and of course, that NextGen Threat Analytics and Attack Simulating Toaster (NGTAAST™). Congratulations, you’ve just racked up over a million dollars’ worth of gear. If you are a large corporation with large security budgets, that’s great! Chances are, these controls are legitimately useful for you and help with your day-to-day defence. However, if you are a smaller company, the reality is that you have very finite resources to stop the exact same adversaries that threaten large corporations.
Continue reading
Recent Posts
- Your industrial control equipment was too annoying to hack, but not any more
- DIY: Temporary Email Service
- Cyber Security Basics for Business Leaders
- CRTM Course Review
- Should you add a penetration tester to your allowlist?
- HTB CBBH Course Review
- Securing the laptops that schools give to children
- We got phished! (but it was just a test)
- What do you really need to authenticate?
- CARTP Course Review