lanmaster53.com


A Decade of Training

Friday, February 22, 2019

Training has been a significant part of my professional life since 2009. I've never written about my training pursuits, so as I march into my tenth year of training, fifth year of Practical Web Application Penetration Testing (PWAPT), and the first year of Practical Burp Suite Pro: Advanced Tactics (PBAT), I'd like to share a little about where I've been, where I'm at, and where I'm going, while specifically addressing my various courses. ... more


Burp Suite Pro v2 Transition

Thursday, February 21, 2019

Most of you are probably well aware of the ongoing beta for Burp Suite Pro v2. While Portswigger recommends continuing to use the latest v1 stable version for commercial testing, many are anxious to get started with the features that Portswigger shared with us last year. Let me help you. I've been actively transitioning for six months now and would like to share with you a resource I've built along the way. ... more


Get Off Your Butt and Teach Your Kids to Code

Saturday, December 8, 2018

If you're my age (born in the early 1980s) and know how to code, then it has likely been a differentiator for you in your career. I can't think of a single thing I've done professionally where my ability to understand programming concepts and write code has not benefited me in some way. However, coding is fast becoming a more common skill set amongst the younger generations. Teaching our kids to code is now more of a necessity and less of a luxury. ... more


XSS Active Defense

Monday, June 18, 2018

While I don't do active defense in any part of my professional life, I enjoy developing active defense techniques for web technologies. Lately I've been dabbling in active defense mechanisms for Cross-Site Scripting (XSS) attacks, and as the developer of the HoneyBadger geolocation framework, incorporating the research into new reporting techniques and agents. ... more


SQLi Exploiter: Exploiting Complex SQL Injections

Thursday, May 24, 2018

Raise your hand if you've ever had sqlmap fail to find or exploit a vulnerability you knew to exist? I imagine there's a lot of folks with their hands up right now. Okay, put your hands down. ... more


Report Spam. Get Owned.

Thursday, March 15, 2018

So, a couple weeks ago Matt Svensson (@TechNerdings) dropped me a DM in Twitter:

Random other thing that I am curious if you guys have seen anything on... I just got an email from the local eye clinic. I hit the "spam" button on Gmail to report spam and unsubscribe. What I didn't realize is that it actually opens the unsubscribe link in the browser. Good news, easy unsubscribe. Maybe.....if you properly craft the spam...you could use the unsubscribe button to open a malicious web page?

Um... yeah! I immediately thought of how great a CSRF-via-email attack vector this was. Think about it. Users are trained not to click links, but in the case of Gmail, they're taught to click the handy-dandy "Report Spam" button to report it to the spam filter. But wait a second. The handy-dandy "Report Spam" button will go the extra step and unsubscribe the user from future attacks as well if the user so desires... and they do. ... more


Cooling Down the Hottest Ticket in Town

Saturday, August 26, 2017

We had an interesting conversation on the Proverbs Hackers mailing list today about getting tickets for popular conferences that have limited ticket sales. Security conferences most often thought of in this category are DerbyCon and ShmooCon. For anyone that has tried to get tickets to one of these conferences in the traditional fashion, you know the struggle is real. The conversation got me thinking about ways you can acquire a ticket that you may not realize are available. Below is the result of that thought exercise. ... more