Compass Security Blog

Offensive Defense

Forensic Readiness

Introduction Every year Bitkom and others publish the statistics of detected attacks. These numbers are increasing (30% in 2014, 51% in 2015, 69% in 2016 each regarding the last two years). According to annual Mandiant reports, the duration until an attack is detected is 148 days in median. 148 days is a long time to gain […]

Continue reading

Wrap-up: Hack-Lab 2017 #4

What is a Hack-Lab? Compass Security provides a monthly playful occasion for the security analysts to get-together and try to hack new devices, dive into current technologies and share their skills with their fellows. Topics The following topics, tools and technology has been discussed during this Hack-Lab: ESPloitation Kubernetes BACnet analysis DNS Attacks and Hardening Multi-SDR […]

Continue reading

JWT Burp Extension

JSON Web Token, or more commonly known as JWT,  is an open standard [1] that defines a compact and self-contained structure for securely transmitting information between multiple parties. The contained information can be verified and trusted through digital signatures. JWTs can be integrity protected using a secret using the HMAC algorithm or a public / private […]

Continue reading

BFH Exploiting & Defense Course

I am given the opportunity to teach Exploiting & Defense in the Bern University of Applied Sciences (Berner Fachhochschule) in the module Application and Software-Security.

Continue reading

Wrap-up: Hack-Lab 2017 #3

What is a Hack-Lab? Compass Security provides a monthly playful occasion for the security analysts to get-together and try to hack new devices, dive into current technologies and share their skills with their fellows. Topics The following topics, tools and technology has been discussed during this Hack-Lab: Nessus Automation Tools Automate Everything Frida on an […]

Continue reading

IoT WiFi Module – Dump the Data

The ESP8266 WiFi module from ESPRESSIF is a commonly used, low cost (less than 2 US$) WiFi module that exists in different PCB layouts. Often used for IoT projects and easily programmable using the Arduino IDE or with Mongoose OS and its web based IDE.  The ESP8266 modules are covered with a metal shield. Under the shield is a WiFi/CPU chip, […]

Continue reading

Fun at Insomni’hack

Last Friday a little more than a dozen Compass Security Analysts traveled to Geneva and attended the Insomnihack conference and its CTF. Conference The conference featured a variety of topics, ranging from areas such as corporate IT security, distributed systems and malware analysis, or even unusual topics such as remote exploitation of game engines. DevOOPS: Attacks […]

Continue reading

Write-up: Capscii

The goal in the Capscii challenge was to solve 50 captchas consecutively in less than 100 seconds and prove that we are not human. The captcha was not your usual recognition of text though, it consisted of an operation (addition, subtraction or multiplication) on two numbers. Only problem, the numbers were printed as ASCII art on […]

Continue reading

Write-up: The Great Continuation

This challenge was web based and contained a mix of XSS, CSRF and CSP bypass. We were given two web pages, admin. and bot.control.insomni.hack, and challenged to break into the administration panel to take the control of the bots. The admin page had a login form containing an obvious reflected Cross-Site Scripting (XSS). However, it […]

Continue reading

Write-up: Who’s your daddy?

At this years Insomni’hack there was a fun Recon / OSINT challenge with the name “Who’s your daddy?”. A login page was presented to the participant, who had to try to reset the password of the page owner. On the login page the user was able to: Login with username / password Insert a username […]

Continue reading

« Older posts