Compass Security Blog

Offensive Defense

OWASP – Toronto January 2020

A write-up of the OWASP Toronto January talk which mainly focused on the correlation and integration of results generated by automated tools in application security such as SAST, DAST and SCA. Alexandre Larocque concludes whether old-fashioned PDF reports are still worth it.

Continue reading

A Smart Card Odyssey

Black box analysis of a not so smart card in ID-1 form factor that is in use for the billing of washing machines and tumble driers.

Continue reading

Insomni’hack 2018 Wrap-Up

As every year, some Compass Security Analysts travelled to Geneva and attended the Insomni’hack conference and it’s enjoyable CTF.

Continue reading

Insomni’hack 2018 – guessflag

For this task, we had SSH access to the server guess.insomni.hack and the task was to read the flag in the /home/flag directory. We were able to get the flag without even solving the challenge :)

Continue reading

Insomni’hack 2018 – vba02-bitminer

Similar to the previous challenge we were provided with an Excel spreadsheet (vba02-bitminer_4052500b4f2120d3d3ae458b339ec1f16e89e870.xls) that again contained macro code that would be executed when opening the document.

Continue reading

Insomni’hack 2018 – vba01-baby

In this challenge we were provided with an Excel spreadsheet (vba01-baby_272038055eaa62ffe9042d38aff7b5bae1faa518.xls). Analyzing the document using olevba (https://github.com/decalage2/oletools/wiki/olevba) quickly revealed that it contains obfuscated VBA macro code that is executed when the document is opened. Challenge Description Our Solution

Continue reading

Insomni’hack 2018 – vbaby

The vbaby challenge was a simple ASP web application that accepted a single page parameter. We initially thought that it could be a local file inclusion vulnerability and therefore tried a path traversal attack:

Continue reading

Insomni’hack 2018 – Authentication Service

This challenge was about LDAP injection.

Continue reading

Insomni’hack 2018 – PHuck

In this challenge we were given the source of a vulnerable PHP page and were tasked with the exploitation.

Continue reading

Insomni’hack 2018 – Conference

This year again a small delegation of Compass Security was present at Insomni’hack in Geneva. On the novelties this year, the workshops spanned  over two days (Tuesday and Wednesday) and the conference followed the same direction (Thursday and Friday). There was also a new kind of CTF, labeled blue-team CTF, called Boss of the SOC. […]

Continue reading

« Older posts