CloudGoat Vulnerable Lambda Scenario - Part 2 (Response)
As an incident responder, walk through how we can investigate and resolve an ongoing attack targeting CloudGoat's vulnerable Lambda scenario.
Random thoughts and adventures of an offensive security engineer_
CloudGoat Vulnerable Lambda Scenario - Part 1 (Attack)
An in-depth walkthrough covering how to both attack and defend CloudGoat's vulnerable lambda challenge.
Windows Internals Course Review
This post describes my experience in taking the Windows Internals course offered by Pavel Yosifovich and how it has boosted my capabilities as an offensive security researcher and red teamer.
The Current State of DDE
The Dynamic Data Exchange (DDE) protocol exposes functionality that allows data to be transmitted between applications/processes on Windows platforms. About two years ago, researchers discovered that this protocol could be abused in order to achieve arbitrary command and code execution, more specifically within Microsoft Office applications (e.g., Excel). Within the past few months, Microsoft issued several updates to combat these attacks. This post will address the current state of the DDE attack vector within Microsoft Office applications, taking the recent patches and security advisories from Microsoft into account.
CSAW 2017 Quals - 'pilot' Writeup
Each year, the cybersecurity students of New York University (NYU) host the Cyber Security Awareness Week (CSAW) capture-the-flag (CTF) competition, the largest student-run cybersecurity event in the world. This is a jeopardy-style CTF event with a variety of challenge types and thousands of competitors, comprised of both students and professionals. In this post, I'll cover the first 'pwn' challenge of the competition, 'pilot'.
Another 'Getting Started in Security' Post
There have been more than a few conversations that involved someone asking me how I successfully 'broke' into the information security field and, more importantly, how they could as well. Although this topic has been covered quite a bit, I felt it would be beneficial to offer my two cents to others looking to follow a similar path.