Tech Help

      What started off as an interesting read on how DNS rebinding attacks work, and how they're leveraged to scan internal networks. The high level gist of the scenario is that if you have multiple A records, or the ability to rapidly change A records during someone's visit to a page, you can cause them to run push requests to other pages. This may include things like scanning a web-page visitor's local network, or replaying known addresses (maybe due to public dns resolving internal addresses) there is potential for attempting things like xss to steal credentials. Since it's the same domain being resolved, the browser often won't have any issue attempting requests.     Now, what this turned into was my general thought of "I've seen attacks before where people used webrtc, wasm, flash, vbs, etc... to port scan a network, I wonder if you could just use javascript targeting subdomains of other websites that have sub-domains pointing to private ips. This woul...

     Hey there folks, I just wanted to drop in to mention an issue that's actually come up probably even more than data recovery or ransomware. Throughout my almost 20 year career in IT, I've had one consistent issue that people ask for all the time that I simply can't help with, and I really want to bring this up as a "please understand what you're asking before you ask it" type thing.     The issue I speak of is any of the many variations of "hack my spouse" type issues. This could be "I need access to my spouse's facebook," "I need access to my spouse's email," "can you monitor my spouse's computer remotely," "my ex did this and I want evidence, it's on his phone," etc...  There's even been some variants with people dumb enough to say "I need access to this girl I'm stalking" and variants around e-girls and doxxing. The short and sweet of the problem isn't just that thes...

        Sometimes inspiration for the coolest tricks comes from some otherwise novel things. Such seems to be the instance for this guy ( https://paulbutler.org/2025/smuggling-arbitrary-data-through-an-emoji/ ), on which post he seems to have gotten inspiration from a comment about unicode's zero width joiner features and rabbit holed until he found a fun way to copy-paste-able emojis that are hiding data in them. To do this, as he explains, he basically took to the unicode format specifications and specifically around these and emojis. Long story short, he came up with something that gives this emoji (for instance):     You can also do the encoding on cyber chef as well (as seen in that picture and this next one). But it's a much more manual process.     If you go check the issues page on the github, you can see this has even more people making bash and python versions of the tool.     However what I wanted to mention today is that ther...

 Windows 11:  That required upgrade you can't perform     I have a lot of issues with using windows, apple, or red hat, and it's mostly because I grew up believing that people shouldn't have to pay to use a computer they already paid for. One time physical purchase, should be an all inclusive package. Sadly, thats not how the world works these days. Now days, your phone apps update every day, your phone updates every week, your computer updates every tuesday and at random, all of them enforce reboots or risk crashing the respective systems, blah. It's all pretty horrible. Now we have Windows 11 out for a while, with even high-end gaming computers that were purchased just before it's release, unable to run windows 11 on it.     If this was just a "my hardware isn't good enough" for it, I guess I could see that. ya know, service purchase with updates and all this garbage, fine. But in some cases, like mine, I have a windows 10 PC waiting to upgrade becau...

Bug hunting, threat hunting... license hunting?      Found myself doing some weird hunting, not finding anything special, but it was fun to keep some skills up. To start with, I was spending some time digging through some github repos using a tool called trufflehog . This is a secrets detection tool thats used specifically to determine if secrets have been leaked in code repos. It's really good for finding leaked passwords, apikeys, session tokens, etc... In my case, I was searching and stumbled across a result I wasn't too sure about. It was a .DS_Store file. These files are often left behind by Apple Mac OS when accessing specific filesystems ( you can find details on why this is a thing with a quick google ).  The main idea however, is that for support of specific systems, mac used a metadata caching mechanism, mostly filenames. Sometimes when finding these files, you can extract data from them in order to identify other files you should try to access. The file th...

Primer:      I want to make a tutorial that I could show my kid to help them understand hacking, methodology, basics, etc... so this is an introduction post, more will follow, and maybe I can add a video series to go along with this.     The first thing to talk about, is what and why. Technology, while ever changing, can will always fall victim to several problems.  First is the idea that use case when created, won't match use case performed. Such as, when creating a remote for a TV, it may use infrared to point to the TV, and that works fine when one TV is in the same room at a time. When more then this is added, conflicts are caused and the light used for remote is picked up by the infrared sensor on multiple TVs. Change channels on one, both go. Second is that nothing created by man, is or is capable of creating, flawlessness. Business profits drive innovation, but not perfectionism (or the attempt to become close to perfect).     With these is...

LET US KNOW! Don't be afraid to let us know if you have any suggestions for blog posts or want any advice to show up on here.  Thanks for reading If you need any IT or CyberSecurity work remotely or within the DFW area, please contact us over at  FeemcoTechnologies .