Tech Help

Introduction      I recently found myself in need of a live wordpress system to install and test various tools against, as well as test for and validate exploits. So as part of my lab setup series, I'm going through a quick step-by-step version of configuring a quick wordpress lab.     This lab uses containers to make this an easily followed process and simplicity sake. If your specific lab needs a virtual or dedicated machine to run your testing, this may not be the ideal place to start. Either way, challenging myself to do some tutorials, so lets get into this!  Requirements:      So, there are a few requirements expected before this lab can be ran, though this should be generally cross platform: docker (or docker desktop) docker-compose an attacker system/container (in my example, I had curl, wpscan and greenbon/openvas installed on a separate container that I used to test against this) Steps: 1. To start with, just simple docker-compose f...

Wifi Beacons      This was an adventure.      Some back story first, when any device you have that listens for connections for wifi wants to connect to something, even when the access point it's trying to reach isn't there, the default tends to be probe for it. That's basically a small little radio in your phone, car, watch, light bulb, whatever saying publicly "YO! IS MY WIFI OUT THERE? WHAT ABOUT THIS OTHER ONE!!?!? NOT THAT ONE EITHER, OKAY NEVER MIND!". When doing wireless network pentesting, it's pretty common to use tools like kismet or airodump and include these beacons, in part to flag what's relating to what network you're targeting / have permission to access and in part to see if network devices in scope are connecting so you can redirect their traffic to a fake network as part of the test. But I came up with an idea a while back due to having a scan going at my house and I kept seeing these "ROPD-CAR4" (fake, but something like th...

The problem      I'm not really big on endorsing services, but I found DocuSeal over the last weekend and thought I'd share some experiences with it. I've been discussing a lot lately about how people should have some basic sign before work performed stuff, even for contractors and individually owned companies so they aren't getting screwed over (there's a lot of ways to do this to someone). Personally I'm using obsidian and it's print to pdf thing to create and edit (if needed) templates for various forms and reporting situations. Platforms like google forms is nice for just generic information filled out, but doesn't do any digital signatures or provide any proofs that the data wasn't tampered/altered/or faked. So I've been trying to find a solution to suggest to others that doesn't completely suck or cost an arm and a leg.      But before I get to how DocuSeal seems to work for me on that, lets discuss this for a second so you understand t...

Weird Routes?  History:      So I wasn't really sure how to start this post, but I guess some back story. Many in the IT world know consumer ISPs (internet service providers) like ATT, Comcast, Charter (now spectrum), all have a weird history of "you can't prove there's a problem because we don't escalate it properly, now you're stuck with this while we replace your router 200 times because it can't be on us" sort of problems. I switched to spectrum because in my area its the only non-att fiber lines, and ATT couldn't tell me why my router had an ssh server listening on it. They couldn't think it was compromised or could be compromised, they couldn't tell me anything they just replaced it. Then replaced it again. Then again. After 2 years of doing that, I just had enough. Later that year after leaving ATT, https://en.wikipedia.org/wiki/Salt_Typhoon . But sadly, despite my contempt for ATT by this point, this post isn't about them. More ...