9447 CTF Recon 1 & 2 Writeups
Last weekend I was lucky enough to play with the talented Montreal-based capture-the-flag (CTF) team DCIETS in the 9447 online CTF event [http://9447.plumbing]. For »
5 Important Questions to Ask Your Next Penetration Tester
One of our biggest frustrations we have in our industry is coming across organizations that have been taken advantage of by former security contractors. The biggest »
Blind Error-based SQL Injection with NULLIF()
The other day I found an interesting way to use error-/boolean-based SQL injection, blindly, to exfiltrate database artifacts. What do I mean by that? Well, »
Using Groovy in BurpSuite with BurpKit
In August of 2015, I released a tool at DEFCON 23 [https://www.defcon.org/html/defcon-23/dc-23-index.html] called BurpKit [https://github.com/allfro/burpkit] »