SANS Penetration Testing

SANS Penetration Testing

Pen Testing Node.js: Staying N Sync Can Make the Server Go Bye Bye Bye

By Tim Medin I recently came across a node.js server in a pen test. If you aren't familiar with node.js, Wikipedia describes it as "...an open-source, cross-platform runtime environment for developing server-side web applications. Node.js applications are written in JavaScript and can be run within the Node.js runtime on a wide variety of platforms." For … Continue reading Pen Testing Node.js: Staying N Sync Can Make the Server Go Bye Bye Bye

Getting the Most Out of Shodan Searches

By Joshua Wright and Jeff McJunkin Shodan is a search engine that takes a distinct departure from most Internet search engines. Instead of searching through content intentionally served up and delivered to web browsers, Shodan allows us to search for Internet-connected devices. Created by John Matherly, Shodan uses distributed scanners throughout the world to randomly … Continue reading Getting the Most Out of Shodan Searches

NoSQL? No Problem! Pillaging MongoDB for Fun and Profit

By Josh Wright Database technology continues to evolve to meet different application needs. One example of this is the adoption of NoSQL databases used by many different modern web applications. NoSQL databases depart from the traditional table-based storage mechanisms widely known and loved (mildly appreciated?), and instead store simple key-value data pairs, JSON documents, graph … Continue reading NoSQL? No Problem! Pillaging MongoDB for Fun and Profit

TLS/SSL Failures and Some Thoughts on Cert Pinning (Part 1)

By Chris Crowley It's going to happen sooner or later...sooner probably. You're going to be asked about your company's mobile app or a mobile app your company wants to install across all mobile devices. They'll put the request in the "yet another duty as assigned" (YADAA) category/bucket. You look at the network traffic; it's using … Continue reading TLS/SSL Failures and Some Thoughts on Cert Pinning (Part 1)

Using the SSH "Konami Code" (SSH Control Sequences)

By Jeff McJunkin Are you familiar with the Konami code? The one popularized by the Contra video game? Pictured above: Tangentially related to SSH If not, let me fill you in. This code is a sequence of control actions for some video games that'll let you jump forward in the game (some call it a … Continue reading Using the SSH "Konami Code" (SSH Control Sequences)