Working with motion and some cheap Chinese cams.

I can’t host much stuff at home because I live in a remote-ish place with no landline Internet. I only self-host a few services on an RPi and a (discontinued) Chip board to stream music, and “daily” jobs about the weather, work, or local news.

Email (postfix, dovecot, …), plus a bunch of other services (nextcloud, znc, some ruby/go things) run on an old Kimsufi server (1 core, 2gb RAM, 1TB disk) ; a.k.a. SoYouStart in the new world.

Attending one of the biggest security conference in Italy: https://www.hackinbo.it/

Is this for only HTTP, or are they abusing their certs to MITM HTTPS for injecting javascript too?

My former boss (founder of the company, without any technical experience) force me to use static routing because he did not trust routing algorithms. Every network outage was a nightmare, because we have to reconfigure routing rules by hand.

Flying to Houston, meeting my boss and my teammates. First time in the USA for me

Setup a K3S cluster at my home with a bunch of C.H.I.P. devices

• Preparing for my new job, starting Monday

• Deploying a Docker Swarm cluster over 7 C.H.I.P.

Any suggestion for a Mercurial hosting service?

Working with architects on renovating a 150-year old Kyōmachiya and trying to imagine ways to move back to Kyoto while continuing working on engineering challenges I’m passionate about. Sadly, Kyoto’s not exactly a major tech hub.

Going with my wife to her former workplace (a very nice seafront touristic village). She will hang out with former colleagues, I will relax reading “Deep Learning” by Goodfellow, Bengio and Courville and improving my Golang scraper.

Trying to get back into radio “stuff” so i picked up a rtl-sdr (https://www.rtl-sdr.com/), This is what is called a “software defined radio”. Somewhat like a fpga for radio. The rtl-sdr is super cheap, $30 for a kit with the receiver and some antennas.

My first attempt will be messing around with ADS-B. I’m still learning about it but it seems to have something to do with aircraft positioning. I’m near a few airports so i should have luck with this.

Anyone else into radio???

Learning Chinese.

Writing a scaper to convert an online Chinese course in a podcast.

Installing Docker + Docker Swarm in a cluster of C.H.I.P. for my home lab.

This was a really nice write-up, thanks!

Apologies if this is off-topic but this seems like a lot to ask someone to do for an interview. How long were you expected to spend on this?

For example, the company could have cut down on your time requirement by expending some of their own time and effort creating the environment. I suspect they would have a higher rate of returned tests: perhaps more subtly, you would have learnt more about how they work and who they think their clients are.

If you were happy to do it, all good. But I feel like this is bad interview technique on the company’s part.

Just some quick feedback as someone who has been in the consulting game for quite a while that you and others might find interesting or helpful to how the OffSec world works;

I used the first techniques that I found working

This is actually what you want. In a real world test you might have a week to do 40,000 live hosts on a network and the “low-hanging fruit” that you find might actually give the client the most for their money. If you can prove easy ways in and provide them with feedback that can systemically fix issues, it doesn’t matter how easy it is. Plus ease of reproduction is valuable in it’s own right.

a demo version of Mikrotik RouterOS

I’m not certain I understand the logic of this, was this to connect into the VPN? A bit confusing and as a person doing the hiring I’d like to hear some justification for this. It’s not a huge deal, just a curiousity to see how some people think.

the payload will be encoded using msfvenom, in order to evade with shikata_ga_nai encoder

I see this a ton on entry level testing write-ups and as someone who contributes to the Metasploit framework, shikata_ga_nai doesn’t work on any remotely up to date AV for the past probably 5 years. I’d even be skeptical that they were using AV at all. Did you do anything special with it? Why did it used to be so good at AV bypass?

The rest looks pretty solid imo, good job :)

I’d personally have no hesitations hiring someone who can do this and at least explain their methodology. Remember, the reporting is actually the product from a Penetration Test, so while the technical bits are really important it also really matters if you can create a report that is consumable by the client and can give all the remediation steps on top of issues discovered.

Some other quick tips that might be helpful to you in future testing, check out the impacket examples and understand how they could impact an AD network. One of the most common mechanisms for attacks these days is to simply abuse AD built-in functionality to gain Domain Administrator. Why even bother with the PSExec route if you can user a kerberoasting attack to gain access to SPN accounts (which are often privileged). Oh, and persistence generally isn’t a huge deal, in a pentest scenario you aren’t trying to secure your footholds, you are looking for bredth of issues not depth.

We finally launched gambe.ro, the italian equivalent of lobste.rs. This week I(we) have to work on the first batch of feedbacks and maybe work on a dark theme that can be contributed back to lobste.rs

Preparing for OSCP with HackTheBox.

Buy a small Mikrotik (like hAP Lite) and configure it to enqueue the traffic on a 100k queue. You can also made some more specific rules, like putting videos packet in a low priority queue.