Logging Passwords on Linux

Hal Pomeranz tipped me off to a nasty little trick of using Linux’s own auditing features and PAM to grab clear text passwords from users as they use sudo/su on the command line. Linux PAM (Pluggable Authentication Modules) are a flexible method of implementing...

Breaking into Infosec

tl/dr; There are a lot of ways to get into infosec. I’ll try to outline some of the things that have helped me along the way and provide some resources to help you. We recently had the pleasure of sponsoring BSides Kansas City. Side note: if you haven’t been, you...

SQLi Data Exfiltration via DNS

Did you know you can use DNS queries to exfiltrate data from a database via SQLi? No? Then continue reading! I’ll walk through some techniques you can use to enumerate and exfiltrate data from a DB server via blind SQLi. On a recent web app test, I encountered a...

Capturing SQL Server User Hash with SQLi

On a recent external web app pen test, I found a possible SQL injection vulnerability using the Burp Scanner. One of the tests triggered an A record lookup for the Burp Collaborator server. In the screenshot below, we can see the test that triggered the finding....