cryp7.net

Disabling macOS Mojave dark mode for a specific app

Tue, 26 Mar 2019 00:00:00 +0000

HOWTO - disable macOS (Mojave) dark mode for a specific/single app

Introduction

While macOS Dark mode is great, in general, I find myself confusing it with specific app modes. Namely, Google Chrome Icognito.

Therefore, the following instructions provide a quickstart/reminder of how to disable Dark Mode for particular apps.

Find the application Bundle

Use the osascript command to find the Bundle name:

osascript -e 'id of app "Some Random App"'

For example, Google Chrome:

osascript -e 'id of app "Google Chrome"'

Disable Dark mode for a Bundle

Now use the following command to disable the app Bundle_Identifier retrived from the previous step:

defaults write Bundle_Identifier NSRequiresAquaSystemAppearance -bool yes

Continuing the previous example:

defaults write com.google.Chrome NSRequiresAquaSystemAppearance -bool yes

Restart

Unfortunately, one must restart the app in order for the new settings to take effect :(

Resetting

For whatever reason, should you want to reset the Bundle to defaults use the following command:

defaults delete Bundle_Identifier NSRequiresAquaSystemAppearance

References

All credit goes to the following post (this is just a tl;dr :)

https://www.tekrevue.com/tip/exclude-app-dark-mode-macos-mojave/

AWS WAF Bypass

Fri, 09 Nov 2018 00:00:00 +0000

Introduction

I (finally!) got around to playing with AWS WAF last November. My initial PoC was to grab OWASP WebGoat and focus on the SQL injection module to see how it blocks those attacks. After spending a couple days of free-time without any blocks it slowly dawned on me that I was actually bypassing the attack. So thinking I had lost all my offensive skills, forgotten everything I had learned from @infoseckeatron’s (seriously outstanding!) InfoSec Institue CEH bootcamp, I turned to some trusted web app developer friends of mine to check my work. When they came back with, “Nah, you’re good, and you should submit that to Amazon for review!” I did so, and what follows is our journey to properly block these simple SQL injection bypasses.

Disclaimer

This research was done entirely independent of any employer past or present.

Vulnerability Disclosure Report

Below is my vulnerability disclosure report as sent to aws-security@amazon.com unedited; except for anti-spam email obfuscation. While the attachment is missing, a representative github repo of this journey is available at enkaskal/aws-waf-sqli-bypass-PoC

N.B. The UserData in this initial commit is likely out of date/wrong. At least I had to update it for the Simplified Example section (below); however at the time I swear it JustWork’d(TM)

-----Original Message-----
From: stefan _at_ cryp7 _dot_ net
Sent: Tue, 13 Feb 2018 05:28
To: aws-security@amazon.com
Subject: WAF SQLi bypass

Hello,

I was recently investigating the AWS WAF service and believe I have stumbled upon an SQLi bypass. Originally, I was just trying to ensure the rules were working correctly and 
I thought I was misconfiguring my test environment; however, after some troubleshooting it became clear that was not the case. While it may be considered a low priority issue 
that doesn’t warrant a vulnerability disclosure, I thought it best to err on the side of caution; especially since I don’t have an active support contract to submit via the 
ticketing system and didn’t want to post it publicly via the forums.

Attached is a tarball that includes the following:

* README.md
 * A report describing my findings.
* bypass/
 * Puppeteer scripts that attempt to automate the bypass (both numeric and string).
* cf/
 * A standalone CloudFormation template to assist in reproducing my findings.
* .sh
 * Helper (bash) scripts to assist the reviewer.
* demo.gif
 * An animated gif demonstrating the successful WAF bypass using the ssqli.sh helper.

Just in case the attachment is filtered for some reason, the same tarball is available via Dropbox at: [REDACTED]

SHA256SUM: b5bb12d38bb1ca930fd138730eae795229302cc93741e4e991af703b79c4524a

Finally, the automated scripts are _fairly_ deterministic, but I have found repeated invocations can demonstrate non-determinism that I believe is due to timeouts or (possibly) 
chrome headless crashing. The main point of the Puppeteer scripts was to codify the bypass and while I normally would’ve done some more testing and cleanup; QA was already 
dragging on and therefore I decided it best to just submit as is. However please don’t hesitate to contact me if you have any questions or would like me to pair/screen share with a reviewer.

Very Respectfully,

-- 

Stefan Schwoegler

Initial Response

After ~1mo I received the following response:

-----Original Message-----
From: aws-security@amazon.com
Sent: Mon, 12 Mar 2018 20:56:54 +0000
To: stefan _at_ cryp7 _dot_ net
Subject: RE: WAF SQLi bypass

Hi Stefan,

Thank you for reaching out to us regarding the Security Issue. After reaching out to the service team, they concluded that the issue came from the fact that several sequential transforms
were used in your WAF configuration. Currently the API does not have a way to specify multiple sequential transforms. However, the documentation did not reflect this at the time of your report.
We have updated it and it is now available at the following link: https://docs.aws.amazon.com/waf/latest/developerguide/getting-started.html#getting-started-wizard-create-string-condition.
If you discover otherwise or become aware of another security concern specific to AWS products and services, please do not hesitate to contact us again at aws-security@amazon.com.

Thank you again for helping us protect our customers!

Best Regards

[REDACTED]
AWS Security
https://aws.amazon.com/security

N.B. Name has been [REDACTED] to protect the innocent. Also, there was typical “status” correspondences during the ~1mo so it’s not like there was total silence during the interim.

My Reply

-----Original Message-----
From: stefan _at_ cryp7 _dot_ net
Sent: Wed, 11 Apr 2018 02:44
To: aws-security@amazon.com
Subject: RE: WAF SQLi bypass

[REDACTED],

Thank you for your reply.

It was a pleasure working with you all, and given this response, plus the fact you have publicly posted your remediation I would like to publish this work to my personal blog.
I would like to include content from our correspondences but will not include any identifying information other than an AWS Security Support Representative. One thing that would 
be very helpful is if AWS could also provide the steps or a modified version of my submission that would block the SQL injection. This would really help me hammer home a good 
teaching example for the blog post.

Can you help in getting the improved solution or steps to that solution?

Can you also confirm that there is not an issue publishing my work to a personal blog with the caveats above?

Very Respectfully,

--
Stefan Schwoegler

Their Response

-----Original Message-----
From: aws-security@amazon.com
Sent: Wed, 11 Apr 2018 16:10:06 +0000
To: stefan _at_ cryp7 _dot_ net
Subject: RE: WAF SQLi bypass

Hi Stefan,

Thank you for notifying us about the blog post. I will look into it and get back to you with a status update within 5 business days. 
In the meantime, if you have already drafted the blog post, we would greatly appreciate it if you could share this draft with us.

If you have any further questions or concerns, please do not hesitate to contact us. If you wish to protect your email, you may use PGP; our key is here:

https://aws.amazon.com/security/aws-pgp-public-key

If you would like AWS Security to encrypt its communications to you, please provide us with your public PGP key also.

Thanks again!

Best Regards

[REDACTED]
AWS Security
https://aws.amazon.com/security

A Simplified Example

Given Amazon’s response at this point I decided to put together a simplified example: https://github.com/enkaskal/aws-waf-sqli-bypass-PoC/tree/simplified

It is a single rule WebACL with ONLY a Body FieldToMatch + CMD_LINE TextTransformation which I feels highlights my findings.

I then sent it to them along with a draft of this blog post for review.

Resolution

After providing the simplified example, and a draft of this blog post for review prior to publication, I was contacted by Principal/Senior AWS staff asking for a teleconference. During the call, they agreed with my initial findings/expectations, and asked that I halt publication so that we could continue to work together to properly mitigate these attacks. After some back and forth collaboration with the team, including ensuring that not only do compound SQL statements using a single ‘;’ but also canonical solutions were also handled, I can happily report these injection flaws are now properly protected against in AWS WAF!

Medium to GitHub Pages Migration

Thu, 18 May 2017 00:00:00 +0000

My apologies for the “blackout.” I put all posts on hold while I setup CloudFlare DNS & GitHub Pages+Jekyll for my blog. JIC Twitter™ decides to kill my content ;P

Hope all is well with my followers.

–183r space cowboy

cryp7.net discord server

Thu, 18 May 2017 00:00:00 +0000

cryp7.net now has a discord server. use this invite link to join (never expires :) if you would like to chat with us: https://discord.gg/P6rSfGS

–183r space cowboy

Must See Movies Of All Time

Wed, 08 Jun 2016 00:00:00 +0000

This is a living document.

It’s intern season again…

So we found ourselves compiling a list of must see movies!

Here’s what we came up as a first draft:

sneakers
spy game
blade runner
pulp fiction/reservoir dogs
LOTR/hobbit trilogies
indiana jones trilogy
star wars (machete order: http://www.nomachetejuggling.com/2011/11/11/the-star-wars-saga-suggested-viewing-order/)
all star trek movies
ghostbusters
caddyshack
fight club, american beauty, the beach (i maintain these are all basically the same stories retold in different ways)
pitch black/chronicles of riddick “trilogy”
rounders
the way of the gun
boondock saints
suicide kings
usual suspects
man on fire
godfather 1 & 2 (skip 3)
casino
goodfellas
carlito’s way
scarface
true romance
good will hunting
die hard (all)
heat
12 monkies
shawshank redemption
inception
goodfellas
se7en
casablanca
dial m for muder
rear window (original 1954)
mr smith goes to washington
soylent green
2001: a space odyssey
terminator 1 & 2
robocop
total recall (original and remake)
back to the future trilogy
memento
dr strangelove
the shining
crocodile dundee
taxi driver
to kill a mockingbird (original)
the sting
the hustler/color of money
cocktail
lock, stock, and two smoking barrells/snatch
swingers/made
braveheart/gladiator
the sixth sense
kill bill
full metal jacket
platoon
the princess bride
the bourne identity trilogy
rocky
toy story
monsters, inc
(insert all classic disney movies which i’m sure you’ve seen including charlie and the chocolate factory [original])
groundhog day
last of the mohicans
red
dangerous liasons (cruel intentions is the “modern” remake)
hitchhiker’s guide to the galaxy (and then read all the books!)
black hawk down
thirteen days
prometheus, alien, aliens
wag the dog
office space
blazing saddles
history of the world part 2
spaceballs
clerks/dogma
groundhog day
there’s something about mary
dazed and confused
superbad
dumb and dumber
austin powers
the jerk
old school
national lampoons vacation
zombieland
american pie
the hangover
trading places
boiler room
avatar
ted
saving private ryan (band of brothers series on hbo is much better tho)
oceans 11 (nothing beats the original but the remakes are pretty good too)
blood diamond
simpsons movie
slumdog millionaire
american history x
happy gilmore/billy madison/black sheep
edward scissorhands
friday
fear and loathing in las vegas
training day
james bond (anything with sean connery or roger moore skip the rest)
hunt for red october
the rock
highlander
time bandits
bill & ted’s excellent adventure
forrest gump
wizard of oz
it’s a wonderful life
a christmas story
jaws
ET
army of darkness
short circuit
breakfast club
ferris bueller’s day off
war games (NOT THE SEQUEL)
top gun
goonies
gremlns
poltergeist
beetlejuice
lost boys
who framed roger rabbit
big
the shining
coming to america
karate kid
predator
dirty dancing
roadhouse
batman
weird science
when harry met sally
boyz n the hood
schindler’s list
sandlot (you’re killin me smalls!)
don’t tell mom the babysitter’s dead
independence day
wayne’s world
a few good men
days of thunder
minority report
parenthood
a clockwork orange
close encounters of the third kind
tombstone
real genius
stripes/spies like us
Joe Versus the Volcano
dreamcatcher

Favorite Quotes

Tue, 24 May 2016 00:00:00 +0000

This is a living document.

What follows is a list of my favorite quotes.

From the (original?) IDA Disassembler FAQ:

Q: How do I view the disassembly in C/VB etc?

A: You must create a file called sissy.ini and add the line “LANG C=Yes”.

Jokes aside, this is not something IDA can do. The output is ASM.

Upgrading firmware on Cisco Small Business SG300 Series Managed Switch

Sun, 06 Dec 2015 00:00:00 +0000

Because I’ll never remember how I did this!

Prerequisite

As usual nothing is straight-forward ;)

TFTP Server

Luckily on MacOSX it’s built in :)

To enable it you will need to use the following command:

sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist

Note: the -F is because it is disabled by default.

Firewall

Since you’re running a server make sure your firewall isn’t blocking you!

Download

https://software.cisco.com/download/navigator.html?mdfid=283009439&flowid=18905

Note: I’ve found all the port (e.g. sg300–10 vs sg300–28p) and power (POE) variations to be the same firmware. For example, sg300–10 is the same as sg300–28p. YMMV

Warning: Firmware Format Changes!

If your firmware version is < 1.3.7.18 (sh ver) then you need to upgrade to that first as there was a change in both the firmware and boot formats! If you don’t you will see the following error in the web console:

entry already exists in the Copy History table…

And the following in the CLI or logs:

%TFTP-A-TftpTxERROR: An error message was sent: 0

Then shell onto the switch and copy the firmware over:

Note: While I love the new web interface on these switches I still do this CLI.

switch# copy tftp://A.B.C.D/sx300_fw-1413.ros image

Finally, you will need to activate the new image and reboot the switch:

switch#sh bootv
Image  Filename   Version     Date                    Status
-----  ---------  ---------   ---------------------   -----------
1      image-1    1.3.7.18    12-Jan-2014  18:02:59   Active*
2      image-2    1.4.1.3     29-Mar-2015  16:24:16   Not active
switch#boot system image-2
switch#reload

Cleanup

You’re running a server and your firewall is probably disabled…FIXIT!

TFTP Server

To shutdown on MacOSX use the following:

sudo launchctl unload /System/Library/LaunchDaemons/tftp.plist

Firewall

Close any ports opened in Prerequisites; above.

References

This blog post is just a combination of the following:

HOWTO generate a certificate signing request (CSR)

Fri, 20 Nov 2015 00:00:00 +0000

subjectAltName must always be used (RFC 2818 4.2.1.7, 1. paragraph)

If you set subjectAltName, you have to use it for all host names, email addresses, etc.
NOT JUST THE “ADDITIONAL” ENTRIES.

CN is only evaluated if subjectAltName is not present and only for compatibility with old, non-compliant software.

As of chrome 58+ this is why you will have problems and should follow these instructions :)

DoWorkSon

Enough with the warnings…let’s get shit done!

Copy openssl.cnf

while not necessary since the openssl.cnf has the CA sections separate from the user sections, I like to get my CA setup self-contained in a directory.

your cwd needs to be wherever you’re gonna generate. if you don’t know what that means quit now!

Ubuntu/Debian

cp /etc/ssl/openssl.cnf openssl-san.cnf

RedHat/CentOS

cp /etc/pki/tls/openssl.cnf openssl-san.cnf

Cygwin (MinGW?)

cp /usr/ssl/openssl.cnf openssl-san.cnf

MacOSX (El Capitan)

cp /System/Library/OpenSSL/openssl.cnf openssl-san.cnf

Edit openssl-san.cnf

...
[req]
req_extensions = v3_req
[v3_req]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = server1.yourdomain.tld
DNS.2 = mail.yourdomain.tld
DNS.3 = www.yourdomain.tld
DNS.4 = www.sub.yourdomain.tld
DNS.5 = mx.yourdomain.tld
DNS.6 = support.yourdomain.tld

Generate the CSR

My notes on generating private keys and CSR’s. (that I never remember)

Used with, for example, a new HTTPS server.

Simultaneous key and request generation

openssl req -newkey rsa:4096 -nodes -keyout cryp7.net.key -out cryp7.net.csr -days 365

-nodes places an unencrypted copy of the private key in the server’s key file. This is typically used so that the sysadmin doesn’t need to type in the password when restarting apache; for example.

!!!You should secure this with restrictive permissions at a minimum!!!

Answer the prompts noting:

CN (A.K.A Common Name) section is the name of the server (e.g. cryp7.net)
extra attributes (namely challenge password and optional company name) can be ignored by using the enter (return) key

Setting permissions on the new key

chown root:root cryp7.net.key
chmod 0400 cryp7.net.key

Generate a CSR using an existing key

Used, for example, to sign your own intermediate CA certificate

openssl req -new -config openssl.cnf -key private/vpn.ca.key -out vpn.ca.csr -days 1825

since you’re specifying the openssl.cnf, all prompts should all be defaulted as desired.

Request signing

Now send off the server.csr to your CA.

once sent, the CSR is no longer needed.

Prepare a PKCS#12 file

Combines the public and private key in an encrypted format (symmetrical) for use with email clients, etc.

Before 2011–02–19 (needs the CA cert)

openssl pkcs12 -export -in my.crt -inkey my.key -in root.pem -out my.p12

On or after 2011–02–19 (doesn’t need CA cert)

openssl pkcs12 -export -in my.crt -inkey my.key -out my.p12

References

HOWTO become your own certificate authority (CA)

Thu, 05 Nov 2015 00:00:00 +0000

My notes (that I never remember) on creating a self-signed root certificate authority (CA).

Create the CA

First, setup the standard directory structure

mkdir ca
cd ca
mkdir certs newcerts crl requests
mkdir -m 0700 private

the rest of this document presumes your working directory is ca!!!

Copy openssl.cnf

while not necessary since the openssl.cnf has the CA sections separate from the user sections, i like to get my ca setup self contained in a directory

cygwin
```
cp /usr/ssl/openssl.cnf ./
```
RedHat/CentOS
```
cp /etc/pki/tls/openssl.cnf ./
```
Ubuntu/Debian
```
cp /etc/ssl/openssl.cnf ./
```

MacOSX (El Capitan)

cp /System/Library/OpenSSL/openssl.cnf ./

Set openssl.cnf permissions

chmod 0600 openssl.cnf

Edit openssl.cnf

[CA_default]
dir = .
certificate = $dir/certs/cryp7.net.ca.crt
private_key = $dir/private/cryp7.net.ca.key
[req_distinguished_name]
countryName_default = US
stateOrProvinceName_default = california
localityName_default = los angeles
0.organizationName_default = cryp7.net
organizationalUnitName_default = information assurance directorate
commonName_default = cryp7.net certificate authority
emailAddress_default = root@cryp7.net
# Extension copying option: use with caution.
copy_extensions = copy # allow SAN CSR cert generation (review v3 extensions when signing with caution!!! especially with policy_anything!)
default_md = sha512 # which message digest to use.
[v3_ca]
keyUsage = cRLSign, keyCertSign
nsCertType = sslCA,emailCA,objCA

Setup db and serial files

touch index.txt
echo 01 > serial

Generate the CA keypair

openssl req -config openssl.cnf -newkey rsa:4096 -sha512 -x509 -extensions v3_ca -keyout private/cryp7.net.ca.key -out certs/cryp7.net.ca.crt -days 1825

Signing a request

When a request is received place the .csr file in the requests directory then execute:

openssl ca -config openssl.cnf -policy policy_anything -infiles requests/server.csr

There are two default policies defined in a default openssl.cnf:

policy_match (default) — which requires that the country, state, and organizational unit all matches and common name is supplied
policy_anything — common name is supplied

all other fields are optional

to specify a policy on the commandline use -policy policy_name

what this does:

shows you the request and asks if you would like to sign it
backup database index file (index.txt) to *.old
stores signing in database index file
creates database index attributes file (index.txt.attr)
asks for commit
backup serial to serial.old
increments the serial
stores signed certificate in newcert/NN.pem (this is the filethat should be sent back to the requester)

using -out certs/server.crt, above, can optionally be used to pick the output path/filename

Signing an intermediate CA request

While the CSR portion is the same as a regular request, signing is a little different. you must sign a CA as a CA (of course); for example:

openssl ca -extensions v3_ca -policy policy_anything -config openssl.cnf -infiles requests/range.cryp7.net.ca.csr

Fingerprinting

sha-1 (default)

openssl x509 -noout -in certs/cryp7ca.crt -fingerprint

md5

openssl x509 -noout -in certs/cryp7ca.crt -fingerprint -md5

sha256

openssl x509 -noout -in certs/cryp7ca.crt -fingerprint -sha256

sha512

openssl x509 -noout -in certs/cryp7ca.crt -fingerprint -sha512

Generating Diffie-Hellman pairs (e.g. for use with an OpenVPN server)

openssl dhparam -out private/dh-params.pem 2048

In the previous example the integer 2048 is the key size and may be modified. See dhparam(1).

performing this step is equivalent to running ./build-dh in section “Generate Diffie Hellman parameters” of Setting up your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients.

File extension definitions

key — private key
csr — certificate signing request
crt — certificate
crl — certificate revocation list
pem — base64 encoded x.509 certificate

References

Changelog

20151105 — migrated to medium
20170321 — migrated from sha1 to sha2 (sha512)
20170518 - migrated to github pages

infected linode -> vmware & anti-virus that caught my in-the-wild (ITW) malware

Fri, 20 Mar 2015 00:00:00 +0000

tl;dr

Get a Kaspersky free trial.
If it doesn’t slow down your system and you can live with broken exceptions (e.g. don’t scan your malware research directory) buy it immediately!
Else, get a trial of ESET (and purchase it at the end of said trial :)
If you’re too cheap to purchase AV (hey, no judgments :) then checkout Avast! or Sophos.

Recently (ok november of last year; so relatively recently ;) i had a linode that was infected by malware. i was first alerted by the excessive amount of egress traffic being used on my account; however after missing the email notification(s), and therefore exhausting my monthly transfer limit, linode’s NOC (SOC?) shutdown my instance. no fault to them; that’s exactly what i would’ve done as well. after contacting support and having a very helpful, responsive, and friendly conversation i was able to gain access to the halted instance.

this is when i learned two very important lessons

first, i used this incident as an opportunity to (finally!) learn how to migrate a linode to a vm, but more generically dd via ssh. My notes are as follows:

new virtual machine based on your linode specs (i used vmware fusion pro to create a new vm with 1GB RAM, 24GB disk NOT split into multiple files; not sure this is needed, but AWS import made this a habit)
boot into rescue disc (i used the latest kali iso)
ssh user@A.B.C.D "dd if=/dev/xvda" | dd of=/dev/sda ^[1]
mount /dev/sda /mnt
for i in /dev /dev/pts /proc /sys /run; do mount -B $i /mnt$i; done
chroot /mnt
update /etc/resolv.conf (i used 8.8.8.8 and 8.8.4.4; which it turned out so did the malware! N.B. DNS is often overlooked, so be careful and don’t forget you have your local ISP; not to mention OpenDNS, etc.)
yum install kernel grub2 (I was using CentOS; adjust for your package manager)
grub2-mkconfig -o /boot/grub2/grub.cfg
install grub grub2-install --boot-directory=/boot /dev/sda --force

This allowed me to get a local infected vm for further research. Luckily (for me ;) the malcode persisted and I immediately started seeing a large stream of outbound traffic (don’t forget to use bridged networking in your test lab/cyber range [or not as the case may be ;]). Further, it seemed to be a different host from before which told me it was highly likely the malcode had checked into C2.

ok, so the hunt is on to find out what process. a quick look through netstat showed that ls was sending udp traffic. clearly; not normal. further, by inspecting /proc i quickly found the malcode in /boot. after copying what looked like a mktemp(3) filename off and checking it on virustotal.com i found a couple of shocking revelations…which brings me to the second lesson/teaching moment for this exercise.

anti-virus software is not only ALIVE AND WELL; there is very little AV that actually catches ITW malcode! ok, so this isn’t a shocking revelation in and of itself; nor is it surprising which vendors caught this trojan: basically the same players we’ve all seen recommended time and time again however, the surprise (for me at least) came ~2mo later when i re-analyzed

so the real story here is that only ~26% of vendors caught a known trojan 2+ months after it was publicly disclosed to exist! further, some of them are just re-bundles of the original 6 that have been “tuned” for performance.

my take away’s from all this:

dd via ssh — very cool!
Kaspersky and ESET NOD32 are quantified as #1 and #2 in my book for endpoint protection.^[2]^[3]^[4]
The little guy is exposed, can, and will be attacked; even on modern, monitored platforms.^[5]
Castle theory is dead; long live the castle mentality!
Defense in Depth is more relevant than ever. (Embrace a more modern protection methodology/approach such as immunology or policing.)^[6]
Use a SIEM framework/solution; if possible.^[7]

–183r space cowboy

Footnotes

1: ok so i didn’t actually test this cli. instead i followed their docs (ref: https://www.linode.com/docs/migrate-to-linode/disk-images/copying-a-disk-image-over-ssh) copied to an image file first, (WHICH TOOK FOREVER!) and then i had to copy (again!) all 24GB to the new vm created in step1. hopefully the above works and saves me (and you!) some time in the future :) ↩

2: I will continue to use ESET as it has a crazy low system utilization (Kaspersky at similar settings just owned my current and previous macbook pros) ↩

3: Further, Kaspersky still doesn’t handle scanning exceptions properly; where ESET NOD32 works exactly as I would expect.↩

4: Moreover, ESET claims to have never (?) missed an ITW threat; which as seen above is also my experience. While, Avast is a good free product (that works on MacOSX and Windows) as is Sophos, (free only for MacOSX)↩

5: APT? http://blog.malwaremustdie.org/2014/09/mmd-0028-2014-fuzzy-reversing-new-china.html↩

6: I like to run Sophos’s excellent and free unified threat mangement system (formerly astaro security gateway [http://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx] as my core router and therefore prefer a more robust endpoint solution; see previous comments.↩

7: I use AlienVault products as they are Open Source based but also offer commercial support and improvements.↩

cryp7.net

Disabling macOS Mojave dark mode for a specific app

HOWTO - disable macOS (Mojave) dark mode for a specific/single app

Introduction

Find the application Bundle

Disable Dark mode for a Bundle

Restart

Resetting

References

AWS WAF Bypass

Introduction

Disclaimer

Vulnerability Disclosure Report

Initial Response

My Reply

Their Response

A Simplified Example

Resolution

Medium to GitHub Pages Migration

cryp7.net discord server

Must See Movies Of All Time

This is a living document.

It’s intern season again…

So we found ourselves compiling a list of must see movies!

Favorite Quotes

This is a living document.

What follows is a list of my favorite quotes.

From the (original?) IDA Disassembler FAQ:

Upgrading firmware on Cisco Small Business SG300 Series Managed Switch

Prerequisite

TFTP Server

Firewall

Download

Warning: Firmware Format Changes!

Cleanup

TFTP Server

Firewall

References

HOWTO generate a certificate signing request (CSR)

subjectAltName must always be used (RFC 2818 4.2.1.7, 1. paragraph)

If you set subjectAltName, you have to use it for all host names, email addresses, etc.NOT JUST THE “ADDITIONAL” ENTRIES.

DoWorkSon

Copy openssl.cnf

Edit openssl-san.cnf

Generate the CSR

Simultaneous key and request generation

Setting permissions on the new key

Generate a CSR using an existing key

Request signing

Prepare a PKCS#12 file

See Also

References

HOWTO become your own certificate authority (CA)

Create the CA

Copy openssl.cnf

Set openssl.cnf permissions

Edit openssl.cnf

Generate the CA keypair

Signing a request

what this does:

Signing an intermediate CA request

Fingerprinting

Generating Diffie-Hellman pairs (e.g. for use with an OpenVPN server)

File extension definitions

See Also

References

Changelog

infected linode -> vmware & anti-virus that caught my in-the-wild (ITW) malware

tl;dr

this is when i learned two very important lessons

Footnotes

If you set subjectAltName, you have to use it for all host names, email addresses, etc.
NOT JUST THE “ADDITIONAL” ENTRIES.