- cybersecurity 13
- tip 11
- opinion 9
- writeup 5
- career 4
- aws 4
- Microsoft 3
- HackTheBox 3
- productivity 3
- hacking 3
- VulnHub 3
- amazon 3
- Apple 2
- software-reversing 2
- Proxmox 2
- system-administration 2
- Docker 2
- aws-path-series 2
- leadership 2
- software-development 1
- static-analysis 1
- assembly 1
- x86 1
- privacy 1
- Ansible 1
- aws-cfn 1
- rant 1
- Telegram 1
- proxy 1
- censorship-evasion 1
- arm 1
- raspberry-pi 1
- alpine-linux 1
cybersecurity
Networked writeup
Networked is a machine hosted in Hack The Box.
Damn Vulnerable Web Application v1.10 Virtual Machine
The latest binary release for Damn Vulnerable Web Application is an ISO of the 1.0.7 version. It was released almost ten years ago in 2010. And the way to install a newer version is quite a lengthy process, so I decided to release this virtual machine with everything already set up.
Unknowndevice64 writeup
bWAPP writeup
Kuya 1 writeup
This is a relatively easy to crack machine. Let’s start with the basics: Reconnaissance.
Typhoon v1.02 writeup
This is a writeup for the Typhoon v1.02 machine on VulnHub. This is a highly vulnerable machine, with multiple potential entry points. There are four different flags to capture.
The five phases of ethical hacking
An Ethical Hacker is someone who specialises in computer security through what’s known as “Penetration Testing”, which are series of exercises carried out against computer systems to spot vulnerabilities and weaknesses.
Post-Exploitation: spawning a shell
Once you have gained shell access on a machine, you will often find the prompt extremely limited, especially if you have used manual exploitation. In these cases, the shell often cannot perform basic tasks that you would expect from a fully interactive shell prompt like Bash, or zsh. You will also be unable to run intensive interactive commands such as the Vim text editor, or ncurses-based programs.
What Apple’s T2 chip means for the security of Macs
MSFVenom and Meterpreter: The basics
I just recently successfully gained root (or rather, Administrator, because it’s a Windows box) on the Devel machine in Hack The Box.
The fun begins: HackTheBox.eu
It’s been a while since I joined https://www.hackthebox.eu/. Probably more than a year. And I haven’t really had the time to spend trying to break into the machines, because of my university studies, but now summer is coming, so I will be able to dedicate more resources to it.
x86 Function call conventions
Another cybersecurity post. Focused on binary (dis)assembly.
Static analysis tools for Windows
I’m currently studying malware analysis, so I wanted to write a post on the tools I’ve been using recently, to serve as a reference for me and hopefully for anyone interested in binary reversing.
tip
scp and rsync reference
Similar to my previous post on SSH tunnelling, this post is a quick reference for typical rsync and scp usage.
Breaking bad habits thanks to dark patterns
Most digital products and services are optimised to generate as much revenue as possible. An app will only generate revenue for the creator for as long as you keep actively engaging with it. Therefore, one of the most important digital metrics is what’s called “user retention”. This is the percentage of users that return to the app in a specific timeframe.
AWS CloudFormation: Appending elements to lists
Short reference on manipulating CloudFormation lists.
SSH tunnelling
Quick reference guide to use when you need to use OpenSSH’s various tunnelling features.
Docker cleanup commands
It is important that from time to time, machines running Docker are cleaned because otherwise, Docker leftovers will start piling up and eating precious storage space.
Push notifications for Linux logins
An easy walkthrough on enabling instant push notifications for logins and logouts on a Linux system with Pushover. You will need a Pushover account. Pushover is a proprietary service for smartphones, with a single-time purchase application which includes a generous free quota (never ever surpassed the “free” limits for any of my personal projects, and I receive sometimes more than 20 notifications per day). Register for a free account here.
Automating Proxmox with Ansible
Ansible is an automation platform for managing machines. When combined with Proxmox, it becomes a ridiculously powerful tool to orchestrate virtual datacenters.
Post-Exploitation: spawning a shell
Once you have gained shell access on a machine, you will often find the prompt extremely limited, especially if you have used manual exploitation. In these cases, the shell often cannot perform basic tasks that you would expect from a fully interactive shell prompt like Bash, or zsh. You will also be unable to run intensive interactive commands such as the Vim text editor, or ncurses-based programs.
Proxmox tip: “Failed to start VNC server: Failed to bind socket: Cannot assign requested address”
Note: This issue appears on Proxmox 5.2-x, always check the date of the post when troubleshooting your systems.
The DEFINITIVE guide to defeating spammers
Nowadays, spamming is a very common technique, and nobody can deny that. Spamming is so cheap that even a 10% opening rate is a tremendous success, because sending e-mails doesn’t require paying fees to ISPs (like you would with mass SMSs and robocalls), and it also doesn’t require hiring anyone to take the time to manually write and send e-mails (as opposed to postal spam, which have to be physically delivered into mailboxes by people), when you can just buy e-mail addresses in bulks by thousands of providers that sell active e-mail addresses by prices so ridiculously affordable, it lowers the barrier to entry dramatically.
Productivity
In the past, I used to struggle with my productivity, no matter how hard I seemed to study, my grades didn’t reflect it. I was quite stubborn in believing I wasn’t at fault, like some kind of genius who nobody understood, and reading quotes like this one certainly didn’t help me understand it was actually my problem. I was in denial.
opinion
Lessons from AWS: One-way and Two-way Doors
Amazon, like possibly all big companies, is full of wisdom, and I was able to experience this firsthand during my time there.
Breaking bad habits thanks to dark patterns
Most digital products and services are optimised to generate as much revenue as possible. An app will only generate revenue for the creator for as long as you keep actively engaging with it. Therefore, one of the most important digital metrics is what’s called “user retention”. This is the percentage of users that return to the app in a specific timeframe.
My path into AWS: Part 2, leadership principles
This is an ongoing effort to openly document my AWS interview experience. I will try to cover everything I find relevant, but I’m open to suggestions on what to include. Let me know via Twitter!
My path into AWS: Part 1, Introduction
What Apple’s T2 chip means for the security of Macs
The power of silence
I find silence to be grossly underestimated. We live in an era of permanent distraction. Companies use loud, aggressive marketing in the form of advertisements to grab your attention and get you to buy whatever it is they’re selling. Our smartphones have become distraction devices that instead of boosting our productivity, and increase our focus, are loaded of applications that send notifications indiscriminately, connecting us to real-time events instantly.
Why I use a MacBook
In this article, I want to explain why I use a MacBook. I am convinced it is the superior desktop OS, but I also think everyone should use what suits them. In my case, that would be macOS.
Password managers
The Internet nowadays is a very messy place. Identity theft, e-mail confirmations, instant notifications, mobile devices, multiple accounts, data leaks, account dumps, service breaches, malware that steals your bank’s information, scammers, identity theft…
Don’t share Microsoft Office documents: use open formats
It’s very common, in certain situations, to share OOXML files such as .docx from Microsoft Word and .pptx from Microsoft PowerPoint. I’ve seen this happen most often in schools, universities, and educational institutions in general. I will try to explain why this is generally a bad idea.
writeup
Set up your own Telegram proxy
Set up a Telegram MTProto proxy on a Raspberry Pi using Alpine Linux and Docker in a few minutes and communicate freely.
Unknowndevice64 writeup
bWAPP writeup
Kuya 1 writeup
This is a relatively easy to crack machine. Let’s start with the basics: Reconnaissance.
Typhoon v1.02 writeup
This is a writeup for the Typhoon v1.02 machine on VulnHub. This is a highly vulnerable machine, with multiple potential entry points. There are four different flags to capture.
career
When the “better coding style” is the wrong style
Code is always read more than it is written or debugged. It is of the utmost importance that code is optimised for readability. And in this regard, it must be written such that the largest amount of people possible can read and understand it as quickly as possible.
Lessons from AWS: One-way and Two-way Doors
Amazon, like possibly all big companies, is full of wisdom, and I was able to experience this firsthand during my time there.
My path into AWS: Part 2, leadership principles
This is an ongoing effort to openly document my AWS interview experience. I will try to cover everything I find relevant, but I’m open to suggestions on what to include. Let me know via Twitter!
My path into AWS: Part 1, Introduction
aws
Lessons from AWS: One-way and Two-way Doors
Amazon, like possibly all big companies, is full of wisdom, and I was able to experience this firsthand during my time there.
AWS CloudFormation: Appending elements to lists
Short reference on manipulating CloudFormation lists.
My path into AWS: Part 2, leadership principles
This is an ongoing effort to openly document my AWS interview experience. I will try to cover everything I find relevant, but I’m open to suggestions on what to include. Let me know via Twitter!
My path into AWS: Part 1, Introduction
Microsoft
Static analysis tools for Windows
I’m currently studying malware analysis, so I wanted to write a post on the tools I’ve been using recently, to serve as a reference for me and hopefully for anyone interested in binary reversing.
My favourite Visual Studio Code extensions
At first, I really disliked Electron and JS-based text editors, like Atom and VSCode, but after learning Vim, and finding many problems with my plug-ins, on different languages (such as MIPS assembly, Java and VHDL), I decided to give VSCode a try, and I have been very impressed by how well Visual Studio Code works. It’s much faster than JS-based editors used to be, it has amazing community support, and I’m generally faster, and more productive using it. It has fixed a lot of its shortcomings, like its speed.
Don’t share Microsoft Office documents: use open formats
It’s very common, in certain situations, to share OOXML files such as .docx from Microsoft Word and .pptx from Microsoft PowerPoint. I’ve seen this happen most often in schools, universities, and educational institutions in general. I will try to explain why this is generally a bad idea.
HackTheBox
Networked writeup
Networked is a machine hosted in Hack The Box.
MSFVenom and Meterpreter: The basics
I just recently successfully gained root (or rather, Administrator, because it’s a Windows box) on the Devel machine in Hack The Box.
The fun begins: HackTheBox.eu
It’s been a while since I joined https://www.hackthebox.eu/. Probably more than a year. And I haven’t really had the time to spend trying to break into the machines, because of my university studies, but now summer is coming, so I will be able to dedicate more resources to it.
productivity
When the “better coding style” is the wrong style
Code is always read more than it is written or debugged. It is of the utmost importance that code is optimised for readability. And in this regard, it must be written such that the largest amount of people possible can read and understand it as quickly as possible.
Breaking bad habits thanks to dark patterns
Most digital products and services are optimised to generate as much revenue as possible. An app will only generate revenue for the creator for as long as you keep actively engaging with it. Therefore, one of the most important digital metrics is what’s called “user retention”. This is the percentage of users that return to the app in a specific timeframe.
The DEFINITIVE guide to defeating spammers
Nowadays, spamming is a very common technique, and nobody can deny that. Spamming is so cheap that even a 10% opening rate is a tremendous success, because sending e-mails doesn’t require paying fees to ISPs (like you would with mass SMSs and robocalls), and it also doesn’t require hiring anyone to take the time to manually write and send e-mails (as opposed to postal spam, which have to be physically delivered into mailboxes by people), when you can just buy e-mail addresses in bulks by thousands of providers that sell active e-mail addresses by prices so ridiculously affordable, it lowers the barrier to entry dramatically.
hacking
Damn Vulnerable Web Application v1.10 Virtual Machine
The latest binary release for Damn Vulnerable Web Application is an ISO of the 1.0.7 version. It was released almost ten years ago in 2010. And the way to install a newer version is quite a lengthy process, so I decided to release this virtual machine with everything already set up.
The five phases of ethical hacking
An Ethical Hacker is someone who specialises in computer security through what’s known as “Penetration Testing”, which are series of exercises carried out against computer systems to spot vulnerabilities and weaknesses.
Post-Exploitation: spawning a shell
Once you have gained shell access on a machine, you will often find the prompt extremely limited, especially if you have used manual exploitation. In these cases, the shell often cannot perform basic tasks that you would expect from a fully interactive shell prompt like Bash, or zsh. You will also be unable to run intensive interactive commands such as the Vim text editor, or ncurses-based programs.
VulnHub
Unknowndevice64 writeup
Kuya 1 writeup
This is a relatively easy to crack machine. Let’s start with the basics: Reconnaissance.
Typhoon v1.02 writeup
This is a writeup for the Typhoon v1.02 machine on VulnHub. This is a highly vulnerable machine, with multiple potential entry points. There are four different flags to capture.
amazon
Lessons from AWS: One-way and Two-way Doors
Amazon, like possibly all big companies, is full of wisdom, and I was able to experience this firsthand during my time there.
My path into AWS: Part 2, leadership principles
This is an ongoing effort to openly document my AWS interview experience. I will try to cover everything I find relevant, but I’m open to suggestions on what to include. Let me know via Twitter!
My path into AWS: Part 1, Introduction
Apple
What Apple’s T2 chip means for the security of Macs
Why I use a MacBook
In this article, I want to explain why I use a MacBook. I am convinced it is the superior desktop OS, but I also think everyone should use what suits them. In my case, that would be macOS.
software-reversing
x86 Function call conventions
Another cybersecurity post. Focused on binary (dis)assembly.
Static analysis tools for Windows
I’m currently studying malware analysis, so I wanted to write a post on the tools I’ve been using recently, to serve as a reference for me and hopefully for anyone interested in binary reversing.
Proxmox
Automating Proxmox with Ansible
Ansible is an automation platform for managing machines. When combined with Proxmox, it becomes a ridiculously powerful tool to orchestrate virtual datacenters.
Proxmox tip: “Failed to start VNC server: Failed to bind socket: Cannot assign requested address”
Note: This issue appears on Proxmox 5.2-x, always check the date of the post when troubleshooting your systems.
system-administration
Docker cleanup commands
It is important that from time to time, machines running Docker are cleaned because otherwise, Docker leftovers will start piling up and eating precious storage space.
Push notifications for Linux logins
An easy walkthrough on enabling instant push notifications for logins and logouts on a Linux system with Pushover. You will need a Pushover account. Pushover is a proprietary service for smartphones, with a single-time purchase application which includes a generous free quota (never ever surpassed the “free” limits for any of my personal projects, and I receive sometimes more than 20 notifications per day). Register for a free account here.
Docker
Set up your own Telegram proxy
Set up a Telegram MTProto proxy on a Raspberry Pi using Alpine Linux and Docker in a few minutes and communicate freely.
Docker cleanup commands
It is important that from time to time, machines running Docker are cleaned because otherwise, Docker leftovers will start piling up and eating precious storage space.
aws-path-series
My path into AWS: Part 2, leadership principles
This is an ongoing effort to openly document my AWS interview experience. I will try to cover everything I find relevant, but I’m open to suggestions on what to include. Let me know via Twitter!
My path into AWS: Part 1, Introduction
leadership
When the “better coding style” is the wrong style
Code is always read more than it is written or debugged. It is of the utmost importance that code is optimised for readability. And in this regard, it must be written such that the largest amount of people possible can read and understand it as quickly as possible.
Lessons from AWS: One-way and Two-way Doors
Amazon, like possibly all big companies, is full of wisdom, and I was able to experience this firsthand during my time there.
software-development
My favourite Visual Studio Code extensions
At first, I really disliked Electron and JS-based text editors, like Atom and VSCode, but after learning Vim, and finding many problems with my plug-ins, on different languages (such as MIPS assembly, Java and VHDL), I decided to give VSCode a try, and I have been very impressed by how well Visual Studio Code works. It’s much faster than JS-based editors used to be, it has amazing community support, and I’m generally faster, and more productive using it. It has fixed a lot of its shortcomings, like its speed.
static-analysis
Static analysis tools for Windows
I’m currently studying malware analysis, so I wanted to write a post on the tools I’ve been using recently, to serve as a reference for me and hopefully for anyone interested in binary reversing.
assembly
x86 Function call conventions
Another cybersecurity post. Focused on binary (dis)assembly.
x86
x86 Function call conventions
Another cybersecurity post. Focused on binary (dis)assembly.
privacy
The DEFINITIVE guide to defeating spammers
Nowadays, spamming is a very common technique, and nobody can deny that. Spamming is so cheap that even a 10% opening rate is a tremendous success, because sending e-mails doesn’t require paying fees to ISPs (like you would with mass SMSs and robocalls), and it also doesn’t require hiring anyone to take the time to manually write and send e-mails (as opposed to postal spam, which have to be physically delivered into mailboxes by people), when you can just buy e-mail addresses in bulks by thousands of providers that sell active e-mail addresses by prices so ridiculously affordable, it lowers the barrier to entry dramatically.
Ansible
Automating Proxmox with Ansible
Ansible is an automation platform for managing machines. When combined with Proxmox, it becomes a ridiculously powerful tool to orchestrate virtual datacenters.
aws-cfn
AWS CloudFormation: Appending elements to lists
Short reference on manipulating CloudFormation lists.
rant
When the “better coding style” is the wrong style
Code is always read more than it is written or debugged. It is of the utmost importance that code is optimised for readability. And in this regard, it must be written such that the largest amount of people possible can read and understand it as quickly as possible.
Telegram
Set up your own Telegram proxy
Set up a Telegram MTProto proxy on a Raspberry Pi using Alpine Linux and Docker in a few minutes and communicate freely.
proxy
Set up your own Telegram proxy
Set up a Telegram MTProto proxy on a Raspberry Pi using Alpine Linux and Docker in a few minutes and communicate freely.
censorship-evasion
Set up your own Telegram proxy
Set up a Telegram MTProto proxy on a Raspberry Pi using Alpine Linux and Docker in a few minutes and communicate freely.
arm
Set up your own Telegram proxy
Set up a Telegram MTProto proxy on a Raspberry Pi using Alpine Linux and Docker in a few minutes and communicate freely.
raspberry-pi
Set up your own Telegram proxy
Set up a Telegram MTProto proxy on a Raspberry Pi using Alpine Linux and Docker in a few minutes and communicate freely.
alpine-linux
Set up your own Telegram proxy
Set up a Telegram MTProto proxy on a Raspberry Pi using Alpine Linux and Docker in a few minutes and communicate freely.