Security

In this episode I get a reverse shell working and make some progress on capturing the root flag. Spoiler: There is a self hosted GitHub like website.

Watch part 1 of me hacking the Busqueda machine at:

Thanks to Hack The Box for creating a playground for myself, and others, to learn cyber security skills. Thanks to kavigihan for creating the Busqueda machine:

One of the most common security issues I in code reviews is sensitive information, such as production credentials, API keys, etc, in the source code. The source code I just pulled from the repository. The source code all the developers before me have also pulled down to their local computers. Developers who might not work at the company anymore.

Most people are honest and won’t do anything bad with the information but there are exceptions. Even if developer is honest they might accidently expose the sensitive information such as a stolen laptop or their home network getting compromised.

In this episode I find the user flag for the Busqueda machine on Hack the Box. Perhaps with a little help from the walkthrough and Chat GPT to assist with my lack of Python knowledge.

Thanks to Hack the Box for creating a playground for myself, and others, to learn cyber security skills. Thanks to kavigihan for creating the Busqueda machine.

I am excited to announce that I’ll be attending BSides Edmonton this year! I’m looking forward to increasing my cyber security knowledge from the talks, CTF, and fellow attendees.

Specially I’m looking to learn the latest best practices for protecting my clients websites and their underlying servers. Is this something you can help me with? If so let me know and we can chat either at the conference or some other time.

I’m also happy to chat about software development, DevOps, legacy code, board games, Warhammer 40K lore, amount other things. I’m also happy to pair on some CTF problems.

I’ve made it a goal for 2023 to increase my security knowledge. This was based on increase in security related questions from clients. Specifically related to website security as most of my current work is maintaining websites for clients.

One thing I was not expecting was the amount security tools that are available. To help me remember I figured I should write them down and what better place then the dusty old blog.