Posts

In this episode I get a reverse shell working and make some progress on capturing the root flag. Spoiler: There is a self hosted GitHub like website.

Watch part 1 of me hacking the Busqueda machine at:

Thanks to Hack The Box for creating a playground for myself, and others, to learn cyber security skills. Thanks to kavigihan for creating the Busqueda machine:

One of the most common security issues I in code reviews is sensitive information, such as production credentials, API keys, etc, in the source code. The source code I just pulled from the repository. The source code all the developers before me have also pulled down to their local computers. Developers who might not work at the company anymore.

Most people are honest and won’t do anything bad with the information but there are exceptions. Even if developer is honest they might accidently expose the sensitive information such as a stolen laptop or their home network getting compromised.

In this episode I find the user flag for the Busqueda machine on Hack the Box. Perhaps with a little help from the walkthrough and Chat GPT to assist with my lack of Python knowledge.

Thanks to Hack the Box for creating a playground for myself, and others, to learn cyber security skills. Thanks to kavigihan for creating the Busqueda machine.

Custom software is expensive to build and usually delivered late and overbudget. Custom software, like a garden, needs to maintained and frequently updated. Especially for security updates. Everyone, well almost everyone, forgets to budget time and money for maintenance.

Before getting custom software built you should check for an existing solution. I’m willing to bet something does exist. Don’t get hung up on the 10% the custom software can’t do. Look at the 90% of the problem it does solve.

In this episode I try out the new Docker Compose Watch developer feature that synchronizes files on the host and the container. Similar to Docker Volumes. It won’t replace Docker Volumes for for me, at least not yet. Are you using, or thinking about using, Watch?

I did encounter a known bug where Docker Watch won’t run again after a Ctrl-C stop. You can find a workaround for the issue here.