I’ve done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can’t seem to find an answer to a small couple of questions I still have:
It is clear to me that even with OCSP in place, you still need a (delta) CRL (OCSP relies on …
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application’s host 4000+ parent and student records including medical records so secu…
WinRAR, an over 20-year-old file archival utility used by over 500 million
users worldwide, recently acknowledged a long-standing
vulnerability in its code-base. A recently published path traversal
zero-day vulnerability, disclosed in CVE-2018-20…
WinRAR, an over 20-year-old file archival utility used by over 500 million
users worldwide, recently acknowledged a long-standing
vulnerability in its code-base. A recently published path traversal
zero-day vulnerability, disclosed in CVE-2018-20…
Consider a file accessed by multiple processes; the processes map the file to memory and then use lock-free operations to synchronize (for example, use atomic-add to allocate an offset in the file to write to).
The atomic operations might…
I want to perform a benchmark for the most popular offline password cracking tools (john the ripper and hashcat)?
What metrics or approach should i take about benchmarking in order to determine what tool is better that the other?
The author of the key reinstallation attack released scripts on Github to test AP and clients.
To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of course you know the password, because y…
The author of the key reinstallation attack released scripts on Github to test AP and clients.
To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of course you know the password, because y…
All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account’s password.
However, I want to attempt to crack AES-based Kerberos TGS tickets using a short wordlist.
Lo…
The first part of this series introduced Semmle QL, and how the Microsoft Security Response Center (MSRC) are using it to investigate variants of vulnerabilities reported to us. This post discusses an example of how we’ve been using it proactively, cov…
