Published | JUMPSEC LABS

Tutorial – How to setup a forward proxy with HAProxy that routes TOR through a VPN…in docker

by Bjoern Schwabe | Mar 6, 2025 | Network Tools, Tutorial

At JUMPSEC we foster a research culture and want to provide people with tools and safe environments necessary to conduct research. As part of my ongoing work in setting up a new research lab I also wanted to investigate TOR environments. By design TOR is a privacy first process and the The Onion Router provides a very good solution out of the box. I won’t elaborate on the foundations of TOR in this article, instead I want to use it as an example about various options and pitfalls with routing in docker environments. Let’s look at TOR from a business implementation requirement: If devices are domain joined, adding another Intune package requires more maintenance. TOR usage in our company should be monitored, for various reasons I am not going to elaborate. Hide TOR activity from your ISP (without using obfuscated bridges). I wanted to create a central TOR service that can be used by any...

Bring Your Own Trusted Binary (BYOTB) – BSides Edition

Recently, I presented a talk on the main stage at BSides London 2024 and the topic I chose to present on was in regards to bringing trusted binaries to a system and using them in...

TokenSmith – Bypassing Intune Compliant Device Conditional Access

Conditional Access Policies (CAPs) are the core of Entra ID’s perimeter defense for the vast majority of Enterprise Microsoft 365 (M365) and Azure environments. The core ideas of...

Bullet Proofing Your Email Gateway

by Patryk Zajdel | Jun 19, 2024 | Hardening, Mail Security, network

In this labs post, I will introduce you to modern security controls that are currently used (but not always correctly) by the vast majority of enterprises, and hopefully by the end of this write-up, the topic will become a little clearer and the concepts will become easier to grasp. In today’s world of spammers, intruders, and fake emails, having a robust setup for your email deliveries is...

What’s in a Name? Writing custom DNS tunnelling protocol, exploiting unexpected AWS Lambda misconfiguration – in a web app Pen test (Part 2)

by Sunny Chau | Jun 13, 2024 | burpsuite, Exploitation, network, Research, Vulnerability

In Part 1 of the series we looked at how an AWS Lambda-powered feature was exploited in a web app penetration test initially leading to RCE and further on with out-of-band data exfiltration via DNS. Though the exact mechanism of achieving remote-code execution with Python was not discussed, we went in depth in how to return data as a result of the code being executed. Initially, with...

What’s in a Name? Writing custom DNS tunnelling protocol, exploiting unexpected AWS Lambda misconfiguration – in a web app Pen test (Part 1)

by Sunny Chau | Jun 6, 2024 | burpsuite, Exploitation, network, Research, Vulnerability

This is a war story of an AWS web application test where remote code execution was first obtained on the client's application. Then I needed to write my own DNS tunnelling 'protocol' to get the data out. Following a number of twists and turns I impersonated the application and attempted to laterally move within the AWS tenant. Before storytelling though, let's start with a public service...

WASM Smuggling for Initial Access and W.A.L.K. Tool Release

by Francesco Iulio | May 31, 2024 | Initial Access, Red Teaming

TL;DR This blog post introduces Web Assembly (WASM) as a powerful alternative to traditional web technologies, highlighting its appeal to cybersecurity professionals for evading security measures for initial access. WASM has been observed being leveraged in the wild as a new payload delivery avenue which can land payloads in a hardened email inbox or instant messaging chats. A new tool, W.A.L.K....

Adventures and Accidental Honeypots in Network Infrastructure: Unravelling Internet Shenanigans

by Ed Chan | May 16, 2024 | Binary Analysis, Network Forensics

Hello World! So, I've been tinkering with network stuff lately, trying to set up some infrastructure.Turns out that in the process, I made a rookie mistake and left a few ports open to the internet! A few months down the line I took a look and to no one’s surprise my server had been bombarded with all sorts of requests. It was receiving a steady stream of traffic, but not the good kind…think of...

Poisoning Pipelines: Azure DevOps Edition

by Francesco Iulio | May 9, 2024 | Azure Cloud, Azure DevOps, Cloud Red Team

Introduction In the ever-evolving realm of cloud services, organisations are ditching the headaches of physical infrastructure management and diving headfirst into the possibilities of cloud platforms. From the humble beginnings of deploying virtual machines and servers, we now find ourselves in a dynamic space with everything from serverless architectures to cloud-based active directories,...

Why sneak when you can walk through the front door – A Love letter to Password Spraying against M365 in Red Team Engagements

by Sunny Chau | May 2, 2024 | Azure Cloud, Cloud Red Team, Initial Access

In 2023 through 2024, JUMPSEC's red team gained access to Microsft 365 (M365) environments of sophisticated clients during adversarial engagements with an approach that breathes life into the decades-old technique of password spraying. With threat actors increasingly using similar approaches in the wild, being able to compromise the even likes of Microsoft themselves, it is my opinion that red...

Advisory CVE-2023-43042 – IBM Backup Products Superuser Information Disclosure

by Max Corbridge | Dec 21, 2023 | Exploitation, Jumpsec, Research, Security Bug, Vulnerability

Software: IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize products Affected versions: 8.3 Vendor page: https://www.ibm.com/support/pages/node/7064976 CVE Reference: CVE-2023-43042 Published: 08/12/2023 CVSS 3.0 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector: Network Credit: Max Corbridge Summary JUMPSEC’s Head of Adversarial Simulation...

« Older Entries

Next Entries »

JUMPSEC LABS

Tutorial – How to setup a forward proxy with HAProxy that routes TOR through a VPN…in docker

Bring Your Own Trusted Binary (BYOTB) – BSides Edition

TokenSmith – Bypassing Intune Compliant Device Conditional Access

Bullet Proofing Your Email Gateway

What’s in a Name? Writing custom DNS tunnelling protocol, exploiting unexpected AWS Lambda misconfiguration – in a web app Pen test (Part 2)

What’s in a Name? Writing custom DNS tunnelling protocol, exploiting unexpected AWS Lambda misconfiguration – in a web app Pen test (Part 1)

WASM Smuggling for Initial Access and W.A.L.K. Tool Release

Adventures and Accidental Honeypots in Network Infrastructure: Unravelling Internet Shenanigans

Why sneak when you can walk through the front door – A Love letter to Password Spraying against M365 in Red Team Engagements

Advisory CVE-2023-43042 – IBM Backup Products Superuser Information Disclosure

[Latest Posts]

[Categories]

GitHub Activity

Twitter

Latest from JUMPSEC

Disclaimer