Secure Ideas

Professionally Evil Fundamentals: Introduction

Linux X86 Assembly – How To Test Custom Shellcode Using a C Payload Tester

| | ALSR, analysis, Application Security, architecture, ASM, cpu, debugging, DEP, function, gas, getpagesize, Hello World, Linux, mprotect, payload, Penetration Testing, pointers, Professionally Evil, programming, Reverse Engineering, Secure Ideas, shellcode, stub, syscalls, testing, training, x86
Overview In the last blog post in this series, we created a tool to make it easy to build our custom payloads and extract them.  However, what if we want to test ...
Professionally Evil Insights

It Was The Best Of Times, It Was The Worst Of Times…A Tale of Two Passwords

| | Best Practices, Information Security, Password Security, Professionally Evil, Secure Ideas, security, Security Awareness, web app security
Two of the characters in Charles Dickens’ beloved novel, A Tale of Two Cities have such similar features that their identities are swapped.  No one notices.  One escapes and reunites with his ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

Linux X86 Assembly – How to Make Our Hello World Usable as an Exploit Payload

| | analysis, Application Security, architecture, ASM, call, cpu, exit, gas, Hello World, int, jmp, Linux, mov, objdump, optimize, payload, Penetration Testing, PoP, Professionally Evil, programming, push, Registers, Reverse Engineering, Secure Ideas, shellcode, syscalls, training, write, x86, xchg, xor
Overview In the last two tutorials, we built a Hello World program in NASM and GAS for x86 assembly.  While this can help us learn x86 assembly, it isn’t viable as a ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

Linux X86 Assembly – How to Build a Hello World Program in NASM

| | analysis, Application Security, architecture, ASM, C++, cpu, exit, Hello World, int, Linux, mov, NASM, payload, Penetration Testing, Professionally Evil, programming, Registers, Reverse Engineering, Secure Ideas, shellcode, syscalls, write, x86
Overview A processor understands bytecode instructions specific to that architecture.  We as humans use mnemonics to make building these instructions easier than remembering a bunch of binary codes.  These mnemonics are known ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

A Hacker’s Tour of the X86 CPU Architecture

| | analysis, Apple, architecture, ARM, cpu, eflags, Endian, M1, payload, Penetration Testing, Professionally Evil, Registers, Reverse Engineering, Reviews, Secure Ideas, segments, shellcode, x86
Overview The Intel x86 CPU architecture is one of the most prolific CPU architectures for desktops, laptops, and servers.  While other architectures exist and are even taking some market share with mobile ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

LD_PRELOAD: How to Run Code at Load Time

| | analysis, attribute, C++, constructor, debugging, destructor, ELF, gcc, gnu, inject, injection, LD_PRELOAD, Linux, make, Penetration Testing, proc, Professionally Evil, programming, Reverse Engineering, Secure Ideas, self-, Shared Objects, training
    Today I want to continue the series on using LD_PRELOAD.  In previous posts, we covered how to inject a shared object binary into a process, and use that to hijack a library ...
Professionally Evil Insights
Android Virtual Device for a Mobile PenTest

How to configure Android (Virtual) for Mobile PenTest

| | android, mobile application, Mobile Pentest, Mobile Security, Penetration Testing, pentest, Professionally Evil, Secure Ideas, training, virtual
This post is about setting up an Android Virtual Machine (AVD) for a mobile application penetration test ...
Professionally Evil Insights
Professionally Evil Fundamentals - Encryption

Encryption – CISSP Domain 3

| | Blog, CBK, CISSP, CISSP Mentorship, Confidentiality, data in use, data in-transit, Data-At-Rest, Domain 3, encryption, encryption algorithms, Professionally Evil, Secure Ideas, training
We’re circling back to some more CISSP-related materials. Today’s topic will be encryption, which can be found in CISSP Domain 3. By its very nature, encryption is meant to hide the meaning ...
Professionally Evil Insights
Professionally Evil Fundamentals Encoding

Encoding – CISSP Domain 3

| | Base64, Blog, CBK, CISSP, CISSP Mentorship, code vs cipher, Domain 3, encoding, encryption, Professionally Evil, Secure Ideas, training
Today we’re going to take a quick look at encoding, as covered in Domain 3 of the CISSP common body of knowledge (CBK). There is often some confusion between encoding and encryption, ...
Professionally Evil Insights

Workplace Surveillance, Apple and Google Contact Tracing Tech, Virtual Cybersecurity Conferences

| | Conferences, Contact Tracing, coronavirus, COVID-19, Cybersecurity, Digital Privacy, google, Kevin Johnson, Podcast, Podcast Episodes, Privacy, Secure Ideas, Silent Pocket, surveillance, virtual, Weekly Blaze Podcast, Workplace
In episode 119 for May 4th 2020: The use of thermal cameras and other technology to monitor the workplace for COVID-19, more details about Apple and Google’s contact tracing framework, and are ...
Shared Security Podcast
Load more