Jarvis, sometimes you gotta run before you can walk - Searching on Google how to combat writer’s block and blank page fear? Check. I really don’t know how to start this time, probably because I’m distracted so let’s dive right into it. In the last post we learnt how to inject a symbolic bitvector inside a register using angr and...

You need to learn to walk before you can run - In the zeroth part of this series we learnt how to perform some very basic symbolic execution of a simple binary. This time we are going to talk about symbolic bitvectors and how to avoid unwanted states to reduce execution times. We are going to skip the challenge 01_angr_avoid as...

Baby steps in symbolic execution - I need a holiday. I definetely need one. But what’s the point in going on vacation if you never learned how to use angr in a CTF? Wait, you are telling me this is not a reason not to go on vacation? Well, too bad, you should’ve told me before...

Reverse engineering with Binary Ninja and GDB - Yesterday I bought the commercial edition of Binary Ninja and I wanted to test it out so I went looking for some interesting reverse engineering challenges. Since I SUCK at reverse engineering I decided to go for a simple crackme from the 2017 edition of the Enigma CTF called Crackme...

Go RIP Injection Program - It has been in my mind for quite some time to learn Golang and write some pentesting-oriented tools lately. I’ve finally made up my mind and wrote a tool to inject fake RIPv2 routes in a network in Go that I called Golang RIP Injection Program (or GRIP for short)....

2FA at login: using Yubikeys as a second authentication layer - Introduction Quick recap of what we saw in the first and second parts of this series. We started out by seeing how to setup your Macbook so that only one account is allowed to decrypt FileVault2, effectively creating two different passwords for mass storage decryption and user login authentication. After...

Separating Privileges (2): different accounts for different privilege levels - Introduction Quick recap of what we saw in the last post. In the first part of this series we saw how to create a new user and allow only him to unlock FV2. This effectively allows having different passwords for FV2 decryption and user authentication. In this short post we...

Separating Privileges (1): different passwords for decryption and authentication - Introduction This is a blogpost series on how I keep my Macbook insecure. These posts take a lot from the following resources so kudos to them first: macOS Security and Privacy Guide Configuring macOS Sierra to authenticate with YubiKey 4 The idea behind this is to make it impossible very...

Ok so, this is not much actually, just a silly hello world (tbh, I’m keeping it so I remember how to put images in posts in the homepage) This is how I will highlight important stuff in posts: NOTE: this is a note, I'll use it to make things clearer...