Tag: hacking
-
Quickly Solving JigsawExplorer Puzzles
A fellow jigsaw-hating geocacher, familiar with my work on Jigidi, challenged me to find a way to bypass JigsawExplorer too. Here's what I came up with...
-
Length Extension Attack Demonstration (Video)
This is a video version of my blog post, Length Extension Attack. In it, I talk through the theory of length extension attacks and demonstrate an SHA-1 length extension attack against an (imaginary) website.
The video can also be found on:
YouTube
-
Length Extension Attack Demonstration
Hash length extension attacks aren't necessarily intuitive without a little understanding of how vulnerable hashing algorithms work. Using SHA1 as an example, I've put together a step-by-step demonstration with a focus on teaching the underlying principles behind the vulnerability.
-
Solving Jigidi... Again
The Jigidi jigsaw solver I wrote a year and a half ago stopped working, so I made another one (it's not as good).
-
Bypassing Region Restrictions on radio.garden
As the last person on Earth to discover radio.garden, I was disappointed to find that you can't access non-UK stations from within the UK. So I "fixed" it.
-
UK Strikes in .ics Format
Need all the UK strike action in your calendar app? I just helped a coworker with that, and I'm happy to share the results with you.
-
Milk and Mail Notifications with Flic 2 Buttons
Dan deploys Flic 2 "smart buttons" to remind him to read his post and bring the milk in.
-
Hey @VOXI_UK! There's a security #vulnerability in your website. An attacker can (a) exfiltrate mobile numbers and (b) authenticate bypassing OTP.
Not sure who to talk to about ethical disclosure. Let me know? -
Quickly Solving Jigidi Puzzles
Forced with a digital jigsaw puzzle to unlock the location of a geocache... Dan resorts to hacking.
-
Getting Twitter Avatars (without the Twitter API)
Twitter's API sucks so hard that Dan resorts to screen-scraping for avatar images rather than bothering to use it "properly".
-
Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective
Moxie Marlinspike "acquires" a Cellebrite UFED and hacks it, with all the delight and sarcasm you'd expect. Dan partially-translates.
-
Big List of Naughty Strings
# Reserved Strings
#
# Strings which may be used elsewhere in code
undefined
undef
null
NULL
...
then
constructor
\
\\
# Numeric Strings
#
# Strings which can be interpreted as numeric
0
1
1.00
$1.00
1/2
1E2
...
Max Woolf
Max has produced a list of "naughty strings": things you might try injecting into your systems along with any fuzz testing you're doing to check for common errors in escaping, processing, casting, … -
Downloading a YouTube Music Playlist for Offline Play
When Dan is asked how to get YouTube Music onto a retro MP3 player, he uses it as an excuse to explain the process of writing a web scraper.
-
When you browse Instagram and find former Australian Prime Minister Tony Abbott's passport number
The hacker known as "Alex" spots that Quantas expose all kinds of data to barely-authenticated customers.
-
The Perfect Art Heist: Hack the Money, Leave the Painting
A comic telling the story of a John Constable painting targetted by thieves in 2018 for an unusual heist.