What if attackers exploit the very essence of the Internet: HTML, JavaScript and CSS? And bypass practically every filter? This is exactly what so-called HTML Smuggling takes advantage of. Instead of sending phishing victims a file directly as an attachment or download link, the malware is embedded in HTML or JavaScript.| Articles – Lutra Security
We reported to PayPal a way to bypass their two-factor authentication, and their response was to remove the requirement for two-factor authentication. In this article, we document our findings and explain why 2FA is an important security feature that should be taken seriously.| Articles – Lutra Security
Manifest confusion is a problem in the architecture of npm, pointed out by Darcy Clarke: An npm package’s manifest is independently published from its tarball and never fully validated.| Articles – Lutra Security
Sebastian Rode of djangsters recently wrote about his perspective on pentests as a developer. This article takes the reverse perspective and tries to answer how a pentester experiences a pentest.| Articles – Lutra Security
Open Redirects are a great thing for attackers: users click on a trustworthy-looking link and think nothing of it. Why should they? They have learned in various repetitive trainings to look for the little lock icon in the URL bar of the browser and to check everything down to the domain extension before clicking on a link (modern browsers even highlight the important part). The boatload of cryptic parameters afterwards won’t bother us any more — we are used to this by now. So why make a f...| Articles – Lutra Security
Since NIST updated its password recommendations in 2017, a lot has changed. Although there are still plenty of applications that rely on the old-fashioned complexity-based rules (lower case, upper case, numbers, special characters… you know the drill), a lot has improved.| Articles – Lutra Security
If we reinvent the wheel, it’s safe to say that initially it probably won’t run as smoothly as the one that’s been around for more than 6,000 years. So if all you need is a wheel and you’re not trying to sell a new wheel, it’s a good idea to stick with the existing design. The same goes for software. If you just need a functionality, the best solution is usually to use something that already exists, a library that has already implemented it.| Articles – Lutra Security
There are already plenty of articles on how to choose a good password. In this article, we will look at the other end of the question: How to identify the most terrible passwords.| Articles – Lutra Security
Here we are. Patiently waiting to continue the ride. Finally ready to travel beyond space and time. Ready to explore the mysteries of the unknown. So jump in, fasten your seatbelts. And. Off. We. Go! Note: Where we’re going, we don’t need roads. It might, however, not hurt to read Part One first.| Articles – Lutra Security
Not a day passes without a new zero day, a reported data leak, a company temporarily shutting down due to a ransomware attack. All of this is garnished with the lingering threat of cyberattacks on critical infrastructure potentially bringing down entire countries. So yes, information security is arguably pretty important right now and in the future. This is why we are doing what we are doing. This is our motivation.| Articles – Lutra Security
Whether you are a security researcher or an amateur hacker, if you find a security vulnerability in an application or website, you are often faced with the question: What do I do now?| Articles – Lutra Security
Internet access in Russia is heavily censored. Ahead of the invasion of Ukraine on February 24, 2022, this censorship has further increased. But how reliable is the censorship and how is the censorship technically implemented?| Articles – Lutra Security
Anyone who has ever signed up somewhere knows password rules: 8 characters, uppercase letters, lowercase letters, special characters, …. But are these rules really useful and what are good password rules?| Articles – Lutra Security
Bolt is a content management system based on PHP that is a lightweight alternative to Wordpress and is used extensively by agencies. We discovered a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a file to achieve remote code execution.| Articles – Lutra Security
What is even OSINT? OSINT at its core stands for open-source intelligence and Wikipedia defines it as follows: Open-source intelligence (OSINT) is the collection and analysis of data gathered from open sources (overt and publicly available sources) to produce actionable intelligence. OSINT is used by various entities to gain information or insights on specific topics. Insurance companies, for example, use OSINT to assess the risk of their insurance policies. Other areas where OSINT is used on...| Articles – Lutra Security
The HackTheBox Business CTF 2022 featured two cloud challenges. The harder one was Operator, which we will present in the following. Fasten your seatbelts as this will be kind of a ride!| Articles – Lutra Security
Kubewarden, an only recently admitted CNCF sandbox project, has had its first stable release on 22nd of June, 2022 — a perfect time to have a quick look at it. What is Kubewarden? In short: Kubewarden is an admission controller for Kubernetes (stylized as K8s), that tries to replace the now deprecated Pod Security Policies and unify the current ecosystem by supporting both versions of Rego policies (used by Open Policy Agent and OPA gatekeeper).| Articles – Lutra Security
Follina (CVE-2022-30190) is a newly discovered vulnerability that allows to exploit the Microsoft Support Diagnostic Tool (MSDT) via specifically crafted Microsoft Office and Rich Text Format files. It is a RCE vulnerability and therefore enables an attacker to execute code on the exploited Windows system.| lutrasecurity.com
If you remember kobold letters, you already know not to blindly trust emails. But it’s not just HTML emails that can be deceiving. In this article, we’ll take a look at S/MIME and how we can use the concept of invisible salamanders to craft messages that tell each recipient a different story. Let’s talk about Salamander/MIME.| lutrasecurity.com
Anyone who has had to deal with HTML emails on a technical level has probably reached the point where they wanted to quit their job or just set fire to all the mail clients due to their inconsistent implementations. But HTML emails are not just a source of frustration, they can also be a serious security risk.| lutrasecurity.com