Duane Dunston, Ed.D.

918 Followers
270 Following
287 Posts
I legally create cyberattacks, former college prof, infosec professional. Mitre Adversary Emulation and CTI cert. TEDx'r.
Twitterhttps://twitter.com/gnugro
GitHubhttps://github.com/thedunston
LinkedInhttps://www.linkedin.com/in/duane-dunston-67a151195/
TEDx Talkhttps://www.ted.com/talks/duane_dunston_the_answer_to_cybersecurity_threats_middle_high_schoolers

Adding 2FA with Asterisks.

Stumbled upon an old self-hosted article i created in 2012 on using Asterisks to call with a code as a po' folk two-factor auth and decided to post it on GitHub so I don't lose track of it again. I'll add some other examples like returning the 200 OK and 401 Unauthorized header, an example Go implementation of the PHP code, and an implementation using a sqlite backend to store the user info.

https://github.com/thedunston/asterisks2Fa

I know there are other solutions, but I'm a self-hosting fan of some services.

GitHub - thedunston/asterisks2Fa

Contribute to thedunston/asterisks2Fa development by creating an account on GitHub.

GitHub
If Facebook's company gets compromised, they...metaploit. 

browmal now supports extracting macros from office documents.
https://github.com/thedunston/browmal/tree/main/no-server-required

@DaveMWilburn there is a no server version with the WASM app base64 encoded in the index.html file and the JSON files due to CORS blocking access to those files. Thank you for your pointer.

browmal/no-server-required at main 路 thedunston/browmal

Contribute to thedunston/browmal development by creating an account on GitHub.

GitHub
@DaveMWilburn btw, this one engagement on it, made it all worth creating, even if you don't use it. 馃ズ
@DaveMWilburn Based on what I've been reading with Go wasm and the tutorials, a web server seems required for it to run. I'm not able to submit the file without a web server. However, I will work on the method in the StackOverflow link. I appreciate it.

browmal: (https://github.com/thedunston/browmal): A WASM app to parse PE files in your browser, everything stays local. (You will need a web server and I included a basic Go web server, without TLS, though can add a self-signed cert, if needed).

I've been tinkering with using Go to parse PE files. I've also been curious about creating a WASM app with Go for some time. The OMAT tool from anticrypt.de inspired me to try to figure this out so I used one of the many tutorials I've been reading to parse a PE.

There are a lot of limitations to what can be performed in the browser sandbox so this is a start.

GitHub - thedunston/browmal

Contribute to thedunston/browmal development by creating an account on GitHub.

GitHub
@briankrebs I really miss email with pine the most. VLC, Gimp, awk and sed.
Infosec.exchange and infosec.space will be down for about 30 minutes starting in an hour for a hardware upgrade.

My RedisDB honeypot is now open source:

https://gitlab.com/bontchev/redispot

It is based on the RedisDB honeypot from the honeypots package

https://github.com/qeeqbox/honeypots

but has many improvements:

- output plugins - the ability to send reports to various places
- bugfixes - the original assumes that numbers are single-digit in a couple of places
- correct error messages - the original doesn't use exactly the same error messages as a real server
- supports the inline protocol - the original supports only the bulk one; all credential stuffing attackers use the inline one

Vesselin Bontchev / RedisPot 路 GitLab

GitLab.com

GitLab

This is a great resource Reverse Engineering for Everyone:

https://0xinfection.github.io/reversing/

Introduction 路 Reverse Engineering