back
user profile
pentestercrab
2,279karma·284submissions·August 11, 2015
recent activity (284 total)
comment
Anyone interested in this will likely enjoy Don't Skype & Type![1] where researchers decoded keystrokes from background audio of Skype conversations. The best part is source code is available…
comment
For anyone interested in gadget chains for other languages, these Github repos are quite interesting: - Java: https://github.com/frohoff/ysoserial - .NET: https://gith…
comment
This JSON Web Token Security Cheat Sheet[1] or this python script[2] are both quite useful when reviewing anything using of JWTs. [1] https://assets.pentesterlab.com/jwt_security_cheat…
comment
Anyone interested in this should read the book Spycatcher[1]. It covers a bit of this and was even banned in certain countries. [1] https://en.wikipedia.org/wiki/Spycatcher …
comment
The Trezor [1] hardware device supports backing up (at initialization) and restoring of the secret seed which is quite useful. It can also be used as a password manager [2]. [1] https://blo…
comment
Anyone interested in this topic should also make sure to check out the Procps-ng Audit Report by Qualys Security[1]. [1] https://www.openwall.com/lists/oss-security/2018/…
comment
If you want U2F with recovery, the Trezor from SatoshiLabs is a great option. Only issue is the cost is a bit higher than most hardware tokens.