TYS 0x05 - open sesame

This post is part of the Test Your Skills series. You can find an introduction here. And an overview of all TYS’s currently available is over here.


Challenge

The goal of this challenge is to get your hands on the secret code which itself is hidden behind a secret and a captcha protection! You are allowed use any means necessary - think outside the box!

more...

TYS 0x04 - Is it really that easy?!

This post is part of the Test Your Skills series. You can find an introduction here. And an overview of all TYS’s currently available is over here.


Challenge

Your objective? Get root! But, do it without making any changes to the container/image or the file-system outside your users home directory (/home/void) and do not change the docker run command (run it the way shown below)!

more...

Hacking a telnetd sensor node on the back of busybox telnetd

Telnetd sensor node what?!

I call it a sensor node (more on that in a later post), you might call it a telnetd stub. We are essentially talking about a telnet service which looks like a telnet service, is fingerprinted as a telnet service, replies like a telnet service, but is limited to bare minimal functionality and just meant as a sensor to gather information.

In this case, we are looking for the folks who are looking for us - or, who are looking for exposed services on the interwebs (or maybe your corp network?).

more...

dockerinoz - build containers that won't haunt you

dockerinoz - simple Dockerfile (security) best practices verification

dockerinoz is a very small and simple tool which allows you to verify the content of Dockerfiles against a given best practice. It’s nothing more than a fancy grep using a bit more than just simple regular expressions. This approach allows for very quick verifications which is especially important when implementing dockerinoz into your build pipeline. It also makes dockerinoz super easy to modify and extend - especially as the rules are just regular expressions in a json file (rules.json).

more...