Security research
Technical writing from the OKIOK team: vulnerability analysis, tooling, and techniques worked out on real engagements and written up in full.
23 articles
Understanding EDR, XDR, NDR, and MDR: A Comprehensive Guide to Detection and Response Solutions
Introduction In the ever-evolving landscape of cybersecurity, keeping up with the latest technologies and solutions is crucial for protecting an…
An NTLMv1 hash, a hundred dollars and a dream
A couple of days ago, while endlessly scrolling Twitter for the 6th hour in a row, a tweet grabbed my attention, specifically: <$150 and < 24 hours for admin…
Achieving DLL Side-Loading in the Original Process
Introduction DLL side loading has been used for quite some time now to achieve code execution in a trusted signed process.
SIEM Solutions 101 - Basic usage
In this post I’ll explain the basics on using a SIEM: how to search logs and how to send alerts.
SIEM 101 - Initial setup
In this post, I’ll explain how to initially setup a SIEM so you can receive your first logs.
SIEM 101 — Introduction
In the following days, I’ll write a few blog posts explaining how to easily learn to use a Security Information and Event Management, or SIEM.
Integrating OpenShift with GitLab
Introduction In this blog post, I am going to explain how we used GitLab and OpenShift to automatically deploy S-Filer when a new change is made in our…
S-Filer Portal Feature Preview – Easy TLS/SSL Configuration
In version 4.9.0 of S-Filer Portal, we have decided to address an important pain point with the solution: TLS configuration.
Protection for email coming in and out of an organization
On-Premise Solution We’ve already explored some ways to deal with outbound spam, now it’s time to see what is possible to do to protect ourselves from an…
SMTP toolbox to the rescue!
Outgoing Email Protection There are some tools that can improve the protection of e-mail sent to external clients outside of an organization.
Server Side Template Injection: from detection to Remote shell
Today, let’s talk about template engines and the resulting vulnerabilities, the service side template injection attacks.
Feature Highlight: Delegated Authentication
This post presents a feature of the upcoming S-Filer Portal™ v4.8.0 release: Delegated Authentication.
Charts for data visualization : Should you use it in your web application?
When you are in the process of building an application that needs to provide a lot of information for users, it is often a reflex to use tables with rows of…
Magic 101 with PowerShell Empire
Montreal, August 31st, 2016. With the multiplication of cyber-attacks reported in the news and popular TV series like Mr.
Web Application Remote Code Execution
JSP File Upload Remote Code Execution using PowerShell Empire During a penetration test on a Web application, we have found a file upload functionality.
Best practice in digital forensics: how is the integrity of digital evidence assured?
Integrity is what lets digital evidence keep its legal value. What Québec law requires, and what the tools and the method have to guarantee.
Digital Investigations Methods and Requirements
As previously mentioned in another blogpost, we live in a world where everything is becoming virtual and where digital evidence is happening to be more and…
Phishing Anonymously?
We recently did a phishing campaign for a large client. One major difference between phishing and regular penetration testing is that instead of testing IT…
Hacking for Beer – NTLM Relay (HTTP to SMTP)
Another round of the Hacking for Beer contest. This time, the plan was to send an email that will trigger an authentication request back to my machine and…
Hacking for Beer – IP Spoofing
After having to pay rounds because of the Rubber Ducky attack, I wanted a revenge !
Hacking for Beer – The Rubber Ducky
The Penetration Testing team at OKIOK developed a habit of trying to hack each other’s computer.
Burp Extensions in Python
All pen testers use the Burp suite at some point, but few really exploit it to its full potential.
SQL Injection of HTTP headers with sqlmap
When performing penetration testing, sqlmap can be used to have a granular control of the various injection points during a SQL injection.