Behind the Bug
During a recent engagement, I was tasked with testing a web application, in a non-production environment, with Multi-Factor Authentication (MFA). As I began testing, I realized that all of the […]
Uncategorized
Tales From The Red Team: Building Winexe
During one of our Red Team Engagements we were able to gain a foothold on our client’s perimeter via default credentials for an uncommon application server. Once we had this […]
Your Boss Wants You to Write Pentest Blog Posts… Now What?
Oh dear, what have I gotten myself into? I recently started at White Oak Security and I’m getting a different set of pentesting experiences under my belt. Life has been […]
Brief CMD+CTRL Cyber Range Review
Secure360 just took place here in Minnesota on May 14th through the 15th. One interesting addition this year I noticed was the Cyber Range Capture The Flag (CTF). At the […]
Happy to be a 2018 Sponsor of the MN ISSA
White Oak Security is excited to be a 2018 sponsor of the Minnesota chapter of the Information Systems Security Association (ISSA). We fully support their efforts to promote education, networking […]
CBSSports.com Vunerabilities
I want to start by thanking the folks at CBS Interactive andCBS Corporation for working so diligently with me on remediating the issues Idiscovered, and for responsibly disclosing these issues. […]
CBSSports.com Horizontal Access Control Bypass (Trades & Add/Drop)
Summary=========The CBSSports.com fantasy sports sites do not properlyenforce access control between user accounts at the same privilege level withinthe application. This behavior could be leveraged by an attacker to send […]
CBSSports.com Cross-Site Request Forgery
Summary=========The CBSSports.com fantasy sports sites do not prevent unauthorized execution of sensitive operations initiated outside the authorized application workflow. This behavior could beleveraged by an attacker through a Cross-Site Request Forgery […]
CBSSports.com Horizontal Access Control Bypass (Scoreboard Chat)
Summary=========The CBSSports.com fantasy sports sites did not properly enforce access control between user accounts at the same privilege level within the application. This behavior could be leveraged by an attacker […]
CBSSports.com Horizontal Access Control Bypass (Trading Block)
Summary=========The CBSSports.com fantasy sports sites did not properly enforce access control between user accounts at the same privilege level within the application. This behavior could be leveraged by an attacker […]