Rule-Based Highlighter Plugin for BurpSuite

by Ángel Suárez-Bárcena Martín | Feb 18, 2020 | Labs, Techniques, Tools, Web

BurpSuite is one of those must-have tools when dealing with web application or API security assessments. Usually, when proxying applications through Burp, a fair amount of noise (advertising and user-tracking 3rd party services, CORS preflight checks, etc.) is also...

Three Most Common Security Mistakes Seen During AWS Application Assessments

by Ángel Suárez-Bárcena Martín | Jan 23, 2020 | AWS, Cloud, News, Techniques

Security is often a big concern when it comes to cloud computing. According to the Cloud Security Alliance (CSA), traditional security issues under the responsibility of cloud service providers (CSPs) are now less frequent, in contrast with those related to design,...

Parsing Binaries with Kaitai Struct

by Ángel Suárez-Bárcena Martín | Feb 1, 2019 | Labs, Techniques

Kaitai Struct is a general-purpose declarative language for describing binary data structures. With it we can parse binary file formats, in-memory data structures, network packets, etc. The target format to be parsed is first described in the Kaitai Struct language...

Writing a Simple ESP8266-Based Sniffer

by Ángel Suárez-Bárcena Martín | Jul 26, 2018 | IOT, Labs, Techniques, Tools

In this series of blogposts we will cover advanced, security focused, aspects of the ESP8266 /ESP32 SoCs such as sniffing and injecting 802.11 and bluetooth packets, building proof-of-concept network implant devices, etc. The ESP8266 is a low-cost Wi-Fi capable...