Analysis of Samourai Wallet's PIN authentication reveals bypass via app restarts, resetting stateless failure counters. Key is GUID + PIN, used in PBKDF2-HMAC-SHA256 (15,000 iterations) for AES-256-CBC decryption of wallet data. Brute-force 111M possible 5-8 digit PINs feasible in ~140 days on basic hardware. Takeaway, Weak auth risks Bitcoin theft on compromised devices.
Discover CVE-2021-30357 in Check Point VPN SNX client v800007075 for Linux, where SUID bit enables root execution and an info leak allows arbitrary file reads via VPN config filepath, exposing contents like /etc/shadow in exceptions.
Description Details removed due to change of report status (N/A to open) https://hackerone.com/reports/840871
Vulnerability Details Vendor: TM Mobile Solutions app@testes-codigo.pt Product: “Testes de Código” Mobile Application (Android & iOS) About: The mobile application “Testes de Código” (tdc.te...
Introduction The Portuguese Army (Exército Português) performs operational training on cyberdefense every year. This exercice is designated as “Ciber Perseu” and the 9th edition was held in Novemb...
Introduction This challenge was presented at DragonCTF 2020 organized by Dragon Sector, a capture-the-flag team from Poland. As the description suggests, we are given an executable that works on A...
Introduction This challenge is based on vm2.ova file which is used by virtualization applications such as Oracle VM Virtualbox and VMWare Workstation. Description makes reference to OpenBSD operat...
Introduction This week Microsoft released an update for CVE-2020-1350 (SIGRed), a Remote Code Execution vulnerability that affects Windows Server versions from 2003 to Server 2019. It was assigne...
Introduction This easy challenge requires analyzing a PE32 executable file by reversing it and find a buffer overflow vulnerability in order to achieve RCE. We are given an IP address, instead of ...
Introduction Some programs were made public in HackerOne bug bounty platform last month, including Alibaba Group Bug Bounty Program. After having a look at their program details I’ve noticed they ...