Pentesting and IT Security Blog

Our passion for testing and defending infrastructures, applications and companies often leads us to the point where we want to share our thoughts and experience with the world. Here you can read all about our exploits and research and enjoy our posts, from useful howtos, to published CVEs, management strategies, new exciting tools and much more. As a provider of offensive and defensive IT services, we always welcome readers to reach out to us and ask questions or provide feedback, be it about our blog or our services, which include web-application and network penetration tests, system defense and hardening and management consulting, among others.

SSH public key verification with FingerprintHash

date Tue Nov 17, 2015 category Defense
tags Security Client Howto Access Crypto SSH

Whenever I'm connecting to a new remote server via SSH, I tend to verify the fingerprint to make sure that I'm actually connecting to my own machine. Usually it's not that big a deal as I'm simply comparing two strings, but what if those two strings are created with two different hashing algorithms?...

Tunneling TLS Scans Through SSH

date Thu Sep 03, 2015 category Pentesting
tags TLS SSH Pentesting SSL Audits Tricks

Scanning SSL/TLS configurations is part of every pentesters skillset and an often occurring task. In order to detect some of the issues, for example the use of SSLv2, certain requirements have to be met by the scanning tool. In the mentioned example, it’s that the scanner must have been build with s...