plaintext

A Universal .zshrc File

Sun, 15 Feb 2026 00:00:00 +0100

Since forver ago, I have been using oh-my-zsh with a fairly standard configuration. Plugins for commands I often use, utility functions, and all the clutter you accumulate after years of building and breaking software. That included fuzzing configuration, an unreal amount of version managers, and custom configurations, including those recklessly appended by automatic installers. Since my day-to-day work is fairly intense, it’s safe to say that for the last five years, not just my .zshrc but also various other files connected to it were left unattended. Today, this changed.

Geth and Prysm in Docker Compose

Sun, 06 Oct 2024 00:00:00 +0200

I’m getting back into hacking on Ethereum nodes. Some of my tests are RPC-heavy, so a local setup is required. This will also speed up development since requests remain in my local network. However, I haven’t found an easy Docker Compose setup for running Geth and Prysm together.

version: "3.8"

services:
 geth:
 image: ethereum/client-go:stable
 container_name: geth
 restart: unless-stopped
 ports:
 - 30303:30303
 - 30303:30303/udp
 - 8545:8545
 - 8546:8546
 - 8551:8551
 volumes:
 - /ethereum/execution:/root
 command:
 - --http
 - --http.api=eth,net,web3
 - --http.addr=0.0.0.0
 - --authrpc.addr=0.0.0.0
 - --authrpc.vhosts=*
 - --authrpc.jwtsecret=/root/jwt.hex
 - --authrpc.port=8551

 prysm:
 image: gcr.io/prysmaticlabs/prysm/beacon-chain
 container_name: prysm
 restart: unless-stopped
 volumes:
 - /ethereum/consensus:/data
 depends_on:
 - geth
 ports:
 - 4000:4000
 - 3500:3500
 command:
 - --accept-terms-of-use
 - --datadir=/data
 - --disable-monitoring
 - --rpc-host=0.0.0.0
 - --execution-endpoint=http://99.97.0.1:8551
 - --jwt-secret=/data/jwt.hex
 - --rpc-host=0.0.0.0
 - --rpc-port=4000
 - --grpc-gateway-corsdomain=*
 - --grpc-gateway-host=0.0.0.0
 - --grpc-gateway-port=3500
 - --min-sync-peers=7
 - --checkpoint-sync-url=https://mainnet.checkpoint.sigp.io
 - --genesis-beacon-api-url=https://mainnet.checkpoint.sigp.io

networks:
 default:
 ipam:
 driver: default
 config:
 - subnet: 99.97.0.0/16

The network configuration is required to set Prysm’s execution endpoint to the Geth instance. The setup assumes two root paths are set on the server with approprivate permissions: /ethereum/consensus and /ethereum/execution. The JWT has been generated with openssl in the execution directory:

Migration and Business in Germany

Sat, 14 Sep 2024 00:00:00 +0200

In recent weeks, Germany has been on the international news. In the state elections in Thuringia and Saxony (where I live), the extreme right-wing AfD and left-wing BSW have gotten huge voter support. Their focus on immigration, border security, and crime, as well as skilled harping on East-West differences in Germany, seems to have had a significant impact.

Background

Describing East Germany is tough. I grew up here, in Saxony-Anhalt, in a city close to where the border used to be, and countless people lost their lives trying to escape the socialist GDR regime. I was born in 1994, five years after the wall came down. Giant bald strips cut into the dense forest, abandoned surveillance buildings and watchtowers, and mined patches with warning signs are still vivid memories of my childhood.

Field Guide Tryhard

Sun, 01 Sep 2024 00:00:00 +0200

Long story short, I got disillusioned with my previous work and its context. I started my project, the Smart Contract Security Field Guide (SCSFG) to cope with it. Here are some nice features:

New code samples instead of the same-old code you see everyone steal over and over
A section for hackers to give inspiration when stuck and explanations where the attack vector is clear
A section for developers with general security guidelines, from audit preparation to running a bug bounty program
No trackers, no ads, no shilling products, no bullshit. Just information.

In my day-to-day work, I interact with the field guide mainly through the search box, just to see whether I have written something about a certain keyword. The development recommendations are great to send to clients’ dev teams if there is general uncertainty around a topic.

Excessive Growth and Corporate Parties

Thu, 20 Jul 2023 00:00:00 +0200

Corporate parties - essentially designed to celebrate company triumphs, whether hitting revenue targets or instilling the company’s mission and vision into the employees - can often devolve into nothing more than an extravagant distraction. This illusion of harmony, of success, of the ‘perfect’ work environment is essentially the art of corporate virtue signaling. It’s a façade masking the underbelly of what could potentially be inefficiency, misalignment, and, frankly, disarray.

This form of virtue signaling is pervasive mainly in the growing web3 space. Despite the industry being a hotbed of innovation and progress, there is a noticeable shortage of leadership talent capable of shepherding this growth. As a result, there’s a tendency to fall back on old, traditional leadership and management patterns, including these orchestrated and, often, opulent celebrations.

Vacation Traditions

Fri, 13 Jan 2023 00:00:00 +0100

I enjoy getting lost in work. I mean, really enjoy it. I forget to eat and sleep, especially when developing software. There is something addicting about building an MVP as fast as possible, finding the perfect architecture, refactoring your previous hacks, and eventually making your code observable and running smoothly. Whenever I take a vacation, I find myself not really taking time off, however. I’ll hack on other projects, “be around,” and I already find myself working before the holiday ends.

Honest Attempts to Secure an Ecosystem

Wed, 29 Jun 2022 00:00:00 +0200

I have used my off-time from audits in the past months to write more about security. Especially in a nascent ecosystem like Ethereum still is, the most considerable impact can be delivered by educating people. Education has to happen in different modes of complexity, depending on the target audience:

Developers must be educated on how previous hacks happened and how to avoid making similar mistakes in the code they produce.
Business leads must be educated about the general (in-)securities of smart contracts and what can and cannot be expected of them.
General users must be educated on spotting and avoiding scams while repeatedly preached to not invest any money they can’t afford to lose. Ever.

My own contribution to the above is the Ethereum Smart Contract Best Practices. When I joined ConsenSys Diligence, the repository already existed, and people enjoyed the content. In the rollercoaster of auditing smart contracts as the main business, little time was left to properly maintain code samples, keep best practices up to date, and polish the overall site. I intend to change that.This is a note for everyone who enjoys my technical posts to follow along as I develop the best practices. Occasionally, I also tweet about the sections I have revised previously. Contact me if you have suggestions on attacks, best practices, or helpful tooling to add. After all, this is about educating a community so it can make educated decisions!

Remembering my Dad

Wed, 16 Mar 2022 00:00:00 +0100

On March 11, 18:11, my dad passed away. After about a year with lung cancer and two weeks with COVID-19, he finally does not have to struggle anymore.

I miss him dearly. After he got COVID, the doctors diagnosed him with pneumonia. He spent a week in the hospital before being released. He needed oxygen 24/7 and, in 30-minute intervals, switched from lucid moments where he was his usual self to a confused state of mind where memories and thoughts meddled with his conscience. When able to talk, he seemed to relive moments from his past mixed with the input his senses gave him.

HackTheBox Registry

Sat, 13 Feb 2021 00:00:00 +0100

Registry is a box rated at hard difficulty. There are quite a few steps involved, but with a bit of persistence and little experience with Docker internals (hint hint), it looks more daunting than it actually is. Let’s go through the process of breaking in step by step! Out initial nmap scan is as unexciting as it can be:

# Nmap 7.80 scan initiated Fri Jan 10 17:08:06 2020 as: nmap -sS -sC -oN registry.nmap -v 10.10.10.159
Increasing send delay for 10.10.10.159 from 0 to 5 due to 238 out of 792 dropped probes since last increase.
Nmap scan report for 10.10.10.159
Host is up (0.10s latency).
Not shown: 997 closed ports
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 2048 72:d4:8d:da:ff:9b:94:2a:ee:55:0c:04:30:71:88:93 (RSA)
| 256 c7:40:d0:0e:e4:97:4a:4f:f9:fb:b2:0b:33:99:48:6d (ECDSA)
|_ 256 78:34:80:14:a1:3d:56:12:b4:0a:98:1f:e6:b4:e8:93 (ED25519)
80/tcp open http
| http-methods:
|_ Supported Methods: GET HEAD
|_http-title: Welcome to nginx!
443/tcp open https
| http-methods:
|_ Supported Methods: GET HEAD
|_http-title: Welcome to nginx!
| ssl-cert: Subject: commonName=docker.registry.htb
| Issuer: commonName=Registry
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2019-05-06T21:14:35
| Not valid after: 2029-05-03T21:14:35
| MD5: 0d6f 504f 1cb5 de50 2f4e 5f67 9db6 a3a9
|_SHA-1: 7da0 1245 1d62 d69b a87e 8667 083c 39a6 9eb2 b2b5

Read data files from: /usr/bin/../share/nmap
# Nmap done at Fri Jan 10 17:08:20 2020 -- 1 IP address (1 host up) scanned in 14.34 seconds

On ports 80 and 443, we both see a default NGINX site. Only the TLS certificate’s Common Name docker.registry.htb gives us a hint. With the box being called Registry, we can deduce that this server probably has a Docker registry installed. Accessing the referenced vhost gives us an empty response:

HackTheBox Fuzzy

Wed, 23 Sep 2020 00:00:00 +0200

Fuzzy is a fun and short challenge on a docker container. It is especially good for teaching beginners the basics of using a fuzzer to discover new endpoints on a webserver.Spawning the container and probing around a bit, we don’t have too much success. Using dirbuster and a standard wordlist, we find the endpoint /api/action.php. With wfuzz we can now see whether passing any specific parameter to the endpoint significantly changes our response payload:

HackTheBox Mango

Sat, 08 Aug 2020 00:00:00 +0200

Mango was an interesting box when it comes to enumeration. It taught me to look more closely and not brush off anything just because I have seen it before. The box is also a prime lesson to aggregate your recon info in a structured manner so it’s easier to apply it at other points when you hit a dead end somewhere. There were also some nice opportunities for small, specialised attack scripts, which I particularly enjoyed! When we start out by scanning the box, we get the following report:

Construct Truffle Artifact Source Lists

Tue, 12 May 2020 00:00:00 +0200

This is a quick and dirty workaround for an issue that has been bugging me a lot. Truffle is one of the central, if not the most central development tool for building smart contracts on Ethereum to date. When compiling a Truffle project, the output is stored in build/contracts by default. An artifact simply a JSON object containing a plethora of data. A short sample from the SKALE project:

{
 "contractName": "SkaleDKG",
 "abi": [],
 "metadata": "{\"compiler\":{\"version\":\"0.5.16+commit.9c3226ce\"},...}",
 "bytecode": "0x...",
 "deployedBytecode": "0x...",
 "sourceMap": "1529:30527:18:-;;;;;;;;;",
 "deployedSourceMap": "1529:30527:18:-;;...",
 "source": "...",
 "sourcePath": "/path/to/skale-manager/contracts/SkaleDKG.sol",
 "ast": {},
 "legacyAST": {},
 "compiler": {
 "name": "solc",
 "version": "0.5.16+commit.9c3226ce.Emscripten.clang"
 },
 "networks": {},
 "schemaVersion": "3.0.20",
 "updatedAt": "2020-05-05T09:55:25.394Z",
 "devdoc": {},
 "userdoc": {
 "methods": {}
 }
}

If we want to submit this artifact as a payload to MythX for security analysis, we are lacking an important feature, however: The source list.

HackTheBox Postman

Sat, 21 Mar 2020 00:00:00 +0100

Postman was an easy-going box. It required careful enumeration and beyond that did not have too much resistance in privilege escalation. This makes it a prime example for real-world M&M security where the initial foothold is hard, but there is few resistance on the inside. Let’s start out by scanning the machine:

# nmap -sS -sC -oN postman.nmap -v 10.10.10.160
# Nmap 7.80 scan initiated Sun Dec 8 11:27:40 2019 as: nmap -sS -sC -oN postman.nmap -v -p1-10000 10.10.10.160
Increasing send delay for 10.10.10.160 from 0 to 5 due to 674 out of 2245 dropped probes since last increase.
Nmap scan report for 10.10.10.160
Host is up (0.11s latency).
Not shown: 9996 closed ports
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA)
| 256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA)
|_ 256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519)
80/tcp open http
|_http-favicon: Unknown favicon MD5: E234E3E8040EFB1ACD7028330A956EBF
| http-methods:
|_ Supported Methods: GET POST OPTIONS HEAD
|_http-title: The Cyber Geek's Personal Website
6379/tcp open redis
10000/tcp open snet-sensor-mgmt
| ssl-cert: Subject: commonName=*/organizationName=Webmin Webserver on Postman
| Issuer: commonName=*/organizationName=Webmin Webserver on Postman
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2019-08-25T16:26:22
| Not valid after: 2024-08-23T16:26:22
| MD5: 96f4 064c e63e 1277 4954 a4d9 a099 56ac
|_SHA-1: 4322 6ff3 ab7a 6ade 2887 9b89 6657 401c 3afd 5217
|_ssl-date: TLS randomness does not represent time

Read data files from: /usr/bin/../share/nmap
# Nmap done at Sun Dec 8 11:29:31 2019 -- 1 IP address (1 host up)

There are a few interesting things here already. We have a webserver running on port 80, an unprotected Redis database server on the default port 6379, and a custom application on port 10000. The latter one apparently is using an SSL certificate where the organizationName already tells us that we are dealing with a Webmin admin panel here. That is already decent information to start out with! Looking at the website on port 80, there is no real attack surface present. It’s just static content.

The Web3 API has come to Python!

Sun, 15 Mar 2020 00:00:00 +0100

Last week I received an email in my inbox about a hackathon hosted by the awesome folks over at Amberdata. They are a provider for on-chain data and cover a large variety of blockchains - including Ethereum, Bitcoin, and Stellar. I have met the developers in the team in late 2018 when I was looking for my next gig in the Ethereum ecosystem and long before that I was stunned by the large variety and volume of data they are handling.

36C3 Telnet Challenge (Cat CTF)

Sat, 18 Jan 2020 00:00:00 +0100

This is a write-up from the 36th Chaos Communication Congress, 2019. It has been my fourth Congress. Timed shortly after Christmas, it feels like meeting a second kind of family after the holidays. Hackers from all over the world gather in Leipzig to celebrate the weirdness of our community, break technology, learn new things, and have caffeine-fuelled fun.On my initial recon walk with friends we stumbled across the following poster.

HackTheBox Obscurity

Sun, 12 Jan 2020 00:00:00 +0100

Obscurity is a medium-difficulty box. It was super fun to solve because it involved great excuses for me to write some neat little helper scripts and find a vulnerability in Python code. Something you don’t do too often in these challenges. Let’s dive right in with a nmap scan:

$ nmap -sS -sC -oN obscurity.nmap -v 10.10.10.168
Nmap 7.80 scan initiated Fri Jan 10 12:57:06 2020 as: nmap -sS -sC -oN obscurity.nmap -v 10.10.10.168
Nmap scan report for 10.10.10.168
Host is up (0.16s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 2048 33:d3:9a:0d:97:2c:54:20:e1:b0:17:34:f4:ca:70:1b (RSA)
| 256 f6:8b:d5:73:97:be:52:cb:12:ea:8b:02:7c:34:a3:d7 (ECDSA)
|_ 256 e8:df:55:78:76:85:4b:7b:dc:70:6a:fc:40:cc:ac:9b (ED25519)
80/tcp closed http
8080/tcp open http-proxy
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: 0bscura
9000/tcp closed cslistener

Read data files from: /usr/bin/../share/nmap
# Nmap done at Fri Jan 10 12:57:35 2020 -- 1 IP address (1 host up) scanned in 29.44 seconds

Checking port 8080 on the server, we find the following text:

HackTheBox OpenAdmin

Thu, 09 Jan 2020 00:00:00 +0100

OpenAdmin is yet another medium-difficulty machine, which was a blast to hack on! It involved dealing with various stack components, such as interacting directly with a MySQL database. Furthermore, hopping across multiple users through different escalation vectors was very satisfying. Let’s see how it is done!Our first nmap scan does not yield any exciting results:

$ nmap -sS -sC -oN openadmin.nmap -v 10.10.10.171
# Nmap 7.80 scan initiated Wed Jan 8 14:33:26 2020 as: nmap -sS -sC -oN openadmin.nmap -v 10.10.10.171
Nmap scan report for 10.10.10.171
Host is up (0.11s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
| 256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_ 256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp open http
| http-methods:
|_ Supported Methods: GET POST OPTIONS HEAD
|_http-title: Apache2 Ubuntu Default Page: It works

Read data files from: /usr/bin/../share/nmap
# Nmap done at Wed Jan 8 14:33:32 2020 -- 1 IP address (1 host up) scanned in 6.18 seconds

On port 80, we see the default Ubuntu Apache page. The server headers and error page leak the concrete version, but it is updated. Using dirbuster and a small directory wordlist, we find the /music and /ona endpoints. The first one hosts a custom web application without any exciting functionality. ONA is more attractive as it stands for OpenNetAdmin. In the OpenNetAdmin interface, we are automatically logged in as a guest account. The user info panel leaks some database details, however. We get to know that MySQL is running on localhost, the default DB name is, and the default user is named ona_sys. We can also see the ONA version, which is v18.1.1. This is plenty of information to go on!We find that an RCE is available for our version when we check for exploits. With some minor target-related updates to the proof-of-concept, we can drop into a shell right away and dump some user data:

HackTheBox Traverxec

Sat, 04 Jan 2020 00:00:00 +0100

Traverxec is an interesting box, mainly because the HackTheBox team rated it as easy while the community disagreed and voted it to medium difficulty. It involved a funky privilege escalation that I had not seen before. Let’s see how it’s done! Our first nmap scan does not return exciting results:

$ nmap -sS -sC -oN traverxec.nmap -v 10.10.10.165
# Nmap 7.80 scan initiated Mon Dec 9 13:49:03 2019 as: nmap -sS -sC -oN traverxec.nmap -v 10.10.10.165
Nmap scan report for 10.10.10.165
Host is up (0.11s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 2048 aa:99:a8:16:68:cd:41:cc:f9:6c:84:01:c7:59:09:5c (RSA)
| 256 93:dd:1a:23:ee:d7:1f:08:6b:58:47:09:73:a3:88:cc (ECDSA)
|_ 256 9d:d6:62:1e:7a:fb:8f:56:92:e6:37:f1:10:db:9b:ce (ED25519)
80/tcp open http
|_http-favicon: Unknown favicon MD5: FED84E16B6CCFE88EE7FFAAE5DFEFD34
| http-methods:
|_ Supported Methods: GET HEAD POST
|_http-title: TRAVERXEC

Read data files from: /usr/bin/../share/nmap
# Nmap done at Mon Dec 9 13:49:30 2019 -- 1 IP address (1 host up) scanned in 26.97 seconds

On port 80, we see a portfolio website. Nothing exciting seems to be hidden here. We have some static images, a Javascript gallery, a bootstrap template, and a bit of glue in between. The contact form initially seemed interesting, but on closer inspection, we simply perform a GET request to an empty file:

HackTheBox Wall

Sat, 07 Dec 2019 00:00:00 +0100

Wall was as much a fun and educational box as it was frustrating and stretching my patience. It felt like the system was updated by the creator to have some features in place meant to annoy people trying to break in. Nevertheless, there are some nice WAF evasion techniques to consider here, as well as the lesson to never give up on enumeration Starting with a SYN scan, executing scripts where possible:

Dear Medium,

Mon, 11 Nov 2019 00:00:00 +0100

My blogging journey has taken me far. I started writing articles about six years ago. Things got serious after I started studying Computer Science. Among the students of my class there was a lot of chatter. The tendency was that who was unable to communicate would soon start failing exams and eventually quit. In this setting, I started writing technical articles, first on an intranet website. Later GitHub gists. Finally I made the step to host my own blog.

The DEFCON 27 Packet Hacking Village Honeypot Challenge

Thu, 15 Aug 2019 00:00:00 +0200

This year marks the first time I got to attend DEFCON Las Vegas — one of the largest hacker conferences in the world. There are a plethora of things to discover and try out. The talks can be streamed later, but the workshops and spontaneous gatherings? A challenge that caught my eye was the honeypot challenge in the packet hacking village. The setting is simple: You gain access to an SSH honeypot. In there you find challenges to solve and gather the credentials to the next one. The goal was to escalate through five machines and gain the secret passphrase.

A Code Review Story

Sun, 28 Jul 2019 00:00:00 +0200

This is the first post of a sporadic series where we will dive into the weeds of more complex Python code review samples. I will take (slightly modified) real-world code samples, explain some common mistakes that have been made, and how we can improve things. Let’s jump right in!

In this scenario, we have a component that is supposed to handle artifacts containing log messages. It is structured as an object implementing a pipeline of various sanitization and postprocessing tasks. Among a ton of other things, there is the groom_logs method, which is static, and fulfills the task of validating and deduplicating the log list of a given artifact.

HackTheBox fs0sciety

Sat, 20 Oct 2018 00:00:00 +0200

fs0ciety is yet another low-hanging fruit among the HackTheBox challenges. It’s great for beginners who want to test their process for cracking password-protected zip files and recognition of various encodings.For that, we will use fcrackzip - simply for the reason that it has been around for ages and ships with Kali by default. I have sourced my wordlist from here. Let’s fire up the program:

Unzipping the file with the password justdoit: unzip -P justdoit fsociety.zip; We find an interesting file containing credentials:

Explain like I'm five: Cryptographic Hashing

Mon, 15 Oct 2018 00:00:00 +0200

tl;dr Just check out the image and read the details below it if you want to know even more. :)

A few days back I read an article by Yunyun Chen explaining Hashing in an infographic. I enjoyed it and read some comments, which pointed out a couple of weak spots that result from common misconceptions about (cryptographic) hashing.

Mostly this is a result of the distinction between the concept of a cryptographic hash function (its formal, mathematical properties) and implementations of that concept (concrete algorithms such as SHA-256). As the blockchain community attracts people from all kinds of backgrounds, it’s important to clarify these former and educate people about the basic cryptographic concepts blockchain technology is based on. Only when a community around a technology is educated about how it works it can make meaningful progress and ultimately create innovation.

HackTheBox 0ld_is_g0ld

Sat, 13 Oct 2018 00:00:00 +0200

0ld_is_g0ld is a HackTheBox challenge and a great way for beginners to familiarize themselves with PDF password cracking. If you have used Hashcat before, it’s an easy win. Verifying we indeed are targeting the correct file format:

$ file 0ld\ is\ g0ld.pdf
0ld is g0ld.pdf: PDF document, version 1.6

We can extract the hash using the pdf2hashcat.py util script:

./pdf2hashcat.py 0ld\ is\ g0ld.pdf > hash.txt

Now all that’s left is run hashcat with a (large) wordlist against the hash file and with a little bit of luck we get a hit:

The Thing about Mutable Default Arguments in Python

Wed, 10 Oct 2018 00:00:00 +0200

Yesterday I stumbled across some code like this…

def search_children(statespace, node, start_index=0, depth=0, results=[]):
 if depth < MAX_SEARCH_DEPTH:
 n_states = len(node.states)
 if n_states > start_index:
 for j in range(start_index, n_states):
 if node.states[j].get_current_instruction()['opcode'] == 'SSTORE':
 results.append(node.states[j].get_current_instruction()['address'])
 ...

The semantics of the code don’t really matter here. Still spot the bug? It’s a very common Python gotcha that even experienced developers overlook from time to time. Look at the function header. The result list. Maybe a small example playing around will help here:

In [9]: def append_to_list(value, l=[]):
 ...: l.append(value)
 ...: return l
 ...:

In [10]: append_to_list(42)
Out[10]: [42]

In [11]: append_to_list(1337)
Out[11]: [42, 1337]

Setting the default argument you would normally expect to have an empty list every time you enter the function. However, as StackOverflow user skyking points out, this is not the case. Default arguments in Python are evaluated once, when the function is declared.

Low-level Debugging of Stubborn Docker Containers

Sun, 16 Sep 2018 00:00:00 +0200

A few weeks back I have started contributing to the awesome Mythril project. Mythril is a security scanner for smart contracts that allows everyone to look for vulnerabilities on- and off-chain by being able to analyze raw smart contract code, as well as the actual Solidity code file. To make setting it up more easy, the devs provide a Docker container for easy deployment and use via docker run .

Looking for low-hanging fruits to start, I instinctively picked out an issue related to Docker, as there’s little new things about debugging containers. Issue 479 described Mythril crashing with a Unicode decode error — but it was only reproducible with the Docker container:

Parsing KMZ Track Data in Python

Fri, 14 Sep 2018 00:00:00 +0200

A few days back I stumbled across an interesting problem. I was asked to develop a solution that was doing some analysis work on geolocation data stored in KMZ format. Existing solutions like fastkml (64KB) and pykml (42KB) seemed nice at the first glance, proved to be unnecessary overhead, however. They’re mostly meant to manipulate and write data into KML format. I just needed to read the data for my later calculations. So I decided to build a solution using the Python Standard Library.

HackTheBox Sense

Thu, 01 Mar 2018 00:00:00 +0100

Sense was a HackTheBox machine that really tested my patience during the enumeration phase. It is a box designed around the popular pfSense firewall. Let’s dive in! Firstly, we start our usual standard nmap scan:

Starting Nmap 7.60 ( https://nmap.org ) at 2018-02-27 19:44 CET
Nmap scan report for 10.10.10.60
Host is up (0.034s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https

Nmap done: 1 IP address (1 host up) scanned in 7.09 seconds

Checking out port 80 with the browser automatically redirects us to HTTPS on port 443. We also have an information leak about the server technology in the responses, but that information does not lead us to a viable exploit.

HackTheBox Bashed

Tue, 27 Feb 2018 00:00:00 +0100

Bashed is a great entry-level box for people who are just getting started with HackTheBox. If you are just getting started with penetration testing, the value of this box is less in its technical content but rather in giving you the chance to exercise through your processes once. A bit like jumping into the water for the first time after doing dry-swimming. Let’s jump in!

First we run a basic nmap scan to see what ports are running on the server:

HackTheBox Nibbles

Mon, 26 Feb 2018 00:00:00 +0100

Nibbles was one of the first machines I broke on HTB. It is a relatively simple machine that requires a little bit of reconnaissance and leads you to a (hopefully) easy win by letting you poke around the website. Let’s dive in!First, we run a quick port scan: nmap -sS 10.10.10.75 -oX htb-nibbles.xml, which gives us the following result:

Starting Nmap 7.60 ( https://nmap.org ) at 2018-02-26 18:58 CET
Nmap scan report for 10.10.10.75
Host is up (0.056s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 0.80 seconds

Access on port 80 gives us the following view:

Quick Hack: Generating PDFs with Python and XeTeX

Wed, 10 Jan 2018 00:00:00 +0100

A friend of mine is following a PhD in a non-technical field. And his boss is a bully. Work mainly happens with high-level statistical analysis tools. No one knows anything about programming and most problems are solved by hand. While on a positive note this means good chances to get a student job, it also means that progress moves slowly, especially when it comes to working with large datasets.

Due to some kind of disorder related to social dominance, his boss regularly gives him harassing tasks. The ones that would take two students a month to complete - with a deadline set for the day after tomorrow. Obviously, this is impossible to complete if you don’t know how to automate the task. That’s where I come in - and boy was it satisfying to own his boss.

Converting MySQL Table Data to a Graphml File

Sat, 03 Jun 2017 00:00:00 +0200

I recently found myself in the situation where I was given access to a huge MySQL database that contained network traffic flows and IDS signature match data. As I work a lot with graph-based approaches, I needed to convert the table’s flow data into a graphml file for later visualization and analysis with scripts I have already written. Now without further ado here’s the code:

import pymysql.cursors
import pymysql
import networkx as nx
import sys


# Connect to the database
conn = pymysql.connect(
 host='localhost',
 user='root',
 password='my-secret-pw',
 db='flowdata',
 charset='utf8mb4',
 cursorclass=pymysql.cursors.SSCursor
)

graph = nx.DiGraph()

cursor = conn.cursor()
cursor.execute('SELECT src_ip, dst_ip FROM flows')
for i, row in enumerate(cursor):
 sys.stdout.write("\rReading line %s" % i)
 sys.stdout.flush()
 graph.add_edge(row[0], row[1])

nx.write_graphml(graph, "trente-flowgraph.graphml")

It’s obvious to see that I only need the data from the first two columns as they contain source and destination IP. The trick here is to use pymysql.cursors.SSCursor. This will prevent pymysql from loading the whole result set from the SELECT * ... query into RAM. Another catch is that pymysql apparently is not available for Python 3 yet. SQLAlchemy is a good workaround for bigger projects (such as my Pastebin Scraper) but in this case it’s complete overkill. Just run the script with python2.7 and you’re good.

N-wise Iteration in Python

Mon, 17 Apr 2017 00:00:00 +0200

A few hours back I stumbled into a problem where I had to perform a lookahead of n elements in a list to do some calculations. The first thought: Just take the current index and get all elements until i+n. I started writing..

for i in range(len(iterable)):
---- SNAP ----

Stop. This is awfully unpythonic. There has to be a better way! Browsing the itertools recipes I found the pairwise function:

def pairwise(iterable):
 "s -> (s0,s1), (s1,s2), (s2, s3), ..."
 a, b = tee(iterable)
 next(b, None)
 return zip(a, b)

Perfect! Now I just have to adjust it to work with n iterators where the first iterator is at i, the second at i+1, etc.

My New (old) Blog on Github Pages

Sat, 25 Mar 2017 00:00:00 +0100

After the exams, I had some free hours so I decided to show my blog some more love and look for a new theme. The old one, a customized version of Chunk was little more than a hack to have a theme at all. Here’s a quick reminder of how this site used to look:

I had a thorough look at Flex, Elegant, and many other popular themes but none of them struck me as really minimalist. So even though I’m more of a backend-dev I decided to dust off my questionable CSS skills and give it a shot. Turns out a lot has changed since I last developed websites. Animations without JS? Magic! The whole thing turned out pretty neat and I even published the code on Github. Feel free to leave feedback!In this post I’ll explain some of my ideas about Hebe, a “truly” minimalist Pelican blog theme.

Hebe Design Decisions

Sat, 25 Mar 2017 00:00:00 +0100

After the exams I had some free hours so I decided to show my blog some more love and look for a new theme. The old one, a customized version of Chunk was little more than a hack to have a theme at all. Here’s a quick reminder of how this site used to look:

I had a thorough look at Flex, Elegant and many other popular themes but none of them struck me as really minimalist. So even though I’m more of a backend-dev I decided to dust off my questionable CSS skills and give it a shot. Turns out a lot has changed since I last developed websites. Animations without JS? Magic! The whole thing turned out pretty neat and I even published the code on Github. Feel free to leave feedback!

PPP #13 Goodbye Trip: Campana & Punta Chame

Sun, 04 Sep 2016 00:00:00 +0200

As most of my stories in Panama this trip starts with some new friends. At my workplace, the Universidad Tecnológica de Panamá (UTP), I didn’t have much contact to students, because I spent most of my time on campus inside an office. The international office of the uni was very engaged however and regularly asked me to speak about my experiences and help respresent campus affairs. In this context I met some of the most amazing people!

PPP #12 Getting my Greens in Valle de Antón

Sat, 13 Aug 2016 00:00:00 +0200

Social Networks are awesome for travelling. By pure accident I met some fellow viajeros - two handsome women from Israel and Poland. After a quick chat and meetup we decided to spend our time in Valle de Antón - Anton Valley. From colleagues I already heard a lot about it’s natural beauty.

Valle de Antón Mountainside

What has been recommended to all of us was La Cascada El Macho: It’s the highest waterfall in the whole valley, measuring 70m in altitude. So on the first day we had a quick look at the map and went straight for it. The air was much cleaner than in Panama City. Breathing and walking were easier, the heat wasn’t as bad. We passed beautiful paths with great views..

PPP #11 Strolling through the Park

Sat, 06 Aug 2016 00:00:00 +0200

Metropolitano Entrance Sign

Since 1988 there is a park just on the outskirts of Panama City - El Parque Natural Metropolitano. It’s the only wildlife refuge in the city and is host to an amazing variety of wildlife. There are no special attractions there. It’s a place you just go to in a casual manner to relax and forget your everyday duties for some hours. It’s fairly big and you can also easily spend a day there - as I did with some friends from the university.

PPP #10 Gamboa: Welcome to the Jungle

Sat, 09 Jul 2016 00:00:00 +0200

My sister and a colleague of her decided to visit me in Panamà. Still being busy with the investigation, I did not manage to find a lot of time for travels during the week. However on the weekends, we managed to make some small trips. One of them lead us into the jungle near the village of Gamboa.

Gamboa once was one of several canal zone townships built to house employees working at the Panama Canal and their families. Later (due to a shortage in housing in the US military base) there were also soldiers living there. The architecture of Gamboa has been preserved with lots of love and nowadays you can find hotels there. The rise of tourism has not damaged the rural flair the least.

Install Intel Graphics Drivers for Fedora 23

Wed, 29 Jun 2016 00:00:00 +0200

This is a thing I always forget and have to look up. My Dell XPS 13 (2013) runs on an Intel HD4000 and the drivers are obviously not in the standard repos. This script pulls the (at the time of this writing) most recent driver from the repos of the Intel Open Source Technology Centre.

cd /tmp
wget --no-check-certificate https://download.01.org/gfx/RPM-GPG-KEY-ilg-2
sudo rpm --import RPM-GPG-KEY-ilg-2

# x86_64
wget https://download.01.org/gfx/fedora/23/x86_64/intel-linux-graphics-installer-1.4.0-23.intel20161.x86_64.rpm

sudo dnf install intel-linux-graphics-installer-1.4.0-23.intel20161.x86_64.rpm
sudo dnf upgrade

sudo intel-linux-graphics-installer

The installer takes a while to do its work. Just ignore all notifications of GNOME that the program is not responding. In the shell where you did the last call you can see the true progress. After the installation/ update progress a system reboot is required.

Visualizing IP Connections in Python

Mon, 27 Jun 2016 00:00:00 +0200

For some research on botnet host detection in large-scale networks, I found myself in the situation that I had to apply a set of algorithms to a huge packet dump. To comprehend an amazing paper, I started to play around with the dataset and tried to reproduce the results presented in the whitepaper. Quickly I realized that there was something fishy with my own dataset, so I fired up jupyter-notebook to gain some more insight in the IP structure of my dataset.

PPP #09 A Trip to Paradise - Bocas del Toro

Sun, 19 Jun 2016 00:00:00 +0200

In the travel magazines you always see the same ad pictures. Cristal clear water gently stroking the white-sand beach bordered by palm trees. Deep cyan colours meet intense whites and greens. Amidst this paradisal scenery happily sits a woman drinking from a coconut, enjoying the sun. HARD CUT - company name appears. Guess what - I have been there. Not in the ad spot, in that kind of paradise. Just without the woman. You can’t have everything, right?

PPP #08 Conquering Volcán Barú

Mon, 13 Jun 2016 00:00:00 +0200

This was an extraordinary hiking trip full of firsts. I have never ever before been hiking

in Panama
in tropical weather
on an active volcano
on a mountain higher than 2,500m

It all begins at the Albrook bus station in Panamá City. In the night from Friday to Saturday at midnight we take the bus to David, Chiriquí. The bus system in Panamá seems reliable and this particular bus was comfortable. For some reason we ended up in the VIP section without really paying any more. We took the opportunity and enjoyed! The ride lasted about six hours and the next morning we safely arrived in David. We took a small break and it didn’t take long until we found ourselves sitting in the next bus towards Boquete, a small city close to the volcano.

PPP #07 Isla Grande

Sun, 05 Jun 2016 00:00:00 +0200

A sunny day, 30°C and air humidity so high that breathing feels like waterboarding. Perfect conditions to go to the beach! Just some hours by car in the province of Colón north of Panamá City, you can find Isla Grande. This island is your typical small Caribbean island with clear waters and palm trees. From Muelle de La Guaira the crossing by boat just takes some minutes with the speedboat and costs less than $2.

ERROR 2999: Invalid preprocessor command specified

Fri, 03 Jun 2016 00:00:00 +0200

I am quite new to working with Amazon Elastic MapReduce clusters. To do some large scale data analysis, I built a Pig script and ran it on a local pig installation to verify its functionality. Works. Neat! Let’s push it to the cluster and get some serious results on the large dataset!

Luckily for my bill, it didn’t take too long to fail.

[hadoop@ip-XXX-XXX-XXX-XXX samples]$ pig -x mapreduce -f pig/examples/snort.pig -param pcap=data/sample204.pcap
16/06/03 14:05:13 INFO pig.ExecTypeProvider: Trying ExecType : LOCAL
16/06/03 14:05:13 INFO pig.ExecTypeProvider: Trying ExecType : MAPREDUCE
16/06/03 14:05:13 INFO pig.ExecTypeProvider: Picked MAPREDUCE as the ExecType
94 [main] INFO org.apache.pig.Main - Apache Pig version 0.14.0-amzn-0 (r: unknown) compiled Apr 06 2016, 22:40:48
16/06/03 14:05:13 INFO pig.Main: Apache Pig version 0.14.0-amzn-0 (r: unknown) compiled Apr 06 2016, 22:40:48
98 [main] INFO org.apache.pig.Main - Logging error messages to: /mnt/var/log/pig/pig_1464962713368.log
16/06/03 14:05:13 INFO pig.Main: Logging error messages to: /mnt/var/log/pig/pig_1464962713368.log
2542 [main] INFO org.apache.pig.Main - Final script path: /home/hadoop/packetpig/pig/examples/snort.pig
16/06/03 14:05:15 INFO pig.Main: Final script path: /home/hadoop/packetpig/pig/examples/snort.pig
2563 [main] INFO org.apache.pig.impl.util.Utils - Default bootup file /home/hadoop/.pigbootup not found
16/06/03 14:05:15 INFO util.Utils: Default bootup file /home/hadoop/.pigbootup not found
2698 [main] ERROR org.apache.pig.Main - ERROR 2999: Unexpected internal error. Pig Internal Error. Invalid preprocessor command specified : %DEFAULT
16/06/03 14:05:15 ERROR pig.Main: ERROR 2999: Unexpected internal error. Pig Internal Error. Invalid preprocessor command specified : %DEFAULT
Details at logfile: /mnt/var/log/pig/pig_1464962713368.log
2740 [main] INFO org.apache.pig.Main - Pig script completed in 2 seconds and 915 milliseconds (2915 ms)
16/06/03 14:05:16 INFO pig.Main: Pig script completed in 2 seconds and 915 milliseconds (2915 ms)

Wait, what? How can this fail? Setting %DEFAULT values for script parameters is a pretty standard thing! Well, turns out, all Amazon EMR components are running on Pig 0.14.0. A pig version released in November 2014. The latest version (0.15.0) was released in June 2015! Isn’t that enough time to at least provide a newer version to non-legacy customers?

PPP #06 The City of Knowledge

Thu, 19 May 2016 00:00:00 +0200

Located about 20 minutes away from the Technological University of Panama - assuming you don’t run into a traffic jam - lies the Ciudad del Saber, the City of Knowledge. When Panama was occupied by the United States, this base directly in front of the Miraflores locks was called Fort Clayton and the US Army headquarters here in Panama City. After the US departure the government founded a non-profit organization with the mission to turn the vacated facilities at Clayton into a center for knowledge exchange. Amidst the green beauty you can see the buildings showing logos of the Red Cross, the United Nations, the World Food Program, Plan International and plenty more.

PPP #05 Taboga - The Island of Flowers

Sun, 15 May 2016 00:00:00 +0200

During a fair on stipends and opportunities to go abroad at the UTP I met some other interns and students of the uni! Amazing people from Portugal, Mexico, Honduras and Poland. We had a coffee together and got to know each other. They are very down to earth and easy-going people. Before we each left for office and studies again, some people invited me to join them on a trip to Taboga. “Of course! That would be awesome!” was the instinctive answer, because after all I’m not here to spend the weekends with work. “Uhh, and what is Taboga exactly?” was the follow-up question. Now I can answer it! It’s a beautiful volcanic island located in the Gulf of Panama. Ferries towards Taboga leave daily from the Amador Causeway and roughly take 40 minutes to reach land again. On the way there we had an amazing view on the giant container ships waiting for passage through the Panama Canal.

PPP #04 Turning the Tides

Mon, 02 May 2016 00:00:00 +0200

A Monday. Got up early. Bought a Spartan breakfast (water and bread). Off we go to the uni! Work! Get shit done! Meet people! “Hoy está cerrado!”. I stand before closed doors, next to me a wildly gesticulating and almost shouting security guard crossing his hands. Yeah, right. Today was a red-letter day! Ah, my forgetfulness followed me all the way to Panama! At least I got up early. So I took the chance to explore the neighbourhood a little as long as the sun was shining.

PPP #03 New Lands

Sun, 01 May 2016 00:00:00 +0200

So today I moved out of Brigitte’s house into the new apartment. Before coming here I had the choice between a single apartment with my own fridge and bathroom or a flat-share with ten other people with a shared bathroom and a community kitchen. I decided for the latter, because I hoped to make some new friends, improve my Spanish and spend some good times with my flatmates. Now that I’m here I have to say that the people seem to be pretty reserved. All doors are closed and no one is in the hallway or kitchen.

PPP #02 A Helping Hand

Sat, 30 Apr 2016 00:00:00 +0200

Brigitte, my mentor, is an amazing person. She does not only give me a place to sleep. She also hooked me up with a SIM card so I have mobile internet connection. That way I can now navigate around the city and cry for help on WhatsApp should I ever get lost. In order for me to get from A to B she also helped me to get a card for public transport. You can charge it with money and insert it when entering the means of your choice so the cost gets withdrawn. $0.25 each ride, no matter how far you go. I wonder whether there’s one of these crackable RFID chips in this card. Of course I will not look further into this matter without permission. :)

PPP #01 Come Fly With Me

Thu, 28 Apr 2016 00:00:00 +0200

This little series is about my “travel” to Panamá. I applied at IAESTE for an internship in the IT security department of the UTP (Universidad Tecnológica de Panamá). Here, in my Personal Panama Papers I’ll write down some of my experiences, problems and solutions while I find my way into Panamanian society and hopefully some interesting security-related research.

When I left Dresden yesterday, I threw my last keys to the flat into the mailbox outside. I still find it a little weird that at that moment I did not feel anything special. With my backpack and suitcase I stood in front of the doors and separated from my last possessions in this city - at least for the coming five months - and it felt like the most normal thing in the world. In Berlin I met up with a very good friend of mine, Alex. We spent a good late evening together having some dinner and talking about old and new times. What makes good friends stand out is not being together all the time. It’s the immediate intimacy when they meet again. Good friends often lose contact - but they always come find back to each other. And Alex is a very good friend. After some trouble with my accommodation he spontaneously agreed to give me shelter for a night and hence saved me plenty of money (and some sleep).

Saxon Switzerland in Autumn

Sun, 01 Nov 2015 00:00:00 +0100

When you have the chance to study in Dresden, it’s a must for every outdoor person to go hiking in the Saxon Switzerland. It’s only ~30 minutes away from Dresden and you can get there for free with your semester ticket if you’re enrolled at the local uni, Technische Universität Dresden. Whether spring, summer, autumn or winter; there are always amazing views in a landscape that seems to completely change after every corner.

The "Pythonic" GOTO

Mon, 15 Jun 2015 00:00:00 +0200

Nope, I’m not going to join the goto war. Even though it’s shunned among developers, there are still some situations where it makes sense. A good friend of mine with a background in C recently came to me with a very simple problem that still made him scratch his head when he tried to express it in Python. The problem broke down to comparing three lists to find an element that meets a special criterion. His basic naive concept looked something like this in pseudo-code:

Performing Well at CodeFEST8

Fri, 22 May 2015 00:00:00 +0200

When we decided to enter the hackathon, some fellow students and I were in it for the fun. We had worked together before in a mandatory software project and wanted to revive the productive atmosphere of the good old times. Neither did we expect to win in Dresden nor did we have in mind that there was a realistic chance of winning at the CeBIT 2015 against teams from Germany, Austria and Switzerland.

VPN with openconnect in Ubuntu 14.10

Tue, 12 May 2015 00:00:00 +0200

Many services that my university offers have one requirement: to be in a trusted network. That is either eduroam or any network where you can connect through a VPN tunnel. As sad as it is, I don’t have an eduroam router next to my home. However, I ran into some minor problems when trying to create a VPN connection with network-manager.

The Good

After installing the necessary dependencies network-manager-openconnect and network-manager-openconnect-gnome there was a rather visual problem: When trying to create a VPN connection, network-manager would just present me with the option to Import from File…. Not a glimpse of my beloved Cisco AnyConnect Compatible VPN (openconnect) option. So what do?

Some thoughts on the CodeFEST8 in Dresden

Tue, 12 May 2015 00:00:00 +0200

CodeFEST8 Logo

What is it?

The CodeFEST is a hackathon held by Volkswagen. Basically, you’re joining a team and with the help of some mentors you tickle your brain for 26 hours of pure work until a great, innovative idea comes out. After reaching the deadline, you give a short five minute presentation about the problem, your solution, some technical details and marketing aspects. Bonus points for a live demo. This year’s motto was “Mobilität der Zukunft” - mobility of the future.

Code Verification with Git Hooks and Flake8

Sat, 02 May 2015 00:00:00 +0200

We all have that special someone in our life. Someone who dares to commit and push something like this into the master-branch:

import math, os, sys

def test_function(one, two,
 three, four, five):
 from test.utils import *
 print x; print y
 if two==three and (four!=five or one!=three) and (sqrt(four)==two or sqrt(two)==one):
 return math.ldexp( one, two )
 else:
 return None

This code would be accepted by the Python interpreter without hesitation and it will “work”. However, there are many direct conflicts with the PEP8 guidelines. But not only that! Correcting the code with the pep8 tool won’t make it completely nice and clean. For example, PEP8 doesn’t care for unused imports, variables or too complex functions. That’s what you then use so-called linters for. They analyze your code and look for parts that could potentially or will cause errors.