The Curious Engineer

All blogs / Security

Thoughts on Security

scriptjunkie.us

Something about Network Security. Exploits, research … profit!

Security

’10’15’20’25
Posts
100 from 5 Mar 2010 to 14 Sep 2026
Posting
now and then (2 in the last year)
Kind
personal blog
Feed
https://scriptjunkie.us/feed/atom/

2026 2

  1. RSI vs The Real World
  2. Tracking Signal Identifiers

2021 3

  1. schadnfreude
  2. Covert credit calculation communications
  3. Moving Off Google

2020 3

  1. rustun – Virtual Not Private Network in 100 Rust lines
  2. Stream Securely: Simply and Privately Preserving Live Video Evidence
  3. Dispelling Decentralization Doubts

2019 2

  1. Should there be restrictions on the release of hacking tools?
  2. Interface Identifier (IID) list

2018 2

  1. Windows 10 Decontamination Scripts
  2. Signed Malware

2017 5

  1. Hack-back in the Real World
  2. Hoarder
  3. Supply Chainsaw: Practical software supply chain attacks for everyone
  4. Goals
  5. Climate Change Archive

2016 7

  1. Just Too Much Administration – Breaking JEA, PowerShell’s New Security Barrier
  2. Intercepting Passwords to Escalate Privileges on OS X
  3. The Security Pretend Game – Sudo and Runas
  4. Defying Analysis With Sparse Malware
  5. Using a Fully Untrusted Cloud
  6. Yeoman Angular Bootstrap
  7. Human Adversaries – Why Information Security Is Unlike Engineering

2015 7

  1. Why the government shouldn’t pay for your college (or most other things)
  2. How I used dead drop C2 to hide malicious traffic
  3. Stop doing input validation
  4. On Suicide and Ashley Madison
  5. On Wassenaar
  6. Credential Assessment – Mapping Privilege Escalation at Scale
  7. How to run a secret drug empire and hide your incriminating evidence*

2014 9

  1. Replacing Passwords With EasyAuth
  2. Exploiting Ammyy Admin – developing an 0day
  3. Easy Smart Card SSH Setup
  4. More Spiders, Fewer Trees: Meterpreter Hop
  5. 4 practical rules to not get your program hacked
  6. Red Teaming the CCDC
  7. CCDC and CTFs – Addressing the Criticisms
  8. March – Pass the Hash Awareness Month
  9. Installing Linux on a Live Windows System

2013 14

  1. A Comparison of HTTPS Reforms
  2. Adding Easy SSL Client Authentication To Any Webapp
  3. Catching dropped executable files without a sandbox
  4. The Infosec Revival – DerbyCon 2013
  5. Remote Desktop and Die – How to RDP Faster Without Getting Robbed
  6. Secure random password generation
  7. Ambush Standalone
  8. Fixing Pass The Hash and 14 Other Problems
  9. Breaking and Building a Secure Network – BSides San Antonio
  10. Using the GUI in Metasploit 4.6
  11. Saving shells with PrependMigrate
  12. Economics in One Lesson
  13. Authenticated Remote Code Execution Methods in Windows
  14. Running Code From A Non-Elevated Account At Any Time

2012 9

  1. Attack Test
  2. Hoarder, HIPS bypasses, and Ambush
  3. Vulnerable systems setup
  4. Shellcode sizes in Metasploit
  5. Ambush – A New Capability for Advanced Defense
  6. Malicious VM to Host Attacks
  7. The Hacker Games
  8. Direct shellcode execution in MS Office macros
  9. Windows API Function Definitions

2011 18

  1. Network Nightmare (Intel)
  2. Fragerizer – profile-guided load-order disk optimizer
  3. Original Source Forgery
  4. Writing Meterpreter Extensions
  5. Custom payloads in Metasploit 4
  6. Network Nightmare – PXE talk at Defcon
  7. Bypassing DEP/ASLR in browser exploits with McAfee and Symantec
  8. Firefox Exploit Analyzed
  9. System Kill
  10. Why Encoding Does not Matter and How Metasploit Generates EXE’s
  11. Shells, terminals, and sudo mitm
  12. Important Stuff
  13. Java_signed_applet with RJB
  14. Finding non-ASLR or DEP modules
  15. Breaking mobile device crypto with chaos theory and hardware RNG’s
  16. Cryptology, Academics, and Chaos
  17. Black Hat DC Presentation
  18. Expanding Metasploit RPC and GUI

2010 19

  1. Black Hat & Shmoocon
  2. Fun with lnk files
  3. Command stagers in Windows
  4. Team metasploit and msfgui on Windows
  5. Sessionthief linux
  6. Insecure service permission privilege escalation
  7. Screwing with Nmap
  8. PXE exploitation
  9. Sessionthief
  10. msfgui – now in metasploit
  11. New msfgui
  12. Facebook social engineering XSS
  13. Maple exploit
  14. XSS, no really
  15. EXE injection plus
  16. Metasploit EXE code injection
  17. Security advice
  18. Google Update
  19. Shellcode API hashes