If you just want to know how to use the script, skip to the example usage section below. Background The OpenSSH client uses a file called known_hosts to track the fingerprint for previously used ssh servers. This can help the SSH client detect when a man in the middle attack is taking place. If an attacker was to try this attack, the user’s client would show a serious warning and refuse to connect. Read more ...

What is CT? Certificate Transparency (CT) is an experimental IETF standard. The goal of CT is to allow the public to audit which certificates were created by Certificate Authorities (CA). TLS has a weakness that comes from the large list of CAs that your browser implicitly trusts. If any of those CAs were to maliciously create a new certificate for a domain, your browser would trust it. CT adds benefits to TLS certificate trust: Companies can monitor who is creating certificates for the domains they own. Read more ...

(Jenkins logo: https://jenkins.io/ License: CC BY-SA 3.0) Background Jenkins is a popular open source continuous integration (CI) project that is used by many organizations. I’ve commonly seen Jenkins used to do the following: clone a repository from GitHub, compile it, test the code, and then push the successfully compiled and tested code off to production. Junkins was created to help automate my collecting of credentials that are saved in Jenkins servers. Read more ...

A quick Arduino program that helps collect YubiKey OTP tokens. Parts This code will probably work on any Arduino. I used the Arduino UNO as I had one laying around. I also bought the smallest capacitor I could find at Frys: .1μF 35v. The human body is rated at 100pF capacitance, so I figured something close would help emulate when you touch the token. Why? I couldn’t find any examples that did this with an Arduino, so I decided to throw one together really quick. Read more ...

Background The Asia Pacific Network Information Centre (APNIC) is a regional internet registry. APNIC is responsible for distributing IP addresses and Autonomous System Numbers (ASN) in the Asia Pacific region, including China, Japan, Australia, Southeast Asia, India, and other nearby countries. APNIC is comparable to ARIN who is responsible for the North American region. These organizations maintain the WHOIS databases for IP addresses and ASNs in their respecitve regions. Read more ...