The Coalfire Labs Blog

Welcome to the Coalfire Labs Blog, a resource covering the most important issues in IT security and compliance.  The Coalfire Labs blog is written by the company's leadership team and our highly-credentialed security assessment experts.


  • High-Power Hash Cracking with NPK

    March, 2019, Brad Woodward, Director, Coalfire Labs

    Password hashes are an everyday part of life in Coalfire Labs. Barring any other low-hanging fruit, it’s not uncommon for a penetration test to hinge on recovering a plaintext password from one of these hashes. Whether it’s NTLM hashes from Active Directory, NetNTLMv2 from Responder, WPA2 PMK from a wireless penetration test, or hundreds of other possible sources of hashes, recovering the original password has been a challenge for hackers for decades.

  • Enabling Clients to Cope with ASV Scans

    February, 2019, Marco Brown, Associate, CoalfireOne Scanning Services

    Gathering evidence, applying patches, and configuring your systems in preparation for submitting your vulnerability disputes can be a nerve-wracking and daunting task. To better enhance your understanding of the Approved Scanning Vendor (ASV) process, I’ve outlined some coping mechanisms and tools to use.

  • Compensating Controls: When Patching Isn’t an Option

    February, 2019, Steve Durham, Consultant, CoalfireOne Scanning Services

    Your software vendor is asleep at the wheel and your devs still need that legacy daemon.

  • The HOW, WHY, and HUH? Blog on Disputes

    January, 2019, Travis Finn, Consultant, CoalfireOne Scanning Services

    As you may know, performing vulnerability scans is a requirement for PCI DSS compliance. One of those specific requirements, described in section 11.2.2, states that quarterly external scanning must be done by a qualified Approved Scanning Vendor. Coalfire just so happens to be an ASV, so if you need these scans we would happily oblige!

  • Epic Holiday Cookie Baking

    December, 2018, Jim Allee, Senior Consultant, Coalfire

    One aspect of being a penetration tester that is always rewarding is the process of rabbit-holing into an area of interest and letting the data guide me to my destination. Recently, while updating and testing new code on a custom cookie fuzzing tool (Anomalous Cookie – https://github.com/Coalfire-Research/AnomalousCookie.git/), I discovered a XSS (cross-site scripting) vulnerability on EpicGames.com. While it appeared possible to write a good payload (stealing cookies and injecting malicious JavaScript/BeEF hooking), I had no good way to deliver it. Traditional cookie-stuffing (https://en.wikipedia.org/wiki/Cookie_stuffing) might work to drop the rogue cookie onto a target’s machine; but could there be other ways? If not, this would most certainly be classified as 'Self-XSS.'

  • Displaying results 16-20 (of 89)
     |<  <  1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 10  >  >| 
Top