Another one down! OSED is a penetration testing certification with an emphasis on exploit development. It is in the 300 level series of Offensive Security certifications and one of the three certs required to earn the OSCE3 qualification. EXP-301: Windows Exploit Development Course | OffSecLearn to bypass common security mitigations with exploits created from scratch. Earn your OffSec Exploit Developer (OSED) certification.Off·SecOffSec Team Since my background is in reverse engineering firmware and IoT, this certification is closest to my heart. Because I was dealing with assembly frequently, I really liked the precision that it required. You have to know exactly how many bytes to jump in order to make the exploit work, the exact size of your padding to trigger an overflow, or the values required to navigate through various header checks… I thought that was really fun! ...

I attended the Corelan Heap Exploit Development Masterclass organised by SINCON/Div0 in Singapore in March 2024. Corelan is a well-known name in the exploit development space. If you’ve ever done any sort of exploit development, it is inevitable that you would have come across mona.py, an indispensable tool for exploit development, released and maintained by Corelan. Corelan has also published many in-depth articles about exploit development over the years. While I have a bit of experience stack-based exploit development, I was entirely unfamiliar with heap exploitation. So it was with a little trepidation that I signed up for the course because I was worried that the training would be so deeply technical that I would have a hard time catching up. ...

I use a variety of languages on my computer, but most recently, I’ve wanted to use the Russian keyboard. On Windows, you can cycle between the languages using Alt + Shift, but I wanted to toggle quickly between two languages, specifically English and Russian, preferably with a single keypress. This calls for AutoHotKey! I settled on using the Right Alt key for this because I never use this key. I happily coded a simple script to toggle between two languages, and… it didn’t work. It only ever toggled to Russian, and never toggled back. ...

Tldr; I passed! The OSEP is the follow up to the taste of offensive security that is OSCP. It builds on the offensive security skills learned and extends them to a Windows-heavy environment where you’ll be tasked with not only standard enumeration and exploitation, but also evading active AV protections. My journey on the OSEP started in 2022 when I signed up for Offsec’s Learn One deal during their annual Christmas sale and I started in Feburary 2023. Due to the density and breadth of the course, I thought it would be quite challenging to complete it within 90 day option which was why I decided to take the year to learn all the material in the course. I was not wrong. ...

After modding my headphones, I realized that the touch capacitance was not as sensitive as I required it to be. Because of the tight timing requirements to detect if a touch is present, small changes in the environment can result in large changes in the detected delay. It was hard to debug because Padauk does not have any debugging hardware on the IC itself, relying instead on emulation for programming and debugging. However, emulation means that it is unable to replicate the timing and chip performance perfectly, which adds another layer of delay and uncertainty when programming the threshold for detecting touch. ...

I have come a full circle back to IoT products and security testing. Since my original skills were in IoT engineering, I wondered what kind of security bugs could be found in devices. Security testing for IoT devices differs from normal web or cloud security testing because there is a big emphasis binary blobs. Even getting your hands on the firmware is also not guaranteed. More often than not, devices receive their last update before they exit the factory. ...

Having some experience last year, the going was easier this year as I knew that I was looking for and how the flag might be encrypted. The following are my solutions for the hardware category of the competition. Timed Transmission Downloading and running Logic Two from Saelae reveals the flag if the signal capture is rearranged from bottom to the top and you zoom out. It is certainly not a usual method of analysis but an interesting CTF variation nevertheless. One hint is that the signal is not varying in frequency and analysis with the serial decoder results in gibberish, so it is unlikely that any messages can be stored in the signal itself. ...

I own a second-hand OnePlus One and it is one of my favorite devices for Android development: ample RAM, a beautiful screen, light, and easy to grip. I use it as a testbed for Android and recently I had to flash Magisk on it. The phone worked well until it was time to run fastboot flash boot magisk... It reported <waiting for any device> and I realised that it wasn’t being detected correctly when in fastboot mode because fastboot device would not return any connected devices. adb worked, so it wasn’t an issue with my hardware. The solution is to point Windows 10/11 to the right driver and not: ...

How I upgraded my headphones to be fully wireless with a $2 board How it began While browsing AliExpress, I came across this rather impressive little board: A BLE audio board is not crazy by itself; there are a ton of Bluetooth speakers out there. The impressive thing about it is that it is $2. Wireless is hard. Audio is hard. Therefore wireless audio shouldn’t be cheap and sit on a tiny 30mm x 30mm board, but here we are. ...

The hardware challenge for the Cyber Apocalypse was pretty creative! I enjoyed solving the challenges and it had a wide variety of hardware related skills that tested my understanding of what I was seeing in front of me. There were four challenges in total for the hardware category and it was fun to solve them all eventually! Space Pulses In the description, there is this phrase: …our instruments are sensitive enough ...