Here is this year’s write-up for my cloud challenges from BsidesSF CTF 2021. This year I wrote two cloud challenges — Whole New Me and Shout into the Void. As always, I tried to make them fun and applicable in the real world. With that let’s dive into the challenge…

Following the tradition of the past few years, here is this year’s writeup for my challenges. Unlike previous years where I (almost) exclusively wrote mobile challenges, this year I tried my hand at writing web challenges. Web challenges proved to be a lot easier to write than mobile because I…

Disclaimer: I am not an expert on mentoring, this originally started as a philosophical rant that ended with a caffeine fueled research binge. It is a topic I feel passionately about and wanted to share my views on it. This does not in any way reflect the views of my…

Weather Companion — 350 points, 11 solves — Mobile, Reversing “A simple weather application that fetches and displays the weather. What hides within?” After loading and running the application on Android Studio, you will see that it displays the weather. The applications makes one request to pull down a json file — https://storage.googleapis.com/weather-companion/weather.json?GoogleAccessId=weather-companion-service-acco@bsides-sf-ctf-2019.iam.gserviceaccount.com&Expires=1554057388&Signature=Zwv1...snip…

I was part of the Bsides San Francisco CTF crew for the third year in the row, this year I contributed four challenges and helped out with slack / scoreboard support. The other organizers include - @matir the lead who kept everything going @iagox86 the second in command who kept…

Web applications are central to our day-to-day activities — this includes banking, shopping, email, and social media. Given that the web has become a central fixture in our lives, understanding the fundamentals of web application security is more crucial than ever. Books like the The Tangled Web, Web Application Hacker’s…

Find an area that interests you the most and focus on it. When you are starting out in security it is best to specialize, this is good for both — employment opportunities and personal growth. Be prepared to work hard, security isn’t easy. The more you dig into a topic…

I constantly find myself questioning if I belong in my line of work. Working with incredibly talented security engineers is a great way to constantly learn new things, but in my case it also doubles as a constant reminder that I don’t perform as well as the rest of my…

(Originally published on Mar 1st, 2017) A couple of weeks ago I had a blast organizing the BSides SF CTF alongside — @bmenrigh, @CornflakeSavage, @iagox86 and @matir. The CTF had challenges that were primarily in the easy to intermediate range, with a few curve balls thrown in for the seasoned…