meetings

There is a recent wave of interest in API security within the broader security community, and APIs continue to be a promising source of security findings due to their ubiquity as the glue that connects disparate systems. With the goal of spending the latter half of the night on hands-on exercises, we will start with an introductory talk that will survey the resources that are available for learning API security, and discuss tips for what to look for when practicing with API-focused testing exercises. After the intro talk, let’s work through any questions regarding the exercises. If you would like to participate in the exercise half of the night, it is recommended in the interest of time to prepare before the meetup the tool/lab setup instructions under the “Lab Setup” chapter of API Sec University: https://www.apisecuniversity.com/courses/api-penetration-testing

Red Teaming for a [redacted] college cybersecurity competition is a great opportunity to work on persistence techniques and develop some useful custom tools. We’ll go over the unique environment of this competition, how that applies to real world scenarios, and also share some tricks that can be played when you have permission to burn the environment to the ground.

We will cover the high-level concept of a fuzzer, then dig into the paper written by the authors of LibAFL, and then explore some code.

From the GitHub page: “LibAFL is a collection of reusable pieces of fuzzers, written in Rust. It is fast, multi-platform, no_std compatible, and scales over cores and machines.”

If you want to learn and explore in advance, here are the main resources:

GitHub is here: https://github.com/AFLplusplus/LibAFL

Academic paper is here: https://www.s3.eurecom.fr/docs/ccs22_fioraldi.pdf

Bring the invisible world of Bluetooth communications to light using the newly released ‘Bluetooth Demystifier’, from Lost Rabbit Labs https://gitlab.com/lost-rabbit-labs. This freely available, open-source software package allows you to examine and explore the Bluetooth/BLE landscape around you. The Lost Rabbit Labs team will demonstrate how to use ‘Bluetooth Demystifier’, provide the software for all to use, and manage a small CTF around detecting a rogue signal (potential malicious BT device).

Attendees do not have to bring anything as we will be mostly demoing our soon-to-be-released open-source software (projected release between April 18th - April 21st) against the Bluetooth devices we are bringing.

However, if attendees do want to participate, there are three options:

Linux OS laptops that support the BlueZ stack (Not ported to Windows yet nor will it run inside a Linux VM)
A laptop + a Raspberry Pi to configure (the Pi will be running the Bluetooth Demystifier software)
Any device with a web browser to view the front-end application from the LAN (Not entirely sure how many attendees can view this data at once due to Pi's resources)

Attendees can install it before hand (via Linux laptop or on a raspberry pi), with our help at the meetup, or can choose to access the front-end side via a device with a web browser during the event.

Let’s discuss the recent remote execution vulnerability in Log4J. To catch us all up to the same base understanding, we will start off with a presentation explaining the root cause and impact of the vulnerability, as well as work through an exercise that demonstrates this vulnerability. Other topics we can discuss include what resources and tooling we’ve found, remediations we’ve seen that either work or don’t work, and how this event affected our day jobs.