/ Recent content on init6 Hugo -- gohugo.io en-us Thu, 12 Jul 2018 13:59:56 +0000 /zoho-story-of-where-not-to-store-keys/ Thu, 12 Jul 2018 13:59:56 +0000 /zoho-story-of-where-not-to-store-keys/ The second 0DayAllDay event was June 9th, 2018 from 10am to 9pm. It was organized by Spectant Security and Blackmarble.sh. More information on 0DayAllDay can be found here Last 0DayAllDay event was focused around Password Managers, Thycotic, Keeper, ZOHO Vault were a some of the targets. Only bug that was found was for ZOHO Vault. ZOHO Vault is an online password manager focused on businesses. Included in their software is a AD/LDAP provisioning application. /android-hacking-environment/ Sun, 27 May 2018 23:25:52 +0000 /android-hacking-environment/ For the 0DayAllDay event a friend and I are hosting June 9th 2018. I needed to setup a handful of Android virtual machines. Since we will be hacking on Password Managers and their associated Android apps. I didn’t want people wasting their time setting up Android to work with Burp Suite. Especially since it can be difficult with information so spread out. I thought it would be good to centralize the information I needed to get a working Android Hacking Environment setup. /manageengine-password-pro/ Fri, 01 Dec 2017 00:39:30 +0000 /manageengine-password-pro/ Weak Master Encryption Key Generation. This is a public disclosure, WHAT? It’s okay, I feel like public disclosure in this scenario is okay for a couple reasons. One, even though the flaw is serious it still leaves the customers with enough protection against most people. Two, all of ManageEngine products seems to have a few vulnerabilities due to lack of effort. Why should I go through the extra effort getting them to fix code that shouldn’t be broken in the first place. /samuel-l-jackson-tank-upgrade-2/ Tue, 31 Oct 2017 21:29:56 +0000 /samuel-l-jackson-tank-upgrade-2/ Made great progress upgrading my tank. Some more work still needs to be done. however, I needed to get it laid out the best I could so I can see what other improvements are needed. Using 2.2mm acrylic that I bought from home depot; I made top pieces, basking area for Sammy, divider to separate Sammy and the fish, and a gravel retaining wall. Using the laser cutter from TheLab.ms (local Plano, TX makerspace) I was able to cut everything out. /hosting-your-own-videos-on-ghost/ Mon, 02 Oct 2017 15:53:02 +0000 /hosting-your-own-videos-on-ghost/ Ghost blog framework works well for hosting videos on YouTube.com and Vimeo.com. However, if you are like me and prefer to host your own videos follow the steps below. It’s actually pretty easy. Edit your Nginx configuration. sudo vi /etc/nginx/sites-enabled/site.conf Add the following to your server configuration. location ~ /videos { root /var/www/ghost; } The whole file should look simliar to this. server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name init6. /unlock-vps-full-disk-encryption/ Sat, 30 Sep 2017 19:06:41 +0000 /unlock-vps-full-disk-encryption/ Having Full Disk Encryption for your VPS or remote server is nice, however if you don’t have local terminal or out-of-band access via IPMI/iLO the only way to unlock the root partation is to use SSH on boot. The steps outlined here will show how to configure your server to unlock your encrypted drives remotely. Steps here are for Ubuntu 16.04 and were collected from several stack exchange answers and MAN pages. /old-fashioned-pecan-pie/ Sat, 30 Sep 2017 18:18:21 +0000 /old-fashioned-pecan-pie/ Ingredients 1 Pie Crust 1/2 cup unsalted butter 3 tbsp flour 2 1/8 brown sugar 1/2 tsp salt 1/4 tsp cinnamon powder 6 tbsps milk 3 large eggs 2 tsps vinegar 2 tsps vanilla extract 1 1/2 cups pecans Instructions Preheat oven to 375F. Melt butter and let it cool down so its not too hot. In a bowl, mix flour, sugar, and salt. Mix in milk, and eggs. Mix in vinegar, vanilla, butter, and nuts. /herb-roasted-turkey/ Sat, 30 Sep 2017 18:15:13 +0000 /herb-roasted-turkey/ Any good turkey starts with a good brine! Brine Ingredients 1 – 3 Star anise (optional) 1 tablespoon coriander seeds 1 tablespoon fennel seeds 1 tablespoon Dried Thyme 1 tablespoon dried rosemary 1 tablespoon dried sage 1 tablespoon peppercorns (you can crush them if you want) 5 whole bay leaves (optional) 1 to 1.5 cups of sea salt 2 onions 2 leeks 2 – 3 celery sticks Instructions In a pot of water roughly 4 to 5 cups. /easy-to-make-apple-pie/ Sat, 30 Sep 2017 17:52:48 +0000 /easy-to-make-apple-pie/ Ingredients 2 Pie crusts, 1 for top and 1 for bottom. Store bought or hand-made. 1/2 cup unsalted butter 3 tbsp flour 1/4 cup of water 1/2 cup of white sugar 1/2 cup of brown sugar 8 apples, peeled and sliced Instructions Preheat oven to 425 degrees F. Melt the butter in a saucepan. Stir in flour to form a paste. Add water, white sugar and brown sugar, and bring to a boil. /grandma-bakers-dinner-rolls/ Fri, 29 Sep 2017 03:14:43 +0000 /grandma-bakers-dinner-rolls/ Ingredients 1 cup milk 1/2 cup butter 1 package of yeast(fast-rising) 1/2 warm water 1 tbsp sugar 3 eggs 1/2 cup of sugar 3/4 tsp salt 4 cups of flour Instructions Make yeast mix. Mix packet of yeast with 1/2 cup of warm water and 1 tbsp sugar. On stove, scald one cup of milk and add 1/2 cup of butter. Let cool until lukewarm. Beat 3 eggs, well beaten until they are light and fluffy. /about/ Fri, 29 Sep 2017 02:59:11 +0000 /about/ Hi I’m INIT_6, I work for a BDSA (Big Data Security Analytics) Start-up company in the DFW area. My language of choice is Python, however I can code in pretty much anything. Married and have several children (pets) 2 Cats Linus and Bashy, 1 dog Simba what is a Shiba Inu, 1 Red Ear Slider turtle named Samuel L. Jackson, and a few fish. I am active in the Dallas InfoSec/Hacker community. /exploiting-manageengine-eventlog-analyzer/ Tue, 30 May 2017 00:03:00 +0000 /exploiting-manageengine-eventlog-analyzer/ Disclosure Summary ManageEngine Event Log Analyzer (ELA) is an IT compliance and Log Management Software for SIEM. INIT_6 discovered a persistent cross-site scripting (XSS) vulnerability, Reflected cross-site scripting (XSS) vulnerability, and passwords stored near-clear text in cookies. The vendor and CERT have been notified of these issues. The version tested was EventLog Analyzer 11.4, which was the most recent version at the time of initial disclosure. As of today, the current version offered by ManageEngine is EventLog Analyzer 11.