Posts on red-teaming
43 posts on red-teaming. Notes from public sources and my own test lab.
Spy in Your Pocket: Did You Hand Over the Keys to Your Mobile App's Backdoor?
Think your compiled mobile app is a secure black box? Think again. We're diving into binary security illusions and the pitfalls of local data storage from a Red Team perspective.
Smart Devices, Dumb Mistakes: The Dark Backdoors of the IoT World
Relying on Shodan scans for IoT security is the laziest approach in the industry. Let's talk about the missing 'S' in IoT, why MQTT acts like a gossiping neighbor, and what's actually hiding inside that firmware.
Cebimizdeki Casuslar: Mobil Güvenliğin Görünmeyen Yüzü ve Tersine Mühendislik Maceraları
Mobil uygulamalarda 'güvenli' sandığımız o alanların aslında ne kadar kırılgan olduğunu, kendi yaptığım hatalardan yola çıkarak anlatıyorum. Tersine mühendislikten SSL pinning'e kadar sahada karşılaştığımız gerçekleri konuşalım.
Is the Ship Sinking? Lost Security Between Container Layers and Lessons from the Field
Let’s debunk the myth that containers are inherently secure. From root user illusions to supply chain risks, I’m diving into why your 'isolated' environments might be more vulnerable than you think.
Smart Devices, Dumb Security: IoT Backdoors and Silent Takeovers
From a coffee machine trying to talk to a Domain Controller to hardcoded secrets in firmware, let's dive into the Wild West of IoT security from a Red Teamer's perspective.
The Only Bug Even the Most Expensive Firewall Can’t Patch: The Human Factor
Ever seen a massive security budget get wiped out by a single 'free coffee' link? Let's dive into why the 'human interface' remains our most critical vulnerability and how we, as Red Teamers, look at psychological triggers.
The Shadow Creeping Behind the Walls: Anatomy of SSRF and Those 'Innocent' Looking Parameters
A deep dive into Server-Side Request Forgery (SSRF), exploring how 'innocent' URL parameters can lead to full cloud environment compromise, shared from the perspective of a Red Team Lead.
We Used to Drop the Report and Run, Now We Live Together Inside: The Evolution of Modern Pentesting
Pentesting is no longer just about scanning for vulnerabilities and handing over a PDF. Modern Red Teaming focuses on the 'Assumed Breach' mindset and testing how well the Blue Team actually detects 'Living off the Land' techniques.
Dumb Passwords of Smart Devices: Firmware Hunting and Shadow Protocols in the IoT World
Ever wondered why billion-dollar IoT infrastructures fail? Let's dive into firmware extraction, hidden backdoors, and the inherent risks of misconfigured MQTT protocols from a Red Teamer's perspective.
Is Your Smart Bulb Handing Over Your House Keys? The Dark Backdoors of IoT
Forget 'admin:admin' hunts on Shodan. Real IoT security threats hide deep within unpatched, messy firmware files and unencrypted protocols. Here's a look at how we analyze these devices during Red Team ops.
Hitting the 'Reset' Button in the Factory: Why Red Teaming Industrial Systems Gets the Heart Racing
A deep dive into the high-stakes world of Industrial Control Systems (OT) security, featuring a 'learning-the-hard-way' story about how a simple Nmap scan can halt an entire production line.
Trojan Horses in Our Pockets: Mobile App Security Blunders We Swear We'd Never Make
From mistaking public API keys for crown jewels to the 'allowBackup' trap, let's dive into some common mobile security pitfalls I've seen in the field—and how to avoid them.