Andreas Happe: Everything

FH-Lecture: Secure Operating Systems (SecOps)

Nach dem guten Feedback meiner Studenten auf meine Web Application Security Vorlesung lies ich mich überreden, im Wintersemester 2019 einen Teil einer weiteren Vorlesung zu halten: SecOps — Secure Operating Systems, also quasi Security Themen für Administratoren. Mein Part umschloss Linux, Virtualisierung und (sehr kurz) Mobile Systeme. Mein BrainDump dieser Vorlesung kann hier bezogen werden. Es ist noch in einem frühen Stadium, aber ich hoffe es kann schon weiteren Personen helfen bzw.

November 15, 2019 in books

Einführung in die Web-Security

Diese Unterlagen entstanden zeitgleich während einer von mir gehaltenen Vorlesung an dem Technikum/FH Wien. Nach dem positiven Feedback der Stundenten wurden die Unterlagen überarbeitet und ich hoffe, dass sie auch von anderen Personen genutzt werden können. Inhalt Der Inhalt orientiert sich grob an den OWASP Top 10: Allgemeine Sicherheitsgrundlagen Was sind Web-Applikationen? Authentication und Authorization-Fehler Serverseite Injection-Angriffe (inkl. SQLi, SSTI, XEE, Type-Juggling, etc.) Clientseitige Angriffe (inkl. XSS, CSRF, Clickjacking, etc.

August 30, 2019 in books

Building a secure torrent download station by combining Private Internet Access (PIA), OpenVPN and transmission through docker

Sometimes I want to work on client assignments (penetration-tests) from home, if I do that I am using my company VPN so that all traffic is routed thorugh their public IP address (which is white-listed by the client). I do not want for traffic to ever leave that VPN as that would look like as if I’d be performing cyber attacks from my private home IP address. The same requirements arise for different use-cases, e.

August 5, 2019 in tech

How to create a (good-looking) PDF and Kindle eBook from LaTeX

So I held a lecture on “Web Application Security” for the FH/Technikum Wien last spring and wrote a small booklet for my students (partially because I wanted to avoid discussions during the final exam). I did volunteer for a anonymous feedback round which turned out very positive for me, the booklet was repeatatly mentioned positively. So I distilled and refined it, tried to improve its focus. As I will do the same lecture next year, I am in dire need of feedback so that I can improve it, so I went to dark places and published it on reddit.

July 29, 2019 in tech

LTE uplink for Raspberry Pi: Huawei E3372 vs Waveshare SIM7600E-H

I spent some time playing around with various LTE-options for my Raspberry Pi Access Point/Router setup. My Huawei E3372 USB LTE modem works find but only implements a fake network card. This means that a virtual network card is emulated, all traffic is NATted over a virtual router located behind that virtual network card. This happens in addition to the network translation (NAT) that my Raspberry Pi access point already does.

July 5, 2019 in tech

Books and influences of mine

Most of you (and there are a couple of thousands of you) come for my tech-posts, but it seems that some of you get lost reading my non-techie posts too. Time to add on of those, it’s been a while.. I breathe books, they give my brain constant input to thrive on. Recently I went through my goodreads list of reread-good-books to check what influences me and started to reread some of them.

June 26, 2019 in life tech books

Building an LTE Access Point with a Raspberry Pi

In one of my last experiments I replaced my crappy T-Mobile (now Magenta) 4G modem/access point with an OpenWRT-based cheap travel router and a 4G USB LTE modem. That doubled my speed over the wireless (WLAN) network but the setup was limited by the outdated and under-powered travel rooter. So I got myself a cheap Raspberry Pi 3b+ and created a minimal Linux-based 4G router/access-point. My basic goal was to create the minimal feasible configuration so that I have a good starting point for future IoT/VPN/SmartHome experiments.

June 22, 2019 in tech

Switching a Xiaomi Mi Mix 2s to LinageOS (Android 9)

Recently I upgraded from my “old” Motorola/Lenovo G6 plus to a Xiaomi Mi Mix 2s. Why the new phone? Main reasons for that upgrade were: The old phone started to look like a banana. Seriously, I carry my phone in my back pockets and after a year that.. let to a more-than-slightly bent phone. This might have let to another problem: random vibra-call activation. Originally I thought that I was just imagining them, but recently my phone started to vibrate while it was in my hand — while no notification or interaction at all was happening.

June 11, 2019 in tech

Building an LTE Access point with OpenWRT Rooter

My LTE internet connection (70 Mbit downstream, 15 MBit upstream) came with a combined Huawei B315s LTE modem/access point. As I was using it for the last two to three years a couple of problems did arise: the internet connection was often shaky, oftentimes the uplink connection got lost and I had to power-cycle the modem/access point. Subjectively this got improved with the last system upgrade. while the internet down speed on the wired connection was good, the speed achieved through the wireless connection was atrocious (see measurements later in this blog post) the power supply is badly built and takes the space of two power outlets.

May 30, 2019 in tech

To Fuzz a WebSocket

During a recent assignment the customer server was utilizing a WebSocket for some notification transport, part of my assignment was to fuzz-test the used WebSocket (and the messages transported over it). To do this, I turned to my typical tools: PortSwigger BURP only supports display of WebSocket messages but not altering and/or automated fuzzing of websocket messages. OWASP ZAP can inject and fuzz web sockets (e. g. using FuzzDB vectors), alas the tested application disconnects the websocket and thus prevents ZAP from performing the fuzzing attack.

May 22, 2019 in security