Security Blog
How-Tos
The Pen Test Partners Security Blog brings you the latest news and trends in penetration testing and the internet security industry.
More about our security blog »
For the best user experience please upgrade your browser
How to enhance the security of your social media accounts
30 Aug 2024
How to root an Android device for analysis and vulnerability assessment
23 Aug 2024
Bootloaders explained
01 Aug 2024
Dodgy disks. My 32TB SSD Adventure
21 Jun 2024
Bypassing MFA on Microsoft Azure Entra ID
01 May 2024
Cyber security for Credit Unions 101
20 Feb 2024
Call centres. Outbound call verification
03 Oct 2023
Information disclosure through insecure design
07 Sep 2023
The most hated man on the internet. Lessons to learn
22 Aug 2023
n00b’s guide to DEF CON. Surviving the Matrix of the underground
03 Aug 2023
Exposed Gits: 10 Years on
19 Jul 2023
It’s always DNS, here’s why…
16 May 2023
London Councils & pirate books. Google dorking for subdomain takeovers
11 Apr 2023
Attacking Encrypted HTTP Communications
28 Sep 2022
Efficient Infrastructure Testing
01 Aug 2022
Stop using phishing as a measure of your cyber awareness culture
12 Jul 2022
Constrained environment breakout. .NET Assembly exfiltration via Internet Options
09 May 2022
Time based username enumeration
09 Nov 2021
DCOM abuse and lateral movement with Cobalt Strike
03 Nov 2021
Securing mobile devices. A timely reminder
28 Sep 2021
Breaking the NFC chips in tens of millions of smart phones, and a few PoS systems
18 Aug 2021
SNMP – Simply Not My Problem. Or is it?
02 Jul 2021
Smart lighting security
21 May 2021
Security vs User Journey
16 Apr 2021
Feature and Permission Policies. Security issues
23 Feb 2021
Cyber Security advice for Finance staff
15 Jan 2021
How to make a software BTRFS RAID1 with LUKS2 FDE
22 Dec 2020
How to use Keepalived for high availability and load balancing
22 Dec 2020
A Logical Volume Manager / LVM primer for Linux
21 Dec 2020
Understanding Binary and Data Representation with CyberChef
24 Nov 2020
Brute forcing device passwords
16 Nov 2020
Cyber Security Month. What can you do?
08 Oct 2020
CVE-2020-1472/Zerologon. As an IT manager should I worry?
23 Sep 2020
Scanning for UK gov security.txt files
26 Aug 2020
Security Awareness is as valuable today as ever
07 Aug 2020
Building a lab with Server 2019 Server Core and PowerShell …then attacking it!
03 Aug 2020
Scams and how to spot them
30 Jun 2020
Congrats, you got everyone remote. But did you do it securely?
29 Jun 2020
Revisiting old tools
12 Jun 2020
Speaking at security events
04 May 2020
Honeyroasting. How to detect Kerberoast breaches with honeypots
01 Apr 2020
Quick wins with Adobe Experience Manager
27 Mar 2020
9 things to consider when staff work from home unexpectedly
10 Mar 2020
From Minecraft to Metasploit. Game hacking could start your cyber security career
03 Mar 2020
Business Email Compromise. What to do
14 Feb 2020
HTTP Request Smuggling. A how-to
31 Jan 2020
Quick Wins to Combat Data Leaks
08 Jan 2020
The snooping girl on a train, again. How to compromise a business
02 Dec 2019
Christmas socialising. Goodwill to all, and keep your devices safe
28 Nov 2019
A security researcher has made contact. What do I do?
27 Sep 2019
Double-Free RCE in VLC. A honggfuzz how-to
21 Jun 2019
Covert Keylogging: Sniping your Typing
13 Jun 2019
How To Do Firmware Analysis. Tools, Tips, and Tricks
03 May 2019
Walkthrough. Investigating an SSD
15 Mar 2019
Oracle MAF store bypass, a how-to
15 Feb 2019
Burp HMAC header extensions, a how-to
07 Feb 2019
No need for lock picking tools
02 Nov 2018
Cisco device config dumping
26 Oct 2018
Running a security awareness program
01 Oct 2018
Tamper proofing review: the iZettle card payment terminal
08 Aug 2018
Copycat Kali, with mykali for Kali Linux
07 Aug 2018
Data exfiltration techniques
11 Jul 2018
Windows Server settings. Administrative Templates – Network Items. A security how-to
21 Jun 2018
So, you just caused a data breach, by CCing the wrong person in an email…
01 Jun 2018
Penetration Testing Requirements for GDPR
18 May 2018
Hacking train passenger Wi-Fi
08 May 2018
Soldering for Reverse Engineering. Swapping out eSIMs with “normal” SIMs
13 Apr 2018
Accidentally “hacking” Red Hat
08 Apr 2018
From PNG tEXt to Persistent XSS
06 Apr 2018
Abusing Duo 2FA
16 Mar 2018
If you aren’t soldering, you probably aren’t testing IoT thoroughly
08 Mar 2018
Docker for Hackers? A pen tester’s guide
08 Mar 2018
Building half a ‘Proxmark’ for $10
18 Jan 2018
NRF51822 code readout protection bypass- a how-to
05 Jan 2018
Hacking a talking toy parrot
01 Dec 2017
Hacking your office through your screen caster
24 Nov 2017
Exfiltration by encoding data in pixel colour values
08 Nov 2017
How to crack private APN keys with hashcat
31 Oct 2017
Girl on a train. The snooping girl on a train: The Sequel
12 Oct 2017
Bypass Windows auth & BitLocker with forgotten password function
25 Aug 2017
Blockchain Implementation Security. A hardening how-to
22 Aug 2017
Project Dumb2Smart. How to build a secure IoT device. Part One: Dumb
18 Jul 2017
Home Wi-Fi routers. Is yours secure?
23 Jun 2017
What I learned about managing worm outbreaks… 14 years ago
16 May 2017
How to reverse engineer MSWord malware
08 May 2017
Faster EEPROM firmware reads? Use a Pi!
04 May 2017
Girl on a train. The snooping girl on a train
28 Apr 2017
LAN surfing. How to use JavaScript to Execute Arbitrary Code on Routers
13 Mar 2017
Help users spot phishing. Tag fake “internal” emails for them
16 Feb 2017
How to avoid blowing your privacy online
25 Jan 2017
Can’t get data onto that machine? Download a tunnel client over DNS
10 Nov 2016
Scripting Metasploit to exploit a group of hosts. A how-to.
04 Nov 2016
ASUS RT-AC66U router. A couple of bug fixes
27 Sep 2016
CSRFing Facebook games
07 Sep 2016
How to abuse SSH keys
31 Aug 2016
How I can gain control of your TP-LINK home switch
20 May 2016
An interesting route to domain admin- iSCSI
18 May 2016
RATing through the Steam Workshop
28 Apr 2016
How-to subvert Android backups to export sandboxed app files
14 Apr 2016
How a Pentester books a Squash court
31 Mar 2016
How we made the listening-in Android app
23 Mar 2016
How to defend against Pass-the-Hash (PtH) attacks
21 Mar 2016
DIY: How to build your own host-based IDS (HIDS) using OSSEC
16 Mar 2016
Apps and Après. Skiing and privacy
15 Mar 2016
New Chromecast & Chromecast Audio. Have they fixed their hijacking issue?
11 Mar 2016
Are your phones listening to you?
02 Mar 2016
How to exploit XSS with CSRF
26 Feb 2016
glibc stack-based buffer overflow. What you need to know: UPDATE
24 Feb 2016
Pwning CCTV cameras: Update
23 Feb 2016
glibc stack-based buffer overflow. What you need to know
22 Feb 2016
PowerShell and VBScript: Getting full DB access via restricted desktop apps
18 Feb 2016
Cisco ASA Remote Code Execution – Buffer Overflow in IKE code
16 Feb 2016
Pwning CCTV cameras
10 Feb 2016
How to reverse Wyse terminal password crypto: Method Two
10 Feb 2016
How to reverse Wyse terminal password crypto: Method One
09 Feb 2016
Just how secure is the average home Wi-Fi router?
08 Feb 2016
Reading Atmel AVR MCUs
23 Jan 2016
Steal your Wi-Fi key from your doorbell? IoT WTF! UPDATE
12 Jan 2016
Vtech Innotab Max file extraction: Finding the Superblock
07 Dec 2015
VTech Innotab Max vulnerable to trivial data extraction
02 Dec 2015
Collateral Damage: Top 5 Reasons You Should be Scared of Your Customers
26 Nov 2015
New, easier ways to make My Friend Cayla swear
20 Nov 2015
Hacking a Wi-Fi Coffee Machine – Part 1
16 Nov 2015
The TalkTalk breach, Ken Munro will be on the BBC later…
23 Oct 2015
Tonight’s CSI Cyber: implausible Marla talking doll hack. Fiction stranger than truth for once
06 Oct 2015
Hacking the Aldi IP CCTV Camera (part 2)
02 Oct 2015
Should I enable encryption my Android handset?
23 Sep 2015
How to get Windows to give you credentials through LLMNR
22 Sep 2015
Android Lock Screen Bypass
16 Sep 2015
CESG and CPNI put passwords back in the spotlight. Have they got it right?
16 Sep 2015
44CON London: Our IoT Security Workshop
11 Sep 2015
Tweaking nmap for hostile networks. A How-to
09 Sep 2015
How do you know that you aren’t compromised?
28 Aug 2015
Grab the UI lock password from McAfee A/V, kill the service, send in the malware
26 Aug 2015
How to extract sensitive plaintext data from Android memory
19 Aug 2015
AirDrop and Cyber Flashing, what’s the deal?
13 Aug 2015
Inside the spy tank; a hardware review.
11 Aug 2015
Denial-of-Service bug in BIND
04 Aug 2015
How to create poisoned Office documents for your staff awareness training – part 2
30 Jul 2015
How to create poisoned Office documents for your staff awareness training – part 1
28 Jul 2015
How to hack an app enabled device to make it truly internet enabled
17 Jul 2015
Android debug mode and apps. A cautionary tale
15 Jul 2015
Hydra the logon cracker, a brute-forcing how-to user guide
13 Jul 2015
Basic safety tips for mobile devices
08 Jul 2015
The tiniest PHP system shell ever?
07 Jul 2015
Finding wireless kettles with social networks
01 Jul 2015
Abusing software updates. GoPro Studio desktop app: Samsung keyboard app-style fail
29 Jun 2015
Shiva, the spam honeypot. Tips and tricks for getting it up and running.
26 Jun 2015
My Friend Cayla. Updated app; Updated security fails. How to make her swear (again!)
22 Jun 2015
Encrypting the database has done virtually nothing to secure the doll and app.
Common coding fails when writing Android mobile apps
17 Jun 2015
It’s amazing how many simple issues create significant security holes.
Why you’re better off buying expensive smart scales
15 Jun 2015
Extracting your WPA PSK from bathroom scales
08 Jun 2015
Hacking kettles & extracting plain text WPA PSKs. Yes really!
08 Jun 2015
Infosecurity Europe 2015 round up
05 Jun 2015
GoPro Wi-Fi issues could mean stolen video, or worse…
01 Jun 2015
Honeypots; a usage guide
05 May 2015
How to read from an EEPROM
27 Apr 2015
MS15-034. What you need to know
16 Apr 2015
Hacking the IP camera (part 1)
10 Apr 2015
Move over SHA-1, SHA-2 is coming. Here’s the why and the how
09 Apr 2015
Protecting yourself from your customers
31 Mar 2015
DIY dual boot Nexus tablet; make your own mobile test rig with NetHunter
24 Mar 2015
EAP-TLS: Where Mac security is worse than Windows
19 Mar 2015
Samsung TV voice encryption UPDATE: Fixed, but not quite…
06 Mar 2015
The lowdown on the SKIP-TLS and FREAK flaws UPDATE
06 Mar 2015
The lowdown on the SKIP-TLS and FREAK flaws
05 Mar 2015
The Right Way To Do Session Management
25 Feb 2015
Is your Samsung TV listening to you?
16 Feb 2015
Exploiting SUID Executables
09 Feb 2015
Cracking Android passwords, a how-to
02 Feb 2015
Making children’s toys swear
23 Jan 2015
RC4 cipher considered harmful?
22 Jan 2015
How to test wireless systems: A step-by-step guide (part 2)
20 Jan 2015
Are your smart weighing scales lying to you? Quite possibly (part 2)
09 Jan 2015
Are your smart weighing scales lying to you? Quite possibly (part 1)
06 Jan 2015
How to test wireless systems: A step-by-step guide
05 Jan 2015
Visual Basic for Applications and the dangers of allowing Office macros
30 Dec 2014
Pwning git: A Proof of Concept (PoC)
24 Dec 2014
Git client – time to patch!
19 Dec 2014
Data tethering on mobile devices – what are the risks?
09 Dec 2014
Hacking Oracle Reporter- A how-to
02 Dec 2014
Patch management, it’s sexy, here’s why
11 Nov 2014
App creep: Facebook security issues
10 Nov 2014
Using nfsshell to compromise older environments
24 Oct 2014
Using hexdump analysis for firmware extraction: A how-to
20 Oct 2014
Efficient Password Cracking Where LM Hashes Exist for Some Users
17 Oct 2014
Critical SQL Injection Vulnerability in Drupal 7.0-7.31
16 Oct 2014
POODLE SSLv3 Redux: How to fix it
15 Oct 2014
Further Rockchip Android brokenness
13 Oct 2014
BBC article: Prevent devices being remotely wiped, here’s how to do it properly
10 Oct 2014
Using Applocker to protect your users from themselves, and you from your users
06 Oct 2014
Nmap for Sysadmins
22 Sep 2014
Socat-fu lesson
19 Sep 2014
Is a remote wipe any better than a factory reset on an Android device?
16 Sep 2014
Recovering data from ‘wiped’ Android devices: A How To Guide
15 Sep 2014
More on tuning John the Ripper
15 Sep 2014
Custom charsets and rules with John The Ripper and oclhashcat
10 Sep 2014
Top 10 ways to compromise your mobile security that you’d never believe
20 Aug 2014
Top 10 stupidest ways we’ve got domain admin
13 Aug 2014
Advanced traffic interception for mobile apps using Mallory and Burp
06 Aug 2014
Further IBM Maximo Asset Management Vulnerabilities Reported
31 Jul 2014
PTP Code Respository
07 Jul 2014
Auditing AWS Security Groups – Part 2
07 Jul 2014
Hacking Sat Navs
04 Jul 2014
Auditing AWS Security Groups
02 Jul 2014
Is everything actually broken? Software will always be flawed, but here’s what you can do about it
17 Jun 2014
Old pre-smartphones from eBay – Blackmail Central!
10 Jun 2014
Breaking Out of Citrix and other Restricted Desktop Environments
06 Jun 2014
How to scrape plain text from an encrypted Android phone OR why most MDM products just don’t cut it
04 Jun 2014
How to hardware hack Android over UART
29 May 2014
BMW i3 password issues
28 May 2014
How to Hack the Hudl – We give Rockchip a good seeing to
22 May 2014
Defeating corporate anti-virus
20 May 2014
Quick and dirty binary analysis using sandboxes
14 May 2014
Shameless self promotion – Pen Test Partners at Infosecurity Europe 2014
30 Apr 2014
SayNoTo0870.com SayYesToCreditCardFraud.co.uk..?
25 Apr 2014
Keep your Android versions updated. Why? If you have to ask…
24 Apr 2014
Security vs the community: you’re doing it right!
14 Apr 2014
New Zeus variant may get lost in the clamour of Heartbleed
11 Apr 2014
WTF Heartbleed? Don’t make me move all my HTTPS services to HTTP and ditch SSL completely
09 Apr 2014
Heartbleed OpenSSL bug- overview and fixes
08 Apr 2014
WAF (Web Application Firewall) Testing for dummies
08 Apr 2014
Top Tips For Internet Privacy
04 Apr 2014
Scanning for Default Files
01 Apr 2014
Honey traps, a lesson in espionage, and managing your ego
25 Mar 2014
Create a honeynet, dupe your attackers, build threat intelligence
24 Mar 2014
Hacking Computer Games
20 Mar 2014
8 ways to be great at password management, and protect your customers
13 Mar 2014
Passwords: A step-by-step analysis of breaking them
06 Mar 2014
Need to avoid a honeypot? Here’s how
05 Mar 2014
Webcam Security: I can SEE you!
04 Mar 2014
Keylogging domain creds; who needs a hash? Lock the victim’s workstation to order and snarf them immediately
03 Mar 2014
Threat Intelligence: Log File Hacking
26 Feb 2014
Password re-use: the game is changing, SO USE A PASSWORD VAULT!
21 Feb 2014
Can you really wipe a mobile device remotely?
20 Feb 2014
DIY – Build Your Own “Pwn Pad” Style Nexus 7 Hack Box
19 Feb 2014
Analysis of reported Tesco account and password data
14 Feb 2014
How can I be tracked using my mobile devices? Here’s how…
13 Feb 2014
It’s Safer Internet Day and we’ve got six tips to help you stay out of trouble
11 Feb 2014
Passwords, passwords, passwords (repeat)
24 Jan 2014
Belt AND Braces: Web apps and mod_security
22 Jan 2014
Data Exfiltration: DNS tunnelling using iodine
20 Jan 2014
Test early, test often: 6 things you should know about application security testing
17 Jan 2014
IBM Maximo Asset Management Vulnerability Reported
16 Jan 2014
Abusing Group Policy Preferences to Elevate Privileges
06 Jan 2014
Hackey Phishmas!
16 Dec 2013
Transferring Data the Low Tech Way
04 Dec 2013
What we can learn from Meerkats?
03 Dec 2013
Brute Forcing Android PINs (or why you should never enable ADB part 2)
25 Nov 2013
Brute Forcing Android PINs (or why you should never enable ADB part 1)
14 Nov 2013
How to get into Information Security
13 Nov 2013
Backwards phishing with Unicode – edocinU htiw gnihsihp sdrawkcaB
07 Nov 2013
How to remove IIS server response header banners
29 Oct 2013
Get your Macs back on track- Apple security for Windows experts
28 Oct 2013
The Salmon Fishing Bear Attack OR Grabbing password hashes off the network via NetBIOS
24 Oct 2013
The Antwerp hackers bundle demystified
23 Oct 2013
Clickjacking explained, in detail
17 Oct 2013
Patch Tuesday 08/10/2013- notable items
09 Oct 2013
Duplicate Passwords: Why IT Support Needs a Wake Up Call
08 Oct 2013
Git Extraction – Abusing version control systems
04 Oct 2013
Simple steps to stop Social Engineers
01 Oct 2013
How to reverse engineer a protocol
24 Sep 2013
Browser support for TLS 1.1 and 1.2
17 Sep 2013
What to do if you find yourself being DDoSed
16 Sep 2013
Suffered a Security breach?
Mobile Security
Social Engineering
Web application testing
Security Consuting
