MonkeHacks #33

FaustCTF, Full-Stack, Primate Pack v2.0

Author

Monke
October 02, 2024

MonkeHacks #33

This week was varied. On Saturday I took part in FaustCTF, an attack/defense style CTF. I travelled up to Dublin to take part - Team Ireland was treating it as a training exercise for the upcoming European Cybersecurity Challenge (ECSC). It’s probably a bit obvious but I’m one of the web guys, and an exploit writer for the A/D part of the competition.

I also finished the v2 of my plugin suite for Caido, the Primate Pack. I rebuilt it from the ground up in React and Typescript to conform to the new plugin system.

I put some more thought into tooling for my methodology and ironed out some ideas I had for a business. More on this in the future! I’ve been working towards gathering a complete skillset to build a business alone from nothing. I have the company structure set up, and finally this year I’ve become a reasonably good full-stack developer; I can build a scalable cloud-based system with a full backend and frontend alone. This type of full-stack skillset also works very well with building automation.

I’ve finally got some free time so I’ll make a push to get some of my previous findings (about the 100-hour challenge and such) published. Stay tuned.

Taking the train home from Dublin to Cork after FaustCTF.

Weekly Ideas / Notes 

  • I released v2.0 of the Primate Pack, my plugin suite for Caido. Now it has three mini-plugins:

    • Caido Pets allows you to put a custom GIF in the sidebar - the default being a cat.

    • Nerd Sniper allows you to send HTTP requests directly to your friends from the Replay tab. You can configure Discord webhooks for each person and their name will appear in the dropdown menu when you right-click.

    • Embedder is a customisable sidebar tab. You can rename this tab, and embed whatever you want within it - for example, you could embed a Grafana dashboard, or an XSSHunter page.

  • This rewrite was needed because Caido launched an official plugin system and store recently. I taught myself React and Typescript a few months ago for this reason. That was around the time I launched the Simian Security website, which I also wrote in React. I have no particular aspirations to become a frontend dev, but it’s a useful skill to have. It was also a nice break from manual hacking. I’ve also committed to helping Caido with documentation for their SDK. I need to familiarise myself with some of the new additions to the SDK first, but hopefully I can flesh out that documentation a bit more and write some guides too.

  • I figured out that I tend to do better if I tell myself “I’m going to do X amount of hours of recon on this target today” rather than “I’m going to find a bug”. This small mindset shift removes the bounty pressure, and usually results in a few leads that I can explore.

  • I reported a systemic issue in several cloud platforms this week. I initially found it on AWS as part of H1-0131, but it appears to be a universal design flaw in the implementation of this type of system, so I’ve submitted it to the other platforms as well. Fingers crossed! It’ll make for a good blog post eventually.

  • It’s the small steps that count. Each of your skills is like a tree. You plant the tree, and you water it a small bit every day. After a year, that tree is a sapling, and after two years, it’s a small tree. The catch is that every day, you need to show up and water this sapling, or it won’t grow. You need to build that solid foundation without rushing into it. I try to live my life following this philosophy, which is why I can now read Arabic script, have a daily journal for the last 5 years (1700 days) , solve intermediate difficulty bouldering problems, and do bug bounty as a career. Don’t get distracted by the big picture. Water that sapling.

Resources