Top all-time · #9017
Portcullis Labs
Company blog · labs.portcullis.co.uk/blogsecurity
Portcullis Labs is the company blog at labs.portcullis.co.uk, writing about security. Since 2013, 9 different Hacker News readers have linked it 10 times, most often “Reading hotel key cards with a credit card magstripe reader”. The last post was in 2019, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Portcullis Labs for security research: exploiting inherited file descriptors, the SSL cipher suite enumeration tool, and XSS tunnelling for proxying a victim's session.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Reading hotel key cards with a credit card magstripe reader4 people · 4 mentions · first linked 2018-07-05
What Hacker News says?
Personal option: Separating leak from UAF and claim the former is more acceptable should not be the case, because leak applies to more than memory, and leaky fds can also create security holes like [0] [0]: https://labs.portcullis.co.uk/blog/exploiting-inherited-file...
Comment linking /blog/exploiting-inherited-file-handles-in-setuid-programs/
on “Open-Sourcing ClusterFuzz”Submitted Evaluating SteamOS's security posture (a first look) as a story · 4 points
HN discussionNo one has mentioned the https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/ perl script yet. The tool performs a similar function to sslscan, THCSSLCheck and sslyze, but differs by crafting part of the SSL handshake instead of using an SSL library to establish a full connection. [...] Libraries either become outdated and therefore incapable of testing for new protocols such as TLSv1.2 or exotic cipher suites…
Comment linking /tools/ssl-cipher-suite-enum/
on “SSL tools we wish we'd known about earlier”Submitted Reading hotel key cards with a credit card magstripe reader as a story · 2 points
HN discussionInject something like XSS Tunnel ( http://labs.portcullis.co.uk/download/XSS-Tunnelling.pdf that gives you a local proxy that you can point your local browser and then sends all of your traffic through the victim, so you'll see and use the website(s) with your victim's session), or BeeF - http://beefproject.com/ for tons of exotic XSS based exploits.
Comment linking /download/XSS-Tunnelling.pdf
on “Want to use my wifi?”Submitted Reading hotel key cards with a credit card magstripe reader as a story · 2 points
HN discussionSubmitted New "Restricted Admin" feature of RDP 8.1 allows pass-the-hash attack as a story · 2 points
HN discussionSubmitted Reading hotel key cards with a credit card magstripe reader as a story · 1 points
HN discussionSubmitted Reading hotel key cards with a credit card magstripe reader as a story · 1 points
HN discussionSubmitted Exploring Windows Subsystem for Linux as a story · 1 points
HN discussion