Cyber Security Blog of Chris Dale

  • Guest blog at – Azure 0day Cross-Site Scripting with Sandbox Escape

    My guest blog post over at SANS’s pen-testing blog went live. Hope you like it! Check it out here:  

  • Hacking in 2016 – How are our systems broken?

    A presentasjon I did for Norwegian Developer Conference on attacking systems. Lots of demos!

  • Rapid android application pentesting

    This is a quick guide to get started with Android application testing. I wont delve into details of testing, but instead cover what is necessary to do in order to get started. The topics I go through are: Get a hold of an Android device through emulation or physical device Find and download the APK…

  • Why frustrate yourself over passwords?

    When creating a new account for yourself, either at your employeer, on the Internett in general or for your customers, you should in theory adhere to some best practice rules such as creating a strong password. That is: – Above 20 characters – A variety of special characters – No sentences, they alone can quite…

  • I found a security vulnerability, how do I disclose it?

    I found a security vulnerability, how do I disclose it?

    I get different people approaching me all the time regarding this question; how do you disclose security vulnerabilities? In this post I’ll share my thoughts on the subject. First of all, you should probably stay away from researching vulnerabilities on-line, wihtout permission. Your hat will quickly turn to shades of grey, and suddenly black before you…

  • 15 solid tips on producing good documentation

    Documentation has been very dear for me for a long time. The usefulness and importance of documenting is just so immerse! In this post I’ll take a chop on some of my thoughts on documenting. Keep it simple stupid. Documentation should be brief and to the point. Do your best in having economy of words,…

  • How to Password Reset

    A lot of companies and organisations does not do password resets properly today. Here is a recipe on how to do it securely. User enters the login page. This must be loaded over HTTPS. User clicks the “Forgot password” button. The user must then supply something unique to the user, e.g. email or username. The backend…

  • LinkedIn Phish – Investment Proposal

    Today I received the following message from a LinkedIn contact: Greetings, I hope all is well with you, please review this recommendation for an investment opportunity which am considering a partnership with you if you’re interested. I hope that the reasons for this investment, which are alluded to in more details in the enclosed document(…

  • News anchor challenged me to hack his Facebook account – Did he regret his decision?

    I was privileged enough to be interviewed on Norwegian breakfast TV Saturday morning. The reporter had asked me to try hack his Facebook account the day before. Do you think he regret his decision? Here is the clip: – Norwegian (original): – English: (turn on subtitles)

  • Finding Zero-Day XSS Vulns via Doc Metadata (+ WordPress 0day)

    I’ve just released a blog post over at SANS pen-testing blog. Check out my latest article there: It contains details on using metadata as an attack vector, and using these techniques to metadata bomb documents to find zero-days. I hope you enjoy it.

Looking to get in touch?