• Home
  • Contact
  • LinkedIn
  • Twitter

Ryan Wendel

My random musings on tech and whatever…

Category: Research

Using CodePipeline, CodeDeploy, and CodeCommit with an EC2 AutoScaling Group

Using CodePipeline, CodeDeploy, and CodeCommit with an EC2 AutoScaling Group

Ryan Wendel / February 19, 2021

Building off my last post, I wanted to utilize the simple application I created in another proof-of-concept that involves the following AWS technologies: Elastic Cloud Compute Instances (EC2) EC2 Autoscaling Groups Network automation via Cloudformation CodePipeline CodeCommmit CodeDeploy The gist of this new proof-of-concept involves wrapping my…

Continue Reading→

Jumping into React, Node, MongoDB, and AWS S3

Jumping into React, Node, MongoDB, and AWS S3

Ryan Wendel / February 9, 2021

So I finally got around to working with some technologies that have been on my hot-list for quite some time. NodeJS, React, and MongoDB see a lot of use in the application development industry and it was high time I put my nose into them. I decided…

Continue Reading→

DNS Exfiltration using SQLMap in a Microsoft SQL Environment - Featured Image

DNS Exfiltration using SQLMap in a Microsoft SQL Environment

Ryan Wendel / February 27, 2020

You may have seen my last post related to DNS exfil in a MS-SQL environment using Burp Suite’s Collaborator tool. I had mentioned that spinning up a DNS infrastructure that allows you to perform DNS exfil outside of this tool can be difficult. I was quickly notified…

Continue Reading→

DNS Exfiltration thru Blind SQL Injection in a MS-SQL Environment

DNS Exfiltration through Blind SQL Injection in a MS-SQL Environment Using Burp Collaborator

Ryan Wendel / February 20, 2020

I had an engagement the other week where I discovered a few instances of Blind SQL Injection in a .NET application with a Microsoft SQL Server (MS-SQL) back-end database system. The underlying account user had “sysadmin” privileges but due to the reservations of my client, I chose…

Continue Reading→

Using Burp's Cookie Jar for Java Web Tokens

Using Burp Suite’s Cookie Jar for JSON Web Tokens

Ryan Wendel / September 7, 2019

I was going over an application I wrote prepping for my upcoming class and realized the shortcoming’s of Burp’s default session handling mechanisms. Not to knock Burp, but working with a Single Page Application (SPA) that makes calls to several APIs using a JSON Web Token (JWT)…

Continue Reading→

un with Burp Suite Session Handling, Extensions, and SQLMap

Fun with Burp Suite Session Handling, Extensions, and SQLMap

Ryan Wendel / April 30, 2019

I’ve been a little obsessed with the session handling tool-set that Burp Suite provides. I’ve been running into web applications that aggressively tear down (de-authenticate) sessions  for any number of given reasons. Could be the volume of requests sent, malicious input, time-based, accessing a certain section of…

Continue Reading→

Looking at CSRF and XSS with default Javascript and jQuery

Looking at CSRF and XSS with default Javascript and jQuery

Ryan Wendel / September 4, 2018

I’ve been procrastinating finalizing some basic research and putting my thoughts into a blog post regarding Same Origin Policy (SOP), Cross Origin Resource Sharing (CORS), Cross-Site Scripting (XSS), Cross-site Request Forgery (CSRF), and Content Security Policy (CSP). I am hoping to spend some more time on it…

Continue Reading→

Posts navigation

1 2 Next »

About

Ryan Wendel

Ryan Wendel currently operates as a penetration testing consultant working for the Dell Secureworks Adversary Group. His primary interests and areas of expertise encompass simulating real-world attacks on web applications and external/internal networks. Outside of his interest in offensive security, Ryan enjoys taking time off to snowboard, lift weights, hike, and enjoy the many delicious craft brews the Denver, CO area has to offer.

Ryan Wendel - GitHub Ryan Wendel - LinkedIn Ryan Wendel - Twitter

Recent Posts

  • Using CodePipeline, CodeDeploy, and CodeCommit with an EC2 AutoScaling Group
  • Jumping into React, Node, MongoDB, and AWS S3
  • DNS Exfiltration using SQLMap in a Microsoft SQL Environment
  • DNS Exfiltration through Blind SQL Injection in a MS-SQL Environment Using Burp Collaborator
  • Forwarding Shells Through A Jump Box Using SSH

Categories

  • AWS
  • Bash
  • Burp Suite
  • Cloud
  • JavaScript
  • Lab
  • PHP
  • Python
  • Research
  • Scripts
  • SQL Injection
  • Tips
  • Uncategorized
  • WebApp
  • Writeups

Archives

  • February 2021
  • February 2020
  • September 2019
  • May 2019
  • April 2019
  • October 2018
  • September 2018
  • April 2018
  • November 2017
  • October 2017
  • August 2017
  • July 2017

Tags

Amap AWS Bash Burp CentOS Chef Cloud Credspray Enumeration gobuster JavaScript Lab Metasploit MongoDB Nessus Netpen Nmap Node PHP Python React Research Scanning Scripts Shells SMB SQL Injection Tips WebApp Workflow
Copyright RyanWendel.com © All rights reserved.
Blog Way by ProDesigns