--- title: Blog url: 'http://kernelpanic.cryptid.fr/en' markdown: 'http://kernelpanic.cryptid.fr/en/index.md' lang: en date: '2023-03-15' description: "kernel panic CryptID's blog" taxonomy: archives_month: - mar_2023 archives_year: - '2023' --- # kernel panic ## CryptID's blog Blog 07 *Apr* #### [Nonsense, mayhem, browser security, CSRF, and CORS - Part 2](http://kernelpanic.cryptid.fr/en/blog/nonsense-mayhem-samesite-cors-and-csrf-part-2) # Introduction In the [last blog post](https://kernelpanic.cryptid.fr/en/blog/nonsense-mayhem-samesite-cors-and-csrf), we detailed the various conditions necessary to **perform a successful CSRF attack**, considering today's browser security. I mentioned that it was mostly written out of frustration, as I received numerous erroneous pentest reports regarding CSRF... Well, it see... [Continue reading...](http://kernelpanic.cryptid.fr/en/blog/nonsense-mayhem-samesite-cors-and-csrf-part-2) 16 *Mar* #### [Nonsense, mayhem, browser security, CSRF, and CORS - Part 1](http://kernelpanic.cryptid.fr/en/blog/nonsense-mayhem-samesite-cors-and-csrf) ![](http://kernelpanic.cryptid.fr/images/c/1/f/a/b/c1fab89834ebd42c91e95e4a61d6a15d29665da2-csrf.png) # Introduction A couple of years ago, **CORS misconfigurations** were the hot stuff for Bug Bounty hunters. Now, the vulnerability has made its way to penetration tests reports, along with **CSRF** and other **self-XSS** poor man's security issues. The thing is, the state of the art of security for browse... [Continue reading...](http://kernelpanic.cryptid.fr/en/blog/nonsense-mayhem-samesite-cors-and-csrf) 25 *Nov* #### [DVID (Damn Vulnerable IoT Device) Bluetooth write up](http://kernelpanic.cryptid.fr/en/blog/dvid-bluetooth-writeup) [DVID](http://kernelpanic.cryptid.fr/en/tag:DVID) [Hardware](http://kernelpanic.cryptid.fr/en/tag:Hardware) [Bluetooth](http://kernelpanic.cryptid.fr/en/tag:Bluetooth) ![](http://kernelpanic.cryptid.fr/images/e/1/d/e/8/e1de85b3ce24f25988868c098f26b299aa91c001-nicolas-thomas-3gzi6opsdcy-unsplash.jpg) # Render unto Caesar the things that are Caesar's... Or more exactly to Vulcainreo (Arnaud Courty), who develops an opensource IoT learning board. You can acquire it for less than 40€, which I did myself at [Grehack](https://grehack.fr), on the good advice of my awesome colleagues [ghozt](https://blog.ghozt.ninja/) and [shoxx](https://shoxxdj.fr). [DVID](http://dvid.eu) aims to fa... [Continue reading...](http://kernelpanic.cryptid.fr/en/blog/dvid-bluetooth-writeup) 11 *Sep* #### [Cloning Mifare tags with a low budget in 2019](http://kernelpanic.cryptid.fr/en/blog/clone-mmifare-tag-acr122u-2019) [NFC](http://kernelpanic.cryptid.fr/en/tag:NFC) [Mifare](http://kernelpanic.cryptid.fr/en/tag:Mifare) [mfcuk](http://kernelpanic.cryptid.fr/en/tag:mfcuk) ![](http://kernelpanic.cryptid.fr/images/a/e/2/f/2/ae2f2ae1e6b8e31e617f32c707818ebae21552c5-badgeentree.jpg) # TL;DR it was more tedious than expected As a proud owner of an ACR122U NFC reader, I periodically try to read the content of my own cards, out of interest. This device can only work on the 13.56 MHz and is fairly limited compared to a Proxmark3, but is much cheaper, which is also an important fact... [Continue reading...](http://kernelpanic.cryptid.fr/en/blog/clone-mmifare-tag-acr122u-2019) 26 *May* #### [Privilege escalation on OPNsense / pfSense, or why code review is necessary (CVE-2019-11816)](http://kernelpanic.cryptid.fr/en/blog/privilege-escalation-opnsense-pfsense-cve-2019) [security](http://kernelpanic.cryptid.fr/en/tag:security) [CVE](http://kernelpanic.cryptid.fr/en/tag:CVE) [OPNsense](http://kernelpanic.cryptid.fr/en/tag:OPNsense) [pfSense](http://kernelpanic.cryptid.fr/en/tag:pfSense) ![](http://kernelpanic.cryptid.fr/images/5/3/b/4/8/53b4876d428a5665f0ea0ec1d796ff80d1f0f791-programming-18738541280.png) # When pentests are not enough I am not a devoted adept of sytematic code reviews, and find that most of the time, penetration tests cover 80% of the vulnerabilities in a much shorter timeframe. Let's face it : usually, the return on investment is just much better. However, for complex pieces of sof... [Continue reading...](http://kernelpanic.cryptid.fr/en/blog/privilege-escalation-opnsense-pfsense-cve-2019) 29 *Aug* #### [Setting up remote ZFS root filesystem decryption on Arch Linux](http://kernelpanic.cryptid.fr/en/blog/archlinux-zfs-remote-encrypted-root) [sysadmin](http://kernelpanic.cryptid.fr/en/tag:sysadmin) [ZFS](http://kernelpanic.cryptid.fr/en/tag:ZFS) [mkinitcpio](http://kernelpanic.cryptid.fr/en/tag:mkinitcpio) [dropbear](http://kernelpanic.cryptid.fr/en/tag:dropbear) ![](http://kernelpanic.cryptid.fr/images/4/4/b/8/8/44b88ed49cc8078b3abdb9f5a820acf8a722de43-pexels-photo-792031.jpeg) # Apologies Dear readers, I apologize sincerely. This blog was supposed to be about security, however my first post will be related to system administration. That said, let's get our hands dirty! [Continue reading...](http://kernelpanic.cryptid.fr/en/blog/archlinux-zfs-remote-encrypted-root) #### Search #### Random Article [ I'm Feeling Lucky!](http://kernelpanic.cryptid.fr/en/random) #### Some Text Widget Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna. #### Popular Tags [NFC](http://kernelpanic.cryptid.fr/en/tag:NFC) [Mifare](http://kernelpanic.cryptid.fr/en/tag:Mifare) [mfcuk](http://kernelpanic.cryptid.fr/en/tag:mfcuk) [DVID](http://kernelpanic.cryptid.fr/en/tag:DVID) [Hardware](http://kernelpanic.cryptid.fr/en/tag:Hardware) [Bluetooth](http://kernelpanic.cryptid.fr/en/tag:Bluetooth) [security](http://kernelpanic.cryptid.fr/en/tag:security) [CVE](http://kernelpanic.cryptid.fr/en/tag:CVE) [OPNsense](http://kernelpanic.cryptid.fr/en/tag:OPNsense) [pfSense](http://kernelpanic.cryptid.fr/en/tag:pfSense) [sysadmin](http://kernelpanic.cryptid.fr/en/tag:sysadmin) [ZFS](http://kernelpanic.cryptid.fr/en/tag:ZFS) [mkinitcpio](http://kernelpanic.cryptid.fr/en/tag:mkinitcpio) [dropbear](http://kernelpanic.cryptid.fr/en/tag:dropbear) #### Archives - [ 1 April 2023 ](http://kernelpanic.cryptid.fr/blog/archives_month:apr_2023) - [ 1 March 2023 ](http://kernelpanic.cryptid.fr/blog/archives_month:mar_2023) - [ 1 November 2019 ](http://kernelpanic.cryptid.fr/blog/archives_month:nov_2019) - [ 1 September 2019 ](http://kernelpanic.cryptid.fr/blog/archives_month:sep_2019) - [ 1 May 2019 ](http://kernelpanic.cryptid.fr/blog/archives_month:may_2019) - [ 1 August 2018 ](http://kernelpanic.cryptid.fr/blog/archives_month:aug_2018) #### Syndicate [ Atom 1.0](http://kernelpanic.cryptid.fr/en/blog.atom) [ RSS](http://kernelpanic.cryptid.fr/en/blog.rss) --- ## Navigation - Children: - [Setting up remote ZFS root filesystem decryption on Arch Linux](http://kernelpanic.cryptid.fr/en/blog/archlinux-zfs-remote-encrypted-root.md) - [Cloning Mifare tags with a low budget in 2019](http://kernelpanic.cryptid.fr/en/blog/clone-mmifare-tag-acr122u-2019.md) - [DVID (Damn Vulnerable IoT Device) Bluetooth write up](http://kernelpanic.cryptid.fr/en/blog/dvid-bluetooth-writeup.md) - [Nonsense, mayhem, browser security, CSRF, and CORS - Part 1](http://kernelpanic.cryptid.fr/en/blog/nonsense-mayhem-samesite-cors-and-csrf.md) - [Nonsense, mayhem, browser security, CSRF, and CORS - Part 2](http://kernelpanic.cryptid.fr/en/blog/nonsense-mayhem-samesite-cors-and-csrf-part-2.md) - [Privilege escalation on OPNsense / pfSense, or why code review is necessary (CVE-2019-11816)](http://kernelpanic.cryptid.fr/en/blog/privilege-escalation-opnsense-pfsense-cve-2019.md)