Pentagrid AG

IKEA produces smart home devices and their newest generation uses the central DIRIGERA smart hub . After extracting the firmware, we started hunting for vulnerabilities of the device and found: An unauthenticated attacker on the network can download large

While this would not be anything out of the ordinary, the environment certainly was. So where do we expect ASP.NET Core Identity hashes? Some obscure cloud application, local Windows application, ... but surely not on an embedded linux system!? While the

At Pentagrid, we occasionally review our clients' internal processes to identify IT security risks. When we discovered that large sums of money are transferred with just a few clicks and no transaction verification, we helped securing the process. At the

Recently we've been tasked to do an analysis of a web application firewall (WAF) of the vendor Ergon, namely the Airlock WAF regarding the effectivness of filtering. One idea was to see what happens when OWASP Core Rule Set (CRS) tests are run against it.

Hackvertor ist ein Standalone-Werkzeug und eine Erweiterung für das Penetrationstest-Tool Burp Suite . Gareth Heyes vom Portswigger Research Team hat Hackvertor entwickelt. Die Erweiterung führt dynamische Datenkonvertierungen durch. Das Tool kann beispie

In 2023, there was an attack on the Russian chat platform jabber.ru. The attack was going on for half a year from April to October and targeted three servers from the jabber.ru network operated at the hosting providers Hetzner and Linode in Germany. A lat

A hotel check-in kiosk application crashed when entering a single quote into the guest search, which enabled access to the Windows Desktop. The terminal uses the Ariane Allegro Scenario Player.

Ein Threat-Modelling-Workshop verschlug uns an einen entfernt gelegenen Ort mit neuem Hotel. Das Hotel war so klein, dass es kein Personal für den Check-in gab, dafür aber ein Selbstbedienungs-Terminal für den Check-in. Es passierte, was passieren musste.

An IBIS hotel check-in terminal leaked room door key codes of almost half of the rooms.

Nach einem Hackerkongress in Hamburg stellte Pentagrid fest, dass ein Check-in-Terminal eines IBIS-Budget-Hotels die Tastencodes von fast der Hälfte der Hotelzimmer preisgab, wenn ein Benutzer nach einer bestimmten Form einer nicht alphanumerischen Buchun