About
Hey!
I am a Cybersecurity Professional working in Auckland, New Zealand. Passionate about Cyber Security, this blog documents my learning process as I strive to further develop my skills and knowledge.
This blog simply serves as a record of the new things I’ve learned, and experiences I’ve gained.
I hope you join in to discuss, learn and help me along the way.
Kento
Highlights
A collection of recent or popular blog posts
Finding and Disclosing My First CVE’s
CVE’s, short for Common Vulnerabilities and Exposures, are a reference model for publicly known security vulnerabilities. Whenever a vulnerability is identified and disclosed, a new CVE can be requested and issued to document this vulnerability. Over time, as countless vulnerabilities have been discovered and documented, CVE’s have become the de facto method to classify vulnerabilities…
Spoofing an Android Phone to Exploit the Razer Local Privilege Escalation Vulnerability
Intro Last Sunday, on a particularly lazy afternoon, I came across a Tweet that caught my attention. It was a demonstration of a local privilege escalation vulnerability that is possible when plugging in a Razer device to any Windows machine. The TL;DR of this vulnerability is that Windows identifies the drivers and software required for…
Pivoting Through Internal Networks with Sshuttle and Ligolo-ng
“Pivoting” is the method used to navigate throughout a network, by using a compromised “foothold” host to gain access to other internal networks and network components that otherwise wouldn’t have been accessible directly. In most networks, there will be various network segments that will contain different servers or devices of interest. It is therefore an…
CVE-2021-40444 PoC Demonstration
Introduction This week, a new zero-day vulnerability was disclosed affecting Microsoft Office applications. CVE-2021-40444 made waves throughout the cybersecurity industry for its ability to perform remote code execution on Windows operating systems with minimal interaction from the user. By simply opening a specially crafted Microsoft Office document, remote code execution could be obtained. Within a…
How I Passed the CISSP Exam in 6 Weeks
Around the middle of January, I decided to commit to studying for the Certified Information Systems Security Professional (CISSP) exam. The CISSP was something that had sat on my list of goals for at least the last few years, and I finally made the call to dedicate the required time and effort into passing this…
How To Pass the OSCP – a Beginner Friendly Guide
I wanted to make this post detailing everything I did when studying for the OSCP examination. I made a lot of mistakes along the way, and my path was far from the most efficient or effective method for studying toward the OSCP. Nevertheless, I did learn something from every resource listed here and I strongly…
Preparing for and Delivering My First Conference Talks
In July last year, I took a big step outside of my comfort zone and delivered two talks at local New Zealand cyber security conferences. These talks were a big highlight of my 2022, and I haven’t had the chance to fully reflect on my experience preparing for and delivering the talks. While we’re still…
Follow Me
Get new content delivered directly to your inbox.
KentoSec 