Security BSidesLjubljana 2016 is coming

We are only two days away from Conference BSidesLjubljana. Community of information security enthusiasts is organizing again the conference, which will take place on March 9, 2016. Schedule is up with promising talks. For those participants who find security a little more exciting CTF will be available. More information at https://bsidesljubljana.si/

ELK stack for Hackers

We can image a face of a person in a CFP review board that sees our paper submitted to a conference. “Oh no, another Wi-Fi talk”. But after reading it through one can see Wi-Fi from a different angle. We are presenting a way how to cross from terminal output of Wi-Fi packets to big data and visualization.



We are proud to share our knowledge in first Slovenian documentary film about hackers. Do they really exist in Slovenia? Who they are? What is their motivation?

The TV premiere will be on December 17, 2015 on channel TV SLO 2 at 8 PM.


[1] http://www.hekerji.si/

Using CloudFlare and still leaking real IP address?

Recently I ran across interesting challenge. Some friends had problems with their service. Providing brand new service and having someone on the other side executing DDoS this service is not very promising beginning for some startup. Therefore, I decided to tackle this challenge and at the end it was not very hard to find leakage.


Big week for Viris

Two conferences in two days!

Milan Gabor is proud to be a speaker at DeepSec 2015 Conference that will take place in Vienna starting tomorow. Milan’s presentation will be about Visualizing Wi-Fi Packets the Hacker’s Way.

At the same time Danijel Grah will have speach at DefCamp 2015 Conference in Bucharest. He will present ELK stack for Hackers.

I know what you forgot last summer – DNS

After preparing and organizing some CTF events we discovered that players struggle at a particular task.  Often forgotten to look at it, but it is a must do in every penetration test. We are talking about a misconfigured DNS server that allows zone transfers from any source. This post is not about explaining details of a zone transfer, but rather about how to initiate one in Linux or Windows and if you want to learn more look DNS zone transfer. (more…)

BalCCon 2k15 CTF

Viris is proud to be the organizer of CTF (Capture the Flag) competition at BalCCon 2k15 security event that lasted from September 11th till 13th, 2015.  CTF competition was designed from pentester perspective where the ultimate goal was to take over BigFish’s Domain Controller. Besides real and legit hacking of the virtual environment, where flags were hidden in the form of security vulnerabilities, warm up tasks had been provided for challengers that didn’t want to get dirty.

Competition was heating up second day where we had couple of groups hacking as crazy. After two long nights there have been quite some challenges also for us as organizers, but we managed to solve them after all.

The grandmasters of CTF at BalCCon 2k15 are Hetti and cluosh. (more…)

Someone else’s trash is another man’s treasure

Everyone in a company is responsible for company’s data security. A company can spend billions of dollars on all kinds of security equipment, but it only takes one person for company’s security to be compromised [1].


Wi-Fi security in Ljubljana

Here is a short story about access points (AP). We were wardriving through Ljubljana with a mission to analyze the security of Ljubljana’s Wi-Fi network. Our focus was collecting information about different authentication types in use. The goal was to capture a representative set of information about AP’s so that some assumption about security of Wi-Fi could be given. The only hardware we used was our Android mobile phone with the great Wigle Wifi Wardriving Android application. We already had a large database and we combined it with a smaller one that was obtained fresh from wardriving. The next step was to narrow down the area. Wigle Wifi app stores information about AP’s in a local SQL-lite database, so limiting the area was a piece of cake. (more…)

Security BSides Ljubljana Real-CTF

In the spirit of Security BSides Ljubljana 2015 there was CTF contest titled Real-CTF. Why choose such a title? Because it was designed like a virtual company with lots of vulnerabilities. Of course, the number and impact of vulnerabilities were enhanced so that the playground area was spread in X in Y axis of fun. Here is a short write up.