WordPress userdata extractor

by

I’ve created a simple Python based utility to extract WordPress userdata. It is now available at my Github profile here. How it works then? The utility relies and uses nothing but publicly available information of any WordPress website. It is provided neatly by WordPress provided REST API which can be then used for the described … Read more

What can be faked, anyway? Mostly anything

by

Deepfakes have been around now for a while but it seems that people are still failing to understand how easy and fast it is to fake any kind of information. This is just a quick summary and a reminder that e.g. screenshots of people’s tweets should not qualify for a newspaper neither screenshots about SMSes or emails for evidence in court.

Read more

How to scam 26 thousand people with “LEAF Healthcare” face masks that don’t exists

by

Well, this is surprisingly easy to do with simple marketing and photo-manipulation, and then you’ll have about 4.4M USD out of which 3.3M USD is currently frozen by the Indiegogo crowdfunding platform, which is still quite a lot of money. The point is, that with simple fact checking a lot of this damage could’ve been avoided, and many future legal processes.

Read more

5 different ways to counter Cloudflare DDoS protection

by

Cloudflare is a company known very much for its great DDoS protection services which are able to mitigate great attacks against online services, technically by providing such service with a reverse proxy technique which also hides the IP address of the server behind the reverse proxy.

In this post, I’ll describe some of the most common pitfalls end-users of this service face. Hopefully, this information helps some OSINT researchers, journalists, and sysadmins to secure their websites.

Read more

Finnish Institute for Health and Welfare (THL) shares your COVID-19 letter complaints with an insecure direct marketing company

by

Finnish Institute for Health and Welfare (THL) has asked SSM Suomen Suoramainonta to deliver a letter about the best practices against the COVID-19. However if you never received such a letter like I didn’t, you could’ve complained about it in the address provided by THL in their own blog post. Unfortunately I think I’m going to pass this one. This is mainly because of 3 reasons.

Read more