https://www.thexero.co.uk/Recent content on TheXeroHugoen-gbSat, 18 Apr 2026 00:00:00 +0000https://www.thexero.co.uk/wifi/open-wi-fi-got-encrypted/Sat, 18 Apr 2026 00:00:00 +0000https://www.thexero.co.uk/wifi/open-wi-fi-got-encrypted/So you’re sitting in your local café, laptop open, and you connect to the free Wi-Fi. No password. No fuss. Job done. But underneath that seamless experience, someone — maybe someone like you — could historically be passively sniffing every single unencrypted byte you’re sending over the air.https://www.thexero.co.uk/wifi/wifiadapters2025/Sat, 13 Dec 2025 00:00:00 +0000https://www.thexero.co.uk/wifi/wifiadapters2025/One of the most common questions I still receive is: “What WiFi adapter should I use for pentesting?” Over the last 13 years, I have tested a very wide range of adapters, the good, the bad and some ugly. In this post, I will walk through my 2025 recommendations, discuss the modes that matter for pentesting, and explain how to get your adapter operational under Kali Linux.https://www.thexero.co.uk/wifi/hidden-wifi/Sat, 14 Jun 2025 00:00:00 +0000https://www.thexero.co.uk/wifi/hidden-wifi/Hidden SSIDs are one of those security measures that feel effective but provide almost no real protection against a determined attacker. Here’s why — and exactly how they’re defeated. Why Hidden SSIDs Exist (and Why They Don’t Help) When a network administrator hides an SSID, the access point stops broadcasting its name in beacon frames.https://www.thexero.co.uk/wifi/wireless-pivots/Sat, 31 May 2025 00:00:00 +0000https://www.thexero.co.uk/wifi/wireless-pivots/Even the most secure wireless deployments — including EAP-TLS with client certificate validation — can become entry points when endpoints are exploited in less secure environments. Here’s how wireless pivots work, and why your mobile devices may be betraying you.https://www.thexero.co.uk/blog/cohort-1-wrapup/Thu, 24 Apr 2025 00:00:00 +0000https://www.thexero.co.uk/blog/cohort-1-wrapup/We wrapped up Cohort 1 of the WiFi Attacks Specialist course last week and I wanted to take a moment to say thank you to everyone who joined. Twelve participants came in with varying backgrounds — some were seasoned pentesters looking to sharpen their wireless skills, others were newer to the field but hungry to learn.https://www.thexero.co.uk/wifi/breaking-eap-tls/Thu, 19 Sep 2024 00:00:00 +0000https://www.thexero.co.uk/wifi/breaking-eap-tls/TL;DR – EAP-TLS Wi-Fi Authentication in a Nutshell EAP-TLS provides strong mutual authentication using client/server digital certificates. The process includes a multi-step handshake to establish a secure session. Key vulnerabilities include username disclosure and weak certificate validation. Misconfigured devices are more often exploited than the network infrastructure.https://www.thexero.co.uk/wifi/evolution-of-wifi-security-from-wep-to-wpa3/Sun, 01 Sep 2024 00:00:00 +0000https://www.thexero.co.uk/wifi/evolution-of-wifi-security-from-wep-to-wpa3/TL;DR – Evolution of Wi-Fi Security: WEP was the first Wi-Fi security protocol but was quickly broken due to weak encryption and IV reuse. WPA introduced TKIP and better key management but still relied on the insecure RC4 cipher. WPA2 replaced TKIP with AES (CCMP), vastly improving encryption strength—though WPA2-PSK remained vulnerable to offline attacks.https://www.thexero.co.uk/wifi/enterprise-wi-fi-security/Sat, 10 Aug 2024 00:00:00 +0000https://www.thexero.co.uk/wifi/enterprise-wi-fi-security/TL;DR – Enterprise Wi-Fi Authentication Explained Enterprise Wi-Fi networks rely on the Extensible Authentication Protocol (EAP) to manage secure client access. EAP acts as a flexible framework that supports various authentication methods: EAP-TLS provides top-tier security using mutual certificate-based authentication but requires PKI.https://www.thexero.co.uk/wifi/understanding-wireless-packets-part2/Mon, 22 Jul 2024 00:00:00 +0000https://www.thexero.co.uk/wifi/understanding-wireless-packets-part2/TL;DR – Control and Data Frames in 802.11 Wi-Fi Control frames manage the coordination of transmissions (e.g., ACK, RTS/CTS, Block ACK), ensuring smooth traffic flow and collision avoidance. Block ACK improves efficiency by acknowledging multiple frames at once, reducing overhead in high-throughput environments.https://www.thexero.co.uk/wifi/wireless-packets-part1/Sat, 13 Jul 2024 00:00:00 +0000https://www.thexero.co.uk/wifi/wireless-packets-part1/TL;DR – 802.11 MAC Frame Explained The MAC frame is the foundation of Wi-Fi communication, defining how data is transmitted across the wireless medium. The Frame Control field defines type (Management, Control, Data, Extension), subtype, and critical flags like encryption (PMF), power-saving mode, and retries.https://www.thexero.co.uk/wifi/understanding-pmf-part2/Fri, 28 Jun 2024 00:00:00 +0000https://www.thexero.co.uk/wifi/understanding-pmf-part2/Before diving into the main content, let’s quickly recap the essentials of Protected Management Frames (PMF). What are Protected Management Frames (PMF)? Protected Management Frames (PMF) provide enhanced protection for various management frames in Wi-Fi networks, which are critical for the proper functioning of Wi-Fi communications.https://www.thexero.co.uk/wifi/understanding-pmf/Sun, 23 Jun 2024 00:00:00 +0000https://www.thexero.co.uk/wifi/understanding-pmf/Understanding Protected Management Frames (PMF) in Wi-Fi Before delving into Protected Management Frames (PMF), it’s essential to understand what management frames are and their role in Wi-Fi communication. What Are Management Frames? In Wi-Fi, management frames are crucial for establishing and maintaining wireless communication.https://www.thexero.co.uk/tools/pmkidhunter/Sun, 10 Mar 2024 00:00:00 +0000https://www.thexero.co.uk/tools/pmkidhunter/A lightweight Python wrapper that automates the full PMKID capture-to-crack workflow using hcxdumptool and hashcat. No client required — just the target BSSID, your interface, and a wordlist. Requirements 1 sudo apt install hcxdumptool hcxtools hashcat Usage 1 python3 pmkidhunter.py -i wlan0mon -b AA:BB:CC:DD:EE:FF -w /usr/share/wordlists/rockyou.https://www.thexero.co.uk/blog/building-a-compact-xor-encoder/Thu, 12 Nov 2020 00:00:00 +0000https://www.thexero.co.uk/blog/building-a-compact-xor-encoder/If you’ve been through the Worldmail exploit write-up or spent any time developing shellcode, you’ve run into bad characters. NULL bytes that kill your TCP connection. Characters that get mangled by string functions before they ever reach your buffer. Values that simply don’t survive the journey from your machine to the target.https://www.thexero.co.uk/exploit-development/worldmail-exploit/Sat, 09 May 2020 00:00:00 +0000https://www.thexero.co.uk/exploit-development/worldmail-exploit/If the stack-based buffer overflow is where exploit development starts, Structured Exception Handler overflows are where it gets more interesting. The primitive is similar — overflow a buffer, control execution — but the path from crash to shell is a few steps longer, and the constraints are tighter.https://www.thexero.co.uk/exploit-development/abusing-the-stack/Sun, 26 Apr 2020 00:00:00 +0000https://www.thexero.co.uk/exploit-development/abusing-the-stack/Stack-based buffer overflows are the foundational technique of Windows exploit development. If you’ve never written one, this is the right place to start. We’ll go from a crash all the way to popping a shell. The Target For this walkthrough, we’re using a deliberately vulnerable Windows application.https://www.thexero.co.uk/blog/corelan-advanced-exploit-development/Sat, 07 Dec 2019 00:00:00 +0000https://www.thexero.co.uk/blog/corelan-advanced-exploit-development/People had warned me. “It’s 9am to 9pm,” they said. “You won’t sleep much.” They weren’t wrong. Three days of Corelan Advanced Exploit Development in Sydney — one of the most well-regarded exploit development courses in the industry. If you’re considering it and wondering whether it’s worth the time, the money, and the sleep deprivation, here’s an honest breakdown of everything covered.https://www.thexero.co.uk/tools/nullsploit-engine/Fri, 03 May 2019 00:00:00 +0000https://www.thexero.co.uk/tools/nullsploit-engine/Metasploit is great. It’s also a black box that a lot of people use without ever thinking about what’s happening underneath. nullsploit exists for the opposite reason — to build an exploitation framework from scratch, understand every moving part, and end up with something that’s genuinely useful for demonstrating the impact of unpatched vulnerabilities to clients who need to see it to believe it.https://www.thexero.co.uk/blog/housing-technology-interview/Thu, 28 Sep 2017 00:00:00 +0000https://www.thexero.co.uk/blog/housing-technology-interview/Housing providers hold a significant amount of sensitive personal data — tenant records, financial information, maintenance histories — and increasingly rely on digital systems to deliver critical services. Cybersecurity in this sector doesn’t always get the attention it deserves. Housing Technology magazine asked me to share my thoughts on what housing providers should be considering when it comes to cybersecurity and data protection.https://www.thexero.co.uk/advisories/sems-heap-memory-corruption/Tue, 07 Jun 2016 00:00:00 +0000https://www.thexero.co.uk/advisories/sems-heap-memory-corruption/Note: LDAPS Service Heap Memory Corruption vulnerability in SEMS <= 3.3.2 MP12 allowing for reads to from or writes to a memory location outside the buffer’s intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.https://www.thexero.co.uk/advisories/sems-privesc/Tue, 07 Jun 2016 00:00:00 +0000https://www.thexero.co.uk/advisories/sems-privesc/Note: Local Privilege Escalation vulnerability in SEMS <= 3.3.2 MP12 allowing for escalations of privileges to that of the root superuser. Summary The tomcat users on an affected Symantec Encryption Management Server (SEMS) is susceptible to privilege escalation vulnerability resulting an gaining root privileges.https://www.thexero.co.uk/advisories/sems-command-exec/Tue, 07 Jun 2016 00:00:00 +0000https://www.thexero.co.uk/advisories/sems-command-exec/Note: OS Command Injection vulnerability allows command execution on the underlying operating system. Summary The management console for Symantec Encryption Management Server (SEMS) is susceptible to potential OS command execution vulnerability. Affected Versions Symantec Encryption Management Server <= 3.3.2 MP11 CVSSv3 Score 9.https://www.thexero.co.uk/blog/conscan-updated/Sat, 07 Jun 2014 00:00:00 +0000https://www.thexero.co.uk/blog/conscan-updated/ConScan has been updated. If you’ve been using the Concrete5 black-box scanner since its initial release last October, version 1.2 adds two features that meaningfully expand what the tool can do against a target. What’s new in v1.2 Username disclosure — ConScan can now enumerate valid usernames on a target Concrete5 installation.https://www.thexero.co.uk/tools/conscan-updated/Sat, 07 Jun 2014 00:00:00 +0000https://www.thexero.co.uk/tools/conscan-updated/ConScan has been updated. If you’ve been using the Concrete5 black-box scanner since its initial release last October, version 1.2 adds two features that meaningfully expand what the tool can do against a target. What’s new in v1.2 Username disclosure — ConScan can now enumerate valid usernames on a target Concrete5 installation.https://www.thexero.co.uk/blog/bsides-london-exploit-development/Sun, 04 May 2014 00:00:00 +0000https://www.thexero.co.uk/blog/bsides-london-exploit-development/BSides London 2014 was a milestone for me. Not because of the conference itself — though it was great — but because it was the first time I’d stood in front of a room full of people I’d never met and tried to teach them something I genuinely cared about.https://www.thexero.co.uk/tools/concrete5-cms-vulnerability-scanner/Sat, 26 Oct 2013 00:00:00 +0000https://www.thexero.co.uk/tools/concrete5-cms-vulnerability-scanner/Web application pentests almost always involve a CMS. WordPress, Drupal, Joomla — the big names have decent tooling. But spend enough time in this space and you’ll run into less common platforms that don’t have the same coverage. When you do, you’re either doing everything manually or building something yourself.https://www.thexero.co.uk/advisories/dexs-pm-system-vulnerability/Mon, 14 Oct 2013 00:00:00 +0000https://www.thexero.co.uk/advisories/dexs-pm-system-vulnerability/Note: Stored XSS vulnerability in the DEXs PM System WordPress plugin v1.0.1 allows attackers to inject malicious JavaScript via the message subject field with potential for full WordPress admin compromise. Summary WordPress plugin vulnerabilities are one of those areas where a bit of curiosity during downtime can turn into a real finding.https://www.thexero.co.uk/tools/ssl-private-key-password-cracker/Sat, 31 Aug 2013 00:00:00 +0000https://www.thexero.co.uk/tools/ssl-private-key-password-cracker/Real pentesting doesn’t always look like the tutorials. Sometimes you’re mid-engagement, digging through an exposed directory, and you find something that makes you stop and think: that really shouldn’t be here. That’s exactly what happened here. The scenario During a client engagement, an undisclosed directory was discovered on an HTTP server — the kind of thing that only shows up if you’re thorough with your enumeration.https://www.thexero.co.uk/tools/http-enum/Mon, 15 Apr 2013 00:00:00 +0000https://www.thexero.co.uk/tools/http-enum/Web server enumeration is one of those tasks that every pentester does, but almost nobody enjoys doing manually. Checking HTTP methods, looking for enabled WebDAV, hunting for server-status pages, poking at FrontPage Extensions — it’s repetitive, time-consuming, and easy to miss something when you’re doing it by hand across multiple targets.https://www.thexero.co.uk/blog/bypass-aslr/Sun, 15 Apr 2012 00:00:00 +0000https://www.thexero.co.uk/blog/bypass-aslr/So you’ve worked through the stack overflow. You’ve got EIP control. You’ve confirmed your shellcode executes cleanly in the lab. Then you take that exploit and point it at something compiled with modern protections — and it falls apart. Welcome to ASLR.https://www.thexero.co.uk/tools/tftp-fuzzer/Sun, 25 Mar 2012 00:00:00 +0000https://www.thexero.co.uk/tools/tftp-fuzzer/Most people learning pentesting focus on TCP. Makes sense — HTTP, FTP, SMB, that’s where a lot of the action is. But UDP protocols are a different beast, and they’re often overlooked. That’s exactly why they’re interesting. What is TFTP and why should you care?https://www.thexero.co.uk/tools/ftp-fuzzer/Fri, 27 Jan 2012 00:00:00 +0000https://www.thexero.co.uk/tools/ftp-fuzzer/If you want to find vulnerabilities in software, fuzzing is one of your best friends. The idea is simple: you throw a massive amount of unexpected, malformed, or just plain weird input at an application and watch what breaks. No source code required.https://www.thexero.co.uk/wifi/episode-5/Sun, 14 Nov 2010 00:00:00 +0000https://www.thexero.co.uk/wifi/episode-5/Hidden SSIDs come up constantly in conversations about WiFi security. The idea is straightforward: if your network isn’t broadcasting its name, attackers can’t find it. Problem solved. Except it isn’t. Not even close. A hidden SSID is what’s sometimes called security through obscurity — the belief that concealment is a substitute for actual security controls.https://www.thexero.co.uk/wifi/episode-4/Fri, 29 Oct 2010 00:00:00 +0000https://www.thexero.co.uk/wifi/episode-4/If you’ve worked through Episode 2 and Episode 3, you can already crack WEP. The question this episode answers is: how do you do it faster? IV generation rate is the bottleneck in every WEP attack. You need enough IVs for aircrack-ng to do its thing, and how quickly you collect them depends entirely on how much traffic you can force the AP to generate.https://www.thexero.co.uk/wifi/episode-3/Sun, 19 Sep 2010 00:00:00 +0000https://www.thexero.co.uk/wifi/episode-3/If you’ve watched Episode 2, you know how to crack a WEP network using the clientless ARP replay attack. Good. Now let’s talk about what happens when you run into a WEP network that doesn’t behave the same way. WEP networks can be configured with one of two authentication methods: Open Authentication or Shared Key Authentication (SKA).https://www.thexero.co.uk/wifi/episode-2/Fri, 10 Sep 2010 00:00:00 +0000https://www.thexero.co.uk/wifi/episode-2/WEP is dead. Has been for years. The cryptography is fundamentally broken — not “weak with a long enough password” broken, but mathematically impossible to secure broken. No configuration, no complexity, no passphrase length fixes it. And yet. It still shows up.https://www.thexero.co.uk/wifi/episode-1/Sun, 29 Aug 2010 00:00:00 +0000https://www.thexero.co.uk/wifi/episode-1/Every wireless pentester has to start somewhere. This is that somewhere. Before you worry about WPA3, enterprise attacks, rogue APs, or EAP-TLS — you need to genuinely understand why WPA2 Personal is fundamentally broken by design. Not just that it can be cracked.https://www.thexero.co.uk/about/Mon, 01 Jan 0001 00:00:00 +0000https://www.thexero.co.uk/about/About Toby Reynolds I’m a penetration tester. I develop exploits. I’m a wireless security expert and trainer. I have more than ten years of hands-on research experience. I’ve spent years studying protocols. I’ve also explored binaries and wireless stacks. This site is where I share what I’ve learned.