Vulnerability Management in the age of AI
Agents accelerate vulnerability management, but only when the foundations are already in place.
bernardoamc RSS
Bernardo's brain dump.
Latest posts
kamal-proxy security audit
Security audit of kamal-proxy's Docker container.
kamal-proxy deep dive
An exploration on how kamal-proxy works under the hood.
Thoughts on using AI
My thoughts on the double-edged nature of AI and how to approach it.
Sustainable Vulnerability Management
Surfacing risk sustainably, without burning out your organization.
Vulnerability Management Pitfalls (and How to Avoid Them)
Discover the most common pitfalls faced by Vulnerability Management teams and how to avoid them.
Cybersecurity Awareness Month CTF reversing challenge
Reversing the fryer binary from the Cybersecurity Awareness Month CTF with GDB and some C, because why not?
Thoughts on burnout
Patterns that may lead to burnout
Reverse Engineering Tips
Going over commands that helped me reverse engineer a binary or two.
Communicating technical projects
How to communicate technical projects with a broader audience?
Prometheus onboarding
Let's go over concepts that can make using Prometheus more intuitive as a new user.
Seeking context for better outcomes
How seeking context can produce better outcomes on decision making.
Cody's First Blog writeup
Writeup for the Hacker101 CTF challenge Cody's First Blog
Photo Gallery walkthrough
Writeup for the Hacker101 CTF challenge Photo Gallery
Encrypted Pastebin walkthrough
Writeup for the Hacker101 CTF challenge Encrypted Pastebin
Micro-CMS v2 walkthrough
Writeup for the Hacker101 CTF problem Micro-CMS v2
Hacker101 CTF and Micro-CMS v1 walkthrough
Introduction to the Hacker101 CTF through the Micro-CMS v1 challenge
Application Security and product teams
Or what could AppSec learn from product teams?
Offensive Security Web Expert (OSWE) certification
A recap on my journey through the OSWE certification
Watch out for teams under high utilization
A deep dive on how teams under high utilization are negatively impacted and how to spot this pattern in your own teams
Gatekeeping in the software industry
What is gatekeeping and when can it lead to a positive outcome?
Memory leak in Rack middlewares
How a memory leak within one of our middlewares exposed user sessions across requests.
Insecure Software Development
A tale of software development and hidden complexity
Mathematically solving Advent of Code 2021 day 06
Where we end up using matrices and exponentiation by squaring to model a linear recurrence.
ECBC algorithm
Let's investigate MACs built using block ciphers by learning about the ECBC algorithm.
Investment Planning
Reasoning about investment planning as a manager
Introducing static application security testing (SAST) to an organization
Is implementing SAST in your organization as simple as it looks?
Pair Programming 101
How to implement productive pair programming sessions?
Message Authentication Code (MAC)
What is a Message Authentication Code and what is it used for?
Breaking CTR with fixed nonce
In this post we will investigate how multiple ciphertexts encrypted with a fixed nonce in CTR mode can be attacked.
CTR mode introduction
In this post we will investigate how encrypting and decrypting in CTR mode works.
CBC - Recovering the key when the IV and the key are the same
In this post we will investigate how this seemingly innocuous idea of using our key as the IV can be exploited to leak the key under certain conditions.
Ensuring postMessage Origin Validation with Semgrep
Let's explore how we can validate postMessage declarations in our JavaScript or TypeScript codebases.
A Practical Introduction to Semgrep
Let's explore this modern static analysis tool and how it allows us to identify patterns in our code for linting or security purposes.
CBC Padding Oracle
Exploiting CBC Padding Oracle
CBC bit-flipping attack
Let's understand and implement the CBC bit-flipping attack.
ECB Cut and Paste Attack
Let's exploit ECB yet again, this time through the cut and paste attack.
Discovering ECB block sizes
How do we figure out the block size of a message encrypted with ECB?
ECB decryption (Simple)
Decrypting ECB a byte at a time
Repeating-key XOR II
Given that we are using repeating-key XOR, how do we figure out the length of an unknown key?
Repeating-key XOR
Implementing and breaking the repeating-key XOR algorithm
Management during an ambitious team expansion
As a manager, what should we pay attention to when we have a successful team that is expanding rapidly?
Technical mentorship
What I consider a good technical mentorship?
Content curation
Thoughts on content curation as a way to mitigate content overload.
Leadership styles
A take on different leadership styles and what I consider a healthy balance.
Digital country
Learning and mentoring through our new digital context.