some blog posts you will hopefully enjoy reading RSS Feed / Atom Feed Most recent posts {{ posts|order:desc }}...
Intro The DPRK and over-employment enjoyers have made extensive use of IPKVMs to juggle access to multiple employers' networks while collecting a comfortable upper-middle-class salary. I have no qualms with the latter's behavior (as long as the work is being completed), but the use of an IPKVM starts to make the latter look like the former. There have been a few excellent posts 1 on detecting…
Intro/Predictions I believe that LLMs will substantially alter the threat detection landscape within a few years. Well-funded infosec programs will, without a doubt, have LLM agents actively threat hunting in their environments 24/7/365. All serious threat detection products will incorporate LLM-based detections into their offerings (probably poorly, but still). If you’re in the threat detection…
The Problem Do developers at your organization utilize VSCode and have free rein to do whatever they want? Then this article is for you! With the recent uptick in supply chain attacks targeting VSCode extensions 1 , I decided to figure out how to baseline and detect new extension installations. Detection VSCode extensions are typically installed in the user's directory located at…
Intro Companies in America continue to push for a return to the office at high rates. There has been much speculation on the reasoning behind this—ranging from boosting worker productivity, to forcing resignations, to uplifting the retail office real estate market. The truth, as usual, is likely a combination of many different factors. But what if one of the main drivers is the health and security…
Intro: Back in April I participated in the US Department of Energy's cyber defense competition. The competition is strictly collegiate and is held once a year. This is the third year for the competition and it was bigger than ever. Twenty-five colleges from around the nation sent undergrad and grad students to one of three DOE labs: Argonne, Oak Ridge, and Pacific Northwest. Each team was tasked…
Intro: I was recently rewarded a VERY generous bounty for finding an exposed /.git/config on a server owned by a fairly large name in the cryptocurrency mining scene. The vulnerability was trivial and any greenhorn infosec enthusiast such as myself could have found it within Recon via DNS: From my previous article I'm sure you all know that I absolutely love using Aquatone. It gathers a list of…
Intro In this article I'm going to show you how to use aquatone to find subdomains and perform takeovers. A subdomain takeover involves finding a subdomain with a DNS entry that is pointing at services such as AWS, CloudFront, or Unbounce but is not claimed within the service. This allows anyone with an account on one of these services to claim the subdomain. The most common occurrence of a…