A disjointed blog about security, engineering, open source, and linux
In an industry that often glorifies passion, innovation, and relentless optimism, there exists a darker, more prevalent, but equally powerful force: despair. Despair-Driven Development (DDD) is an unorthodox yet effective approach to software engineering that channels existential malaise, burnout, and the looming sense of impending doom into productive output. While despair is traditionally see...
It’s now easy to run custom Rego policies against your live AWS account(s) with Trivy, as of version v0.33.0. In this post I’ll run through several example policies to demonstrate how it works and hopefully give you the foundations to write your own policies. What is Trivy? Trivy is a multifunctional, open-source security scanner. It can scan various targets (filesystems, containers, git rep...
What is Trivy? Trivy is a multifunctional, open-source security scanner. It can scan various targets (filesystems, containers, git repositories and more) in order to discover security issues (vulnerabilities, misconfigurations, and secrets). In short, Trivy can find a bunch of different types of security issue in pretty much anything you point it at, for free. Scanning AWS As of this week, T...
Recently I looked into writing a custom linter for an open-source project called defsec. We had a fairly unique problem with an all-too-frequent bug. We decided if we could catch this type of bug at development time with a linter, we could not only fix things faster (instead of waiting for an integration test to fail), but we could also consistently prevent the bug from happening in the first p...
It’s been a while since I’ve done an XSS write-up, and the latest Intigriti challenge was fun, so here goes… 0x00: Initial Recon The site provided by Intigriti is a single-page application that seems fairly limited in functionality. It’s a blog site with a few entries from multiple authors. Most links don’t actually go anywhere, except for the Archives links in the sidebar, which appear funct...