jgamblin

I just spent a day and a half recovering my Github account after the code in my 2FA application stopped working for authentication. GitHub has a good support article on how to recover your account that has this ominous warning on it: Warning: For security reasons, GitHub Support may not be able to restore access … Read more

About once a month I need a Kali VM to use for an hour or so, and I am terrible at keeping a VM up-to-date, so this weekend I took a few hours and built a tool to download automatically, provision and update a Kali Linux VM in Virtualbox. All the code for this project … Read more

Recently I have been working on a project to use the Trivy container scanner to scan large swath of containers for open vulnerabilities that I wanted to quickly post here. There is a full blog about the project here on the Kenna site. Here are some of the pages I have built out so far: … Read more

I had the chance to attend LoCoMoCoSec this year and had a fantastic time. It was a well-run conference that was extremely focused on being friendly for families and being inclusive of the diverse group of people who make up our community. It also doesn’t hurt that it was in one of the most beautiful … Read more

With the 2019 RSA Conference fastly approaching I thought I would take a few minutes and put together a quick list of what I am excited to see this year. Sunday BSides San Francisco How to Build an Application Security Program (Presenting) Automating Web Application Bug Hunting (Presenting With @JCran) Monday RSAC Innovation Sandbox Contest … Read more

Bundle Audit is a great tool to check if the Ruby Gems used in your project have any known vulnerabilities. Most DevOps teams I know run this tool against their builds in their CI/CD process when deploying. This can mean that code that is not updated often can have vulnerable gems unless you have a … Read more

I have developed a bad habit of picking up vanity domain names and not really doing much with them. Last month at AWS Re:Invent I picked up ServerlessSecurity.org and really wanted to do something with it but didn’t feel like maintaining, or paying for, a VPS so after doing some looking around I found that … Read more

Here is a list of my favorite security books from 2018 if you are looking for that last minute gift or have some extra time around the holidays to catch up on some reading.   The GCHQ Puzzle Book 2 I just got The GCHQ Puzzle Book 2, and like the original, it has quickly become the … Read more

I spent this last week in Las Vegas attending AWS Re:Invent.  This event is mind-numbingly massive with classes happening at 4 or 5 hotels all over the strip. I personally spent over an hour every day on their (nice but extremely slow) shuttle buses between the MGM Grand, Aria and the Sands Expo Center. It … Read more

I have started using the Burp Suite 2.0 beta full time recently, and some of the new features I knew I wanted to explore more was the API and the CI Integration.   I took a few hours this last week and built a small POC shell script that will scan a website and open Github Issues for all … Read more