Curiosity in Practice
One of the first things I like to do when I start looking at a PCAP during an investigation is run it through snort to see if it finds anything suspicious. You can easily do this at the command line with snort -dv -r test.pcap but the output is not great. I have been using a tool called … Read more
I took some time tonight and read through the Security Summer Camp (BSidesLV, Blackhat and Defcon) schedules and picked the talks from this year that I think will be the best and that I do not want to miss. I ended up with these 16 talks I am going to make a special point to see next week: BSidesLV … Read more
Security Summer Camp (BSidesLV, Blackhat and Defcon) is the most important week in the security industry and as such you need to be prepared to network like a professional. Here are 6 things you can do this week to get ready: Freshen Up Your Social Media Profiles Is your twitter profile picture 4 years old? Does your twitter … Read more
There has been a lot of talk about why you should use a VPN on public networks and why it shouldn’t be a commercial one. I am a huge fan of the Streisand privacy stack because it includes and L2TP/IPsec VPN, OpenConnect, OpenSSH, OpenVPN, Shadowsocks, sslh, Stunnel, and a Tor bridge all in one amazing package. The problem … Read more
I worked with a consultant using the lair framework two years ago and since then I have been a huge fan of the project to manage pentest information. Tom Steele has done an amazing job with the project but it has been a pain to install but thanks to Ryan Hanson and Docker you can now setup a lair instance with 7 … Read more
A picture started floating around the internet of Mark Zuckerberg holding an Instagram cutout: People almost instantly started to notice that his webcam and mic were taped over. While Mark Zuckerberg isnt exactly known for having great security practices, all his social media passwords were Dadada. This started a discussion in the office if someone … Read more
While rebuilding my iPad this weekend I noticed that I could name it an emoji. So I named my iPad 📱(U+1F4F1): While I don’t have any problem using the iPad it basically makes it unreachable on the network via hostname. From there I renamed all of my lab machines emojis. Mostly variations of 💩 (U+1F4A9) because I … Read more
While getting ready to teach an “introduction to penetration testing with docker ” class I stumbled across the Shipyard-Project which brings an amazing web based interface to docker. Installing on Debian on DigitalOcean is as simple as starting a droplet and running these two commands: curl -sSL https://get.docker.com/ | sh curl -sSL https://shipyard-project.com/deploy | bash -s Update: Running scripts … Read more
Docker containers have become so ubiquitous sometimes respected security professionals tweet ridiculous things like: docker run -u zap -p 8080:8080 -p 8090:8090 -i owasp/zap2docker-stable zap-webswing.sh http://localhost:8080/?anonym=true&app=ZAP — Jerry Gamblin (@JGamblin) June 7, 2016 …but it is 2016 and you should never run code on your machine if you don’t know what it does. These are mini-virtual machines … Read more
I built a simple TOR socks proxy container today to be able to easily use TOR to machines I am working on. Getting it to run is as simple as: docker run –name tor -ti -p 9050:9050 jgamblin/tor This will run it as a daemon: docker run –name tor -ti -p 9050:9050 jgamblin/tor From there all you … Read more