Archive

NewsletterNewsletter
[tl;dr sec] #136 - Career Advice, Scaling AppSec at Netflix, BSidesSF Summaries

[tl;dr sec] #136 - Career Advice, Scaling AppSec at Netflix, BSidesSF Summaries

Many career resources, lessons learned scaling AppSec at Netflix, 5 mini summaries I wrote of BSidesSF talks.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #135 - BSidesSF, Google's Cloud Forensics Utils, Running Bug Bounty Programs

[tl;dr sec] #135 - BSidesSF, Google's Cloud Forensics Utils, Running Bug Bounty Programs

Let's hang out at BSidesSF, Google's Python library to do DFIR across major clouds, Braze and GitHub on running bug bounty programs.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #134 - DevSecOps, Scalable Canary Tokens, Learning from AWS Customer Security Breaches

[tl;dr sec] #134 - DevSecOps, Scalable Canary Tokens, Learning from AWS Customer Security Breaches

Useful ways to think about modern security teams, how to scale honeytokens while maintaining server level attribution, and how to harden your AWS environment based on public breaches.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #133 - Hunting Evasive Vulnerabilities, eBPF, Fuzzing

[tl;dr sec] #133 - Hunting Evasive Vulnerabilities, eBPF, Fuzzing

James Kettle on finding subtle bugs and bug classes, eBPF-related tools and backdoors, fuzzing Golang, malware, and getting higher coverage.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #132 - Application Hacking Methodology, Pwning Cloudflare Pages, Why You Should Be Blogging

[tl;dr sec] #132 - Application Hacking Methodology, Pwning Cloudflare Pages, Why You Should Be Blogging

Jason Haddix's new Bug Hunter's Methodology for apps, write-up of a series of Cloudflare Pages bugs, Jack Rhysider on the power of blogging.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #131 - Compromising Read-Only Containers, Finding 0days in Enterprise Software, Evading Industry Leading EDR

[tl;dr sec] #131 - Compromising Read-Only Containers, Finding 0days in Enterprise Software, Evading Industry Leading EDR

A walkthrough of how to attack read-only containers, Shubham Shah on taking apart complex proprietary software, how your shellcode can evade top EDR products.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #130 - Project Zero on 0day Trends, ThinkstScapes, How Do You Actually Find Bugs?

[tl;dr sec] #130 - Project Zero on 0day Trends, ThinkstScapes, How Do You Actually Find Bugs?

Maddie Stone on 2021 0day trends, Thinkst's excellent research round-up, Mark Dowd OffensiveCon keynote on security research

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #129 - Maximizing Bug ROI, Tamper-proof GitHub Builds, Being Vulnerable

[tl;dr sec] #129 - Maximizing Bug ROI, Tamper-proof GitHub Builds, Being Vulnerable

How Flipkart gets the most value from every vulnerability, setting up a SLSA 3 GitHub Action build process, the power of being vulnerable.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #128 - Security Engineering, CI/CD Goat, Docker Security Playground

[tl;dr sec] #128 - Security Engineering, CI/CD Goat, Docker Security Playground

How Chime empowers developers to own security via internal tools, purposefully vulnerable CI/CD exercises, a microservices-based framework for learning network security.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #127 - Trufflehog V3, The Future of InfoSec, IaC Scanning

[tl;dr sec] #127 - Trufflehog V3, The Future of InfoSec, IaC Scanning

The revamped secret scanner now is faster and finds more secrets, future projecting where the industry is headed, and security scanning infrastructure as code.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #126 - How to Review Your Company's Infrastructure, Kubernetes DFIR, Security for Start-ups

[tl;dr sec] #126 - How to Review Your Company's Infrastructure, Kubernetes DFIR, Security for Start-ups

How to review the security architecture of a multi-cloud environment and find the most critical components, responding to incidents in k8s, advice for start-ups without a security team.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #125 - Hacking a Billionaire, Automating Incident Response in AWS, Exploiting/Hardening GitHub Actions

[tl;dr sec] #125 - Hacking a Billionaire, Automating Incident Response in AWS, Exploiting/Hardening GitHub Actions

Rachel and Evan Tobac vs. Jeffrey Katzenberg, a framework for automatically isolating an EC2 instance and gathering what you need, attacking and hardening GitHub Actions and repos.

Clint Gibler
Clint Gibler
FirstBack
910111213141516
Next Last