Archive

NewsletterNewsletter
[tl;dr sec] #181 - Awesome CloudSec Labs, Red Team Infra in 2023, Privilege Escalation in EKS

[tl;dr sec] #181 - Awesome CloudSec Labs, Red Team Infra in 2023, Privilege Escalation in EKS

Free cloud-native security learning labs, the essential components for modern robust red teaming infra, how to privesc from a compromised EKS pod and defeat Kubernetes NodeRestriction.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #180 - Scaling AppSec, tl;dr sec Swag 🤯, GCP Pentesting Guide

[tl;dr sec] #180 - Scaling AppSec, tl;dr sec Swag 🤯, GCP Pentesting Guide

Riot Games and Segment on Scaling AppSec, help me decide what tl;dr sec swag to make, resources and techniques to do an effective GCP pentest.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #179 - BSidesSF Summaries, Attacking Kubernetes, OpenAI Burp Suite

[tl;dr sec] #179 - BSidesSF Summaries, Attacking Kubernetes, OpenAI Burp Suite

I wrote quick summaries of four BSidesSF presentations, common Kubernetes attack vectors and vulnerable lab, Burp Suite extension that uses OpenAI for recon.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #178 - DevOps Threat Matrix, LLMs in Security, Supply Chain Security

[tl;dr sec] #178 - DevOps Threat Matrix, LLMs in Security, Supply Chain Security

Microsoft techniques and attack vectors for DevOps environments, applications of LLMs in security, the deps.dev API and Golang supply chain security.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #177 AWS KMS Threat Model, DOM Invader, Forensics in the Cloud

[tl;dr sec] #177 AWS KMS Threat Model, DOM Invader, Forensics in the Cloud

Threat model and attack tree for AWS Key Management Service, Gareth Heyes on how to use the DOM Invader Burp extension, doing cloud forensics when a container is compromised.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #176 - Cloud Security Atlas, Semgrep + AI, Finding Malicious PyPi packages

[tl;dr sec] #176 - Cloud Security Atlas, Semgrep + AI, Finding Malicious PyPi packages

A searchable database of real-world attacks, vulns, and misconfigurations in cloud environments, Semgrep Assistant supports auto-triaging and fix suggestions using GPT-4, overview of malicious PyPi packages in 2023.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #175 The Future of Security Engineering, Awesome Kubernetes Threat Detection, ChatGPT Plugins

[tl;dr sec] #175 The Future of Security Engineering, Awesome Kubernetes Threat Detection, ChatGPT Plugins

The power of open source, flexible tooling, k8s detection resources, ChatGPT just got a whole lot more powerful.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #174 - Mitigating SSRF in 2023, Isolation & Container Namespaces, Offensive AI Compilation

[tl;dr sec] #174 - Mitigating SSRF in 2023, Isolation & Container Namespaces, Offensive AI Compilation

The challenges in mitigating SSRF and the best way to do it, how Linux namespaces provide isolation properties for containers, resources on attacking AI models / using it for offensive purposes.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #27 - AppSec Weekly, SOC2 Starting Seven, Save Encryption

[tl;dr sec] #27 - AppSec Weekly, SOC2 Starting Seven, Save Encryption

I was on Application Security Weekly #100, a no-nonsense guide to becoming SOC2 compliant, fight a bill that may kill encryption, compensation resources.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #173 - What Software Will Be Post GPT-4, the Cybersecurity Landscape, Reducing Attack Surface in AWS

[tl;dr sec] #173 - What Software Will Be Post GPT-4, the Cybersecurity Landscape, Reducing Attack Surface in AWS

The AI-based architecture that’ll replace most existing software, overview of cybersecurity companies and acquisitions, how to lock down instance creds and regions/services in AWS.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #172 - Career Resources, Machine Learning, Jim Manico Webinar

[tl;dr sec] #172 - Career Resources, Machine Learning, Jim Manico Webinar

Certs and getting into security, reinforcement learning for security, join Jim and I's webinar on broken access control.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #171 - AppSec and CloudSec Resilience, Audit Logs Wall of Shame, Compromised Cloud to Kubernetes Takeover

[tl;dr sec] #171 - AppSec and CloudSec Resilience, Audit Logs Wall of Shame, Compromised Cloud to Kubernetes Takeover

Building an effective AppSec and CloudSec program, vendors that don't prioritize high quality audit logs, tactics to go from a compromised cloud resource to taking over a Kubernetes cluster.

Clint Gibler
Clint Gibler
FirstBack
56789101112
Next Last