Articles

OFFSEC – Pen-testing Azure Firewall IDPS & Threat Intel features (Azure Lab 2)

Setting Off Alarms Have you ever seen an "alarm will sound" sign and think to yourself, "I feel like gambling today" and push the door open just to find that nothing happens and the sign was put there as a deterrent? Or maybe they pulled the wires to it because they were sick of people … Continue reading OFFSEC – Pen-testing Azure Firewall IDPS & Threat Intel features (Azure Lab 2)

CLOUDSEC – Securing Cloud Networks with Hub-N-Spoke and Azure Firewall (Azure Lab 1)

This lab builds a foundation Azure virtual to later test the Microsoft suite of security products in Azure. With the code examples and a few manual changes you can deploy one hub, four spokes with an advanced firewall appliance, jump hosts and IPSEC tunnel all within an hour using Azure ARM automation. Although Microsoft has … Continue reading CLOUDSEC – Securing Cloud Networks with Hub-N-Spoke and Azure Firewall (Azure Lab 1)

CLOUDSEC – Public Cloud Web Shells …. a serious malware and DLP issue

As you make your journey into the public cloud, you'll find an emerging trend of HTTP/s web enabled terminals. What I mean to say is, the remote access terminals like SSH and RDP are made available in a user friendly browser after the user has already authenticated to the public cloud console in their browser. … Continue reading CLOUDSEC – Public Cloud Web Shells …. a serious malware and DLP issue

APPSEC – How to compromise Kubernetes – Full Red Team vs Blue Team demo

This is a walk through of the Microsoft MITRE ATT&CK for Kubernetes that teaches the value of basic container security architecture requirements. If you're interested in higher level Architecture and Strategy check out my Study Guide. If you're interested in the attack surface and attack model at an enterprise level then check on my Threat … Continue reading APPSEC – How to compromise Kubernetes – Full Red Team vs Blue Team demo

APPSEC – AWS Amplify+React XSS attacks against AWS localStorage vulnerabilities

About Let's start off that ReAct and AWS Cognito are awesome and so is the serverless framework. You should spend some time learning about them because some great innovation went into them. Unfortunately, developers are using the serverless.com development tutorial using AWS Amplify + Cognito + ReAct.js and introducing a localStorage vulnerability which can be … Continue reading APPSEC – AWS Amplify+React XSS attacks against AWS localStorage vulnerabilities

DETECT – Detecting IOCs on Kubernetes for fun and profit

https://github.com/falcosecurity/falco https://github.com/falcosecurity/falcosidekick https://falco.org/blog/extend-falco-outputs-with-falcosidekick/ executive summary Falco and SideKick are open source tools which act as senors to monitor for indicators of compromise on your Kubernetes platform. The tools are officially part of The Cloud Native Computing Foundation (CNCF). If your looking for a low-cost yet effective way to put sensors on your Kubernetes environment, then … Continue reading DETECT – Detecting IOCs on Kubernetes for fun and profit

OFFSEC – Writing Buffer Overflows and Reverse Engineering compiled binaries

https://www.exploit-db.com/docs/47032 This tutorial started as a simple attempt to take notes and follow my curiosity on C programming, Assembly and Buffer Overflows work. Don’t take anything here as gospel because the content was written by a high-school drop-out without any formal computer science background. If you find something wildly wrong then let me know. From … Continue reading OFFSEC – Writing Buffer Overflows and Reverse Engineering compiled binaries

PROTECT – Why & How to build Client-Side Encryption in React.Js and beyond

What we're building .... client-side encrypted content with ReAct.JS and SJCL.js Problem Space GMAIL, Facebook, Instagram, Dropbox... you name it... they typically store your data "unencrypted" or with a limited encryption where they control the keys. This means all your emails, pictures, messages and files are sitting on someone else's computer for them to see. … Continue reading PROTECT – Why & How to build Client-Side Encryption in React.Js and beyond

OFFSEC – Writing Node.js malware that steals your cloud access keys

Disclaimer: This article is meant to educate developers and security practitioners of the current and present dangers of node.js development. Ethically, I cannot make the majority of my code publicly available on GitHub. However, I will show a few snippets and concepts for security awareness. If you are a past or present security colleague, please … Continue reading OFFSEC – Writing Node.js malware that steals your cloud access keys

NETSEC – You’re leaking to public Cloud APIs and all you can do is …

Welcome to the public cloud/s. Long gone are the days where traditional Email DLP, URL proxy filtering and L3 firewalls help you mitigate data loss to malicious websites. Maybe you have a developer who wants to use some benign and non threatening Google API to read non sensitive data. Seems okay right? Well, I wouldn't … Continue reading NETSEC – You’re leaking to public Cloud APIs and all you can do is …