chris408

11 ms·

1.
Creative solution to bypass “+” email address blocks on websites(frdmtoplay.com)
3 points by chris408 3y ago|0 comments
2.
Internet Egress Filtering of Services at Lyft(eng.lyft.com)
1 points by chris408 4y ago|0 comments
3.
Airbnb: Vulnerability Management at Scale(medium.com)
5 points by chris408 4y ago|0 comments
4.
Deconstruction of a $500k Google Chrome RCE vulnerability(tiszka.com)
4 points by chris408 5y ago|0 comments
5.
Get a grip on Chrome Extension risks [video](m.youtube.com)
1 points by chris408 6y ago|0 comments
6.
Get a handle on Chrome Extensions in your enterprise BSidesSF 2020 [video](youtu.be)
4 points by chris408 6y ago|0 comments
7.
Converting boolean expressions to finite state machines for high-perf evaluation(medium.com)
6 points by chris408 7y ago|0 comments
8.
Converting Boolean-Logic Decision Trees to Finite State Machines(medium.com)
8 points by chris408 7y ago|1 comments
9.
Cartography: Graph view of infrastructure and assets, and their relationships(github.com)
2 points by chris408 7y ago|0 comments
10.
Cartography infrastructure graph tool adds support for GCP(github.com)
1 points by chris408 7y ago|0 comments
11.
Envoy now has a bug bounty program(medium.com)
2 points by chris408 7y ago|0 comments
12.
Lyft Invites Community to Envoy Bug Bounty Program(medium.com)
1 points by chris408 7y ago|0 comments
13.
by chris408 8y ago
Not sure, but for now AWS is the focus.
14.
Cartography: Graph view of infrastructure assets and relationships between them(github.com)
176 points by chris408 8y ago|35 comments
15.
Lyft open sources infrastructure asset graph tool(github.com)
3 points by chris408 8y ago|0 comments
16.
Uberducky – A Wireless USB Rubber Ducky Triggered via BLE(blog.ice9.us)
2 points by chris408 8y ago|0 comments
17.
Digispark ATTiny85 USB key “rubber ducky” clone(github.com)
107 points by chris408 8y ago|8 comments
18.
by chris408 8y ago
Yes, with concent of course (Red Teaming).
19.
by chris408 8y ago
That is true and it is the first place I usually check when I compromise a new server. This wasn't mentioned in the post but imagine you compromised a server and found an unprotected ssh key. You don't know where it can be used, a
20.
SSH known_hosts hash cracking with Hashcat(github.com)
123 points by chris408 8y ago|45 comments
21.
SSH known_hosts files and how to crack their hashes(github.com)
3 points by chris408 8y ago|0 comments
22.
Easily crack ssh known_hosts files with hashcat(chris408.com)
1 points by chris408 8y ago|1 comments
23.
Certificate transparency logs and how they are a gold mine to bug hunters(chris408.com)
64 points by chris408 8y ago|10 comments
24.
Discover internal/hidden sub-domains by searching Certificate Transparency logs(github.com)
1 points by chris408 8y ago|0 comments
25.
Discover internal/hidden sub-domains by searching Certificate Transparency logs(github.com)
2 points by chris408 8y ago|0 comments
26.
ct-exposer: Discover sub-domains by searching Certificate Transparency logs(github.com)
3 points by chris408 8y ago|0 comments
27.
by chris408 8y ago
Maybe this isn’t clear, but something I read a while back on this topic: Running a container from dockerhub is basically the same as curl piping into bash.
28.
by chris408 8y ago
Apparently they don’t have a mechanism to permit their own addresses because the probes come from dynamic addresses. It sounded like they were adding this as a predefined label in the future.
29.
by chris408 8y ago
I agree, it seems strange that these ports are open, which is why I wrote this up. I spoke with Microsoft on the phone and they confirmed that the ports must be open for their SLA checks and monitoring to work properly. To reconfirm this, I
30.
Azure requires internet accessible ports to monitor your back end instances(chris408.com)
31 points by chris408 8y ago|5 comments

More ›