John Carroll - The Contractor 🏴‍☠️🧯 (Page 3)

Inference.

OSINT

The way we leak information will eventually change...

'ExpLoading'

Exploitation

If you have ever dismissed a search order binary plant attack because the folder from where it takes place doesn’t allow for writes without elevation?

Bigger Benefits of Password Cracking

EntSec

Visibility everywhere yeilds a better understanding of work working, or work needing more support or new approaches. this is that for AD passwords en-mass.

Paying or Preventing Ransom Payments

Random

Don't make criminals of victims, think a little harder on this problem.

DNS Security TXT

Ideas

DNS Security TXT record A method to hold security contact signposting from an authoritative position - from Casey Ellis & myself https://dnssecuritytxt.org/?tc

Vertical Vulnerability Managment

InfoSec

Vulnerabilities are technology, security and risk vertical, as should be the management.

The Internet Facing Velocity Problem

EntSec

It's probably faster to find a flaw in all IPv4 Assets with Open-source attack and exploit validation tools than it is for someone internal to hunt down the owners, maintainers and appropriate people for remedial actions - The Internet Facing Velocity Problem

DNS Stewardship

EntSec

DNS Stewardship, the art of controlling internet facing projects from conception.

OWASP Top 10 - 2021

AppSec

This post is as much as an internal sit-rep as it is one for others to witness, share and challenge, I'm trying to understand the Top10's value eleven years on, the current top10 (2021) is in draft and open for comment, I've put my comments here, as well as the opening to this conversation on github

A Method for identifying .onion associated IP addresses

OSINT

This post is in theory, sound, however executing it would take real collaboration that probably doesn't exist and due to the benefits of tor to certain operations is going to be counterproductive,but, something to think about all the same