jgamblin

  Mod_Security is the most widely known and used server based Web Application Firewall but I had not had a chance to play with it so I decided to take sometime this weekend to build a website (modsec.handsonhacking.org) to test it.   Here is a small walk through on how I did it. Base Server … Read more

One of the things that even the new MacOS beta is missing is MAC Address Randomization on boot.  After spending a few hours working on it I put together this completely hack-y solution that uses Spoof and an automator Script saved as an application. Here is how I configured it: Install Spoof Open Automator Select “Application” Add “Run … Read more

I recently saw this SSH/HTTP(S) multiplexer on Github and tweeted that it looked amazing: An amazingly cool tool to run a webserver and a ssh on the same port: https://t.co/Z2eel3aIq5 — Jerry Gamblin (@JGamblin) July 2, 2017 A couple of people responded that you should be able to do the samething with HAProxy or something similar but … Read more

I love OWASP  (I wanted to get that out of the way) but they let their TLS certificate expire yesterday: Should it have happened to an organization whose whole goal is to secure web applications? No. There are a million reasons why their TLS certificate could have expired and plenty of reasons it shouldn’t have … Read more

Have you ever wanted to control a vast medium small network of Honeypots but only had an hour and about $40 a month to spend on your project? So did I!  So with the help of Digital Ocean and Anomali‘s Modern Honey Network we can now do it! For a basic distributed Cowrie network you will need: 1 – … Read more

In the last couple of years the Anti-Vaccination crowd in the United States has started to make inroads with more and more people deciding that the perceived risk of the vaccination outweighs the known risk of the disease. When you ask them why they dont vaccinatie they always have anecdotal evidence of how the vaccination could hurt them,  how … Read more

As I continue to try to learn R,  I am trying to build tools that other people might find useful. Tonight with the help of Bob Rudis I built a script that will find domains with a keyword in it from DomainPunch, do a geoip lookup and map it if it is online. Since it is time … Read more

Since I have started looking at the Umbrella DNS Popularity List I was interested in seeing how much the data changes day to day.  I fired up RStuido and wrote some terrible code but finally got it to work with some help. Yesterday there were 80937 new DNS names on the list that were not on the list … Read more