Uncategorized

The new rest API in Burp 2.0 it is going to be amazing but it will allow things like this 9 line shell script I wrote this morning that will grab all public bounty sites from  @arkadiyt’s  bounty-targets-data repo and kick off a full scan. https://gist.github.com/jgamblin/c22c0791af7572280d7fd569141650fe I almost didn’t post this blog because I *think* this script is, … Read more

I spend a lot of time working with MacOS and I have noticed that out of the box the operating system has some basic security settings that are not enabled by default so I have built a small script that automates configuring these. It does the following: Requires Password Immediately After Sleep. Turns On Firewall. Enables … Read more

Recently I have noticed that companies that use Google Suite have a fairly common misconfiguration that is making their internal groups public.  In some cases it is just the name of the groups but in some extreme cases the content of the posts are public. Testing for this misconfiguration on your domain is as easy … Read more

I am a fan of Kali Linux and AWS so I love the fact that they have an official AMI.  While spinning up a Kali instance in AWS is fairly easy, I had a long flight today so I wrote a script that will spin up a Kali instance in about 60 seconds. The script does the … Read more

Recently while working on a project I wanted to run OWSAP Dependency Check against a Github Organization to find any out of date frameworks but I couldn’t find an easy way to do it so I built a tool. Right now it will check Node and Ruby applications and put all the out of date … Read more

On Friday, January 6th 2017  I walked into the first Yoga class of my life at YogaSol  as part of fulfilling a new years resolution. I was in the best shape of my life. I was running, swimming and lifting weights multiple times a week. I weighed 165 pounds and was at 9% body fat. … Read more

Last November I hacked together a script that continually monitored your network and sent a slack alert when something change.   It worked but I was never 100% happy with it so I spent some time this weekend and rewrote it so that is hopefully more user friendly and functional. Some changes in this version … Read more

I was working on a project recently and was asked if it was possible to stop users from setting common passwords.   Using the pam_cracklib module and @DanielMiessler  common passwords list it is as simple as these 3 commands: sudo apt-get install libpam-cracklib -y sudo wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/10_million_password_list_top_1000000.txt /usr/share/dict/ -O /usr/share/dict/million.txt sudo create-cracklib-dict /usr/share/dict/million.txt Seriously,  that’s it. Here is what … Read more

  Mod_Security is the most widely known and used server based Web Application Firewall but I had not had a chance to play with it so I decided to take sometime this weekend to build a website (modsec.handsonhacking.org) to test it.   Here is a small walk through on how I did it. Base Server … Read more

One of the things that even the new MacOS beta is missing is MAC Address Randomization on boot.  After spending a few hours working on it I put together this completely hack-y solution that uses Spoof and an automator Script saved as an application. Here is how I configured it: Install Spoof Open Automator Select “Application” Add “Run … Read more