Curiosity in Practice
Cisco offers a daily list of the million most queried domain names from Umbrella (OpenDNS) users. I had some time this weekend so decided to spend some time playing around with the data to see what I could find so I spun up a lightsail server and got to work. Grabbing the file is as simple as: … Read more
I am a huge fan of Tim Tomes and his Burp Suite Configuration Suggestions blog post. The problem is that I only use Burp a couple times a month and end up facing this screen and have to re-configure burp on every launch: So I built burpsettings.json that: Disables Browsers XSS Protection Disables Burp Collaborator Server Disables Intercept … Read more
Today I was asked if it was possible to generate a list of domain names registered everyday with a keyword in the record (company name, city, trademark, etc). There are a few paid services that do this and domainpunch.com has a web based tool that will do this but I wanted to automate it so I … Read more
I am a big fan of DigiCert for TLS Certificates and CA/WebPKI services. While they have amazing customer support and are an amazing company to work with, there are not a lot of automation scripts to interact with their API available. So over the weekend and with a lot of help from Clint Wilson I built a … Read more
An amazing mentor and leader I work with has been talking to me recently about what real leadership looks like and shared with me a list of quotes he keeps on his desk that his dad who had a leadership role in the military collected and gave to him. He gave me a copy and said … Read more
I am reading a book called “The Art of Authenticity” and in the book over a couple of chapters it talks about understanding what makes strong leaders and deciding who you should follow. I have pulled these 10 questions out of those chapters: What was your first leadership role? When you think about the process … Read more
Certificate transparency logs are an amazing way to get a good overview of your certificate landscape, detect fraud (bad guys also use TLS) and find shadow IT and unknown cloud services. The problem is that there are not many good places to search these logs. The best I have found is from Symantec, although it is … Read more
Ever since Charlie Miller hacked a Jeep while it was driving on the interstate I have wanted to learn more about Car Hacking but really had not had a chance to get started with it until a month ago when I ordered a Carloop and was ready to get hacking: … or so I thought. Turns out car hacking … Read more
The RSA conference starts next week and lets be honest it is becoming known as a stuffy management conference with very little useful technical information but if you know where to look you can take some deep dives. I have put together a quick guide of some amazing talks and events I am looking forward … Read more
I was lucky enough to get a hold of an Insta360 Nano this week and it is some of the most amazing technology I have seen recently. It allows for truly instant 360 photos, videos and timelapse captures. As one of the people I was showing it to this week said it is the “selfiestick … Read more