Zach

infosec Featured

Falco for Runtime IDS

The ability to enable and drive creative thought through technical exploration will always be exciting to me in practice. This post is no different and covers how the Falco ecosystem provides a quick and flexible solution of substance for IDS and threat detection purposes. At the time of this writing,

Application Security Posture Management (ASPM)

The ability to classify, mitigate and avoid risk in relation to applications remains a struggle for organizations of all sizes. Shift-Left has led to a lot of advantages and I would love to think it's had a huge impact on protecting the privacy of users as well as

ai

Enterprise AI Playgrounds?

Recently, I found myself looking into options for running local AI models which leveraged my home lab. The adoption of Ollama is heavily prevalent in many opensource options as an integration point. Jan continues to be developed and tweaked to support model parameter tuning with an incredibly straight forward GUI.

aws

Attacking AWS Part 2: EC2 & EBS Snapshots

This post focuses on methods used to leverage and capture information while targeting EC2 compute resources. We'll cover EC2 and associated AWS service dependencies responsible for maintaining clean security hygiene when leveraging compute on Amazon Web Services. EC2 is also responsible for running the underlying compute for EKS

aws Featured

Attacking AWS Part 1: Public S3 Buckets

This post focuses on the public exposure of s3 buckets. Testing was done using boto3 over the AWS CLI on Python v3.12. An AWS IAM user account with any level of permissions on any account is required for testing. We'll start off by assuming you've

thought

Action-reaction Force Pairs

I wanted to take some time to write about my observations given the current climate and this whole opinion that AI will solve competency and productivity issues. This is not meant to be an in the weeds post where I dive into every facet or provide reverse engineering on package

Members only

tools

ARR Stack Homelab

aws

AWS re:Invent 2023 Announcements

re:Invent always builds hype and excitement for the future direction of AWS. However, the noise at which features and functions are released can definitely lead to fatigue. I've compiled a list below of recent annoucements which I feel are very beneficial to AWS professionals. CloudWatch Pattern grouping

ai Featured

Securing AI & LLMs

Those of us who've been around the block a few times find ourselves at yet another forefront in technology, and it's time to embrace the trend. Traditional machine learning has existed for quite some time, but the hype as of late is incredibly real. That said,

aws Featured

AWS IAM Recon

This post will focus on tools for performing IAM permission enumeration on AWS accounts. Custom, poorly written IAM roles and policies are some of the most common misconfigurations in regards to AWS architecture. That said, we'll discuss various resources that can help you breathe easier. First is MAMIP,

aws Featured

AWS EKS ASAP

EKS is a powerful CaaS solution for hosting k8s in AWS. Though setting up a cluster can be a convoluted task, this quick point of reference will help you strap on those elastic pants and get deploying. We'll first dive into what deploying EKS looks like and what

aws

AWS Threat Detection & IR

Re:Inforce 2021 Presentation Notes The “Auto-Enable” in Organizations from a root account enables services below if enabled on new and existing member accounts. A brief touchpoint on each AWS security related service for Threat Detection & IR is provided below. GuardDuty - Uses ML to present security alerts for

aws Featured

ssh... Quiet Down Now

As we all know AWS provides great solutions to a vast number of common technical problems. One such solutions excited me as a Security focused AWS Architect recently, and I wanted to share this finding aka Session Manager [https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html] . This feature

infosec Featured

☁️ Compliance

This post is about my experience while covering the infamous cloud shared responsibility model. I'm writing this because it's 2021, and people still often assume because they're utilizing a IaaS/PaaS offering it's secure! Well, I'm here to assure you

devops Featured

Sailing the AWS IaC Seas

Infrastructure as Code is an incredibly valuable solution with a ton of applicable use cases in modern cloud practices. Often times I'm approached to build out solutions from scratch or from existing cloud environments using either CloudFormation (AWS IaC) or Terraform. Both these solutions present benefits in multiple

hackthebox

HackTheBox - Resolute | Write-up

Tools impacket- sudo apt install -y python-impacket evil-winrm- git clone https://github.com/Hackplayers/evil-winrm cd evil-winrm install gem evil-winrm Foothold enum4linux 10.10.10.169 From the output, I obtained both a list of users, as well as a password that appeared to be setup for first time users

infosec

HackTheBox - Forest | Write-up

Tools bloodhound- sudo apt install python-pip pip install bloodhound impacket- sudo apt install -y python-impacket evil-winrm- git clone https://github.com/Hackplayers/evil-winrm cd evil-winrm install gem evil-winrm Foothold nmap -v -sV -sS -T5 10.10.10.161 User RPC on port 135 was open, so I attempted an unauthorized

Kubernetes Cluster w/ Vagrant, conjure-up, juju on AWS

This guide is for those looking to configure a K8s clusters for testing purposes on AWS. It leverages Vagrant/Ubuntu/conjure-up/juju to provision a cluster on nearly any cloud provider in 10 minutes. This guide is specific to using AWSCLI and therefore AWS to configure the cluster. This cluster

devops

Kubernetes Self Hosted Home Lab

This post covers how to install Docker & Kubernetes on Windows 10 Pro/Ent using Hyper-V/PowerShell/Chocolatey. Ensure Hyper-V features are enabled before proceeding. All commands are run via PS. — Docker Setup — Install Chocolatey: Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/

windows

Domain Auditing for Microsoft AD/GP

This post covers domain reporting via PowerShell to HTML for compliance change reporting purposes. The following is written to provide guidance and transparency for those seeking out simplistic answers to complex compliance requirements. With expensive paid solutions such at Netwrix requiring setup time and hardware requirements. I'm here

devops

CDN Features w/ Cloudflare

The following content is a summary of the security features Cloudflare offers to help mediate web hosting risk. Cloudflare is a Content Delivery Network that focuses on simplicity and ease of use. In order to setup, you create DNS records and follow a few incredibly easy steps. But what'

devops

SysOps AWS Certification Preparation

This post covers how I prepared for the test, and the resources I used. After using AWS for 5 years I decided achieving and attaining this would be something beneficial. I enjoy using AWS and think in terms of evolving the space they're still the go-to in 2019.

infosec

DUO MFA for RADIUS VPN Connections

This post covers implementation for MFA via firewall VPN connections using RADIUS authorization. 1.) Log into your DUO admin panel and create an application for RADIUS. 2.) Install the DUO Auth Proxy client on the server you wish to use to submit the RADIUS requests from. You'll specify

tools

Link Dump

Secure Yourself or the Enterprise: https://decentsecurity.com/ Virus Scan File or URL: https://www.virustotal.com/ Hacker News: https://news.ycombinator.com/ KitPloit Pentest Tools: https://www.kitploit.com/ 0x00sec: https://0x00sec.org/ Thugcrowd: https://thugcrowd.com/

windows

Nano Server 2016 Image Creation

I recently took a dive into Nano Server 2016 and it's capabilities. I figured I'd share my findings and explain how to get exposure and setup Nano Server. You'll need: Nano Server Image Builder https://www.microsoft.com/en-us/download/details.aspx?id=54065