I think the only reason we didn’t see breaches of this scale and magnitude in prior years is simply because there weren't enough adversaries. InfoSec didn’t change all that much on the defense side, offense did.
When you find response header injection, you can probably do better than mere XSS or open-redir. Try injecting a short Content-Length header to cause a reverse desync and exploit random live users.
TIL that to stop homebrew from doing the auto mass update every time you `brew install` something, just add this to your .bashrc file:
export HOMEBREW_NO_AUTO_UPDATE=1
Cobalt Strike malleable c2 profiles and scripts have a new home. Nothing new posted yet, but future updates will be made under the new account. Please me spread the word.
https://t.co/leWGbsTdeG
@HelpSystemsMN @CoreSecurity@CoreAdvisories
For 52-weeks-of-python, the first lesson on 'Go' is now available. I implement a 'device' in Go, as I've done in Python and Java.
I also compare interpreted vs compiled languages, bytecode, running in a 'vm', etc.
It's here: https://t.co/vOqSe0ltHs
@davidbombal#Python
Things I wish I knew before learning #cybersecurity
1. Bug bounty is not the only domain
2. Google is your best friend
3. Networking with peers is key
4. It's okay to reach out for help
5. Joining reddit/discord/slack #infosec communities
6. Maintain good heath during burnout's.