Brad Richardson

student of security and behavioral science. always curious to learn. love to share info. California road tripper. home coffee roaster. kayaker. scuba diver.

[Brad Richardson @Richarjb]

@_wald0

[Brad Richardson @Richarjb]

@dagrz @PlerionHQ This guy blogs

[BART @SFBART]

The Pittsburg Center Station is closed due to a shooting that occurred around 3:50pm. One person injured.
We are gather more details.

Trains are running through the station but not stopping.

[Cedric Owens @cedowens]

Excited to share the stage with @xorrior next week for #OBTSv5! We will be discussing “living off the land” techniques for macOS! Please say hello if you will be there! https://t.co/HYjhdd9vkj

[Brad Richardson @Richarjb]

@cedowens When I was a kid my parents would take me to "Family Video" to rent movies. Good times. Thanks for the memory.

[Brad Richardson @Richarjb]

@subtee @mubix I’ve been waiting a long time for someone to say this. Yes detections fail too.

[Brad Richardson @Richarjb]

I know some friends have been waiting to see the talk myself and @desi_jarvis put together for Bsides SF on red team operations in GCP so if you weren't able to make the live presentation then check it out here: https://t.co/qHbhrObuPI

[Justin Bui @slyd0g]

My talk @BSidesSF is up on YouTube if anyone wasn't able to make it in-person or catch the stream!

https://t.co/sfV8NGEtd7

[Brad Richardson @Richarjb]

Super excited to be speaking at @BSidesSF on Sunday about Securing Your Cloud with Red Team Engagements in GCP. Hope to you see you all there! https://t.co/eftsUPRFmG

[BSidesSF @BSidesSF]

In 1 week, BSidesSF Staff and Volunteers start the physical work of getting everything for the conference. Do you have your ticket to join us on June 4th & 5th to enjoy the efforts of our labor? No? We want to see you! https://t.co/ERWhT2g9Qp

[Brad Richardson @Richarjb]

@medus4_cdc https://t.co/YUjKMeTwBz

[Brad Richardson @Richarjb]

@N7WEra @desi_jarvis Awesome! 🔥🔥

[Brad Richardson @Richarjb]

@desi_jarvis just significantly raised the bar on quickly visualizing GCP IAM roles and permissions for red and blue teams. Checkout gcpHound v2.0!

[Madhav Bhatt @desi_jarvis]

gcpHound v2.0 is out. It comes with the Web UI to query IAM permissions for different targets.

Next evolution will have Attack Paths as well as other cool GCP abuse cases from @Richarjb

https://t.co/m0epPk5D1L

[Jared Atkinson @jaredcatkinson]

🧵
1/ Two days ago I shared this image to demonstrate how many unique paths exist for a single behavior. At the time I didn't know how to use it, but today I realized it shows why red teams, MITRE evals, & vendor tests can't answer Technique coverage questions without change.

[Cloud Security Podcast @CloudSecPod]

Is it GCP or GC? - Learn from Cool Kids of Google Cloud! @antoniscloud & @hashishrajan
- https://t.co/swgcf8Gym9

#cloudsecuritypodcast #googlecloud #infosec

[Cloud Security Podcast @CloudSecPod]

Red Team in Google Cloud! -@Richarjb @hashishrajan
https://t.co/21zuty3jJC

#cloudsecuritypodcast #googlecloud #infosec

[Brad Richardson @Richarjb]

@CloudSecPod @hashishrajan Thanks for having me on the podcast. The questions were great and I always enjoy meeting members of the community.

[Madhav Bhatt @desi_jarvis]

If you are looking for a Metasploit module for scanning Log4Shell , check out my write-up below.

I have also outlined some things I found useful as well as resources you can use to write / customize your own module.

https://t.co/jEmVsxcsmB

[Brad Richardson @Richarjb]

gcpHound: This hound has learned some new tricks Learn about the new features by @desi_jarvis and myself and why the cat is upset at my latest blog post https://t.co/2ujCLWlMos

[Márcio Almeida @marcioalm]

Just added support to LDAP Serialized Payloads in the JNDI-Exploit-Kit. This attack path works in *ANY* java version as long the classes used in the Serialized payload are in the application classpath. Do not rely on your java version being up-to-date and update your log4j ASAP!