How do you get to 🧙♂️Staff🧙♂️ level in security?
Hard to know, as there's not much guidance out there
Where is the staffeng.com for security?
went and got stories from 8 Staff+ Sec Engineers, go learn from their experiences 👇
Follow
Click to Follow clintgibler
Clint Gibler
@clintgibler
Clint Gibler’s Tweets
🦀 Reverse Engineering Rustlang Binaries - 5 Part Series
* The structure of empty Rust binaries
* How the printf function works at a low level
* How Rust stores variables and passes them as args for use
+ more
By #infosec
1
4
Yay! Come and join us
Quote Tweet
We're bringing together #security experts @dcuthbert @LewisArdern @AroraMinali and @_amanvir for a panel session in London on Feb 20!
Join us and learn their best practices in building & scaling highly effective AppSec/ProdSec teams.
Save your seat: bit.ly/3lf8gQ8
read image description
ALT
2
7
⛈️ Misconfiguration and vulnerabilities biggest risks in cloud security
Report by based on analyzing >7M containers their customers are running daily as well as public data sources such as GitHub, Docker Hub, and the CNCF
#cybersecurity
csoonline.com/article/368657
2
10
🎨 Threat Modelling Cloud Platform Services by Example: Google Cloud Storage
* Key features and security controls of Google Cloud Storage
* Potential threats (STRIDE)
* Threat mitigation recommendations
By
research.nccgroup.com/2023/01/31/thr
4
18
⚠️ XXE in C# applications in theory and in practice
provides an overview of XXE, relevant C# components, an example vulnerability, and how to protect your code
3
6
🗒️ Doubling Down on SBOM Drift
How an application's dependencies, as analyzed by Syft, change from your initial direct dependencies, to transitive dependencies after `npm install`, to adding a container image, etc.
By
3
🥷 Ransacking your password reset tokens
o how the "Ransack" Ruby library can be abused to exfiltrate sensitive data via char by char brute-force
They compromised multiple applications this way and found 100s more that might be vulnerable
4
9
25
🥳 New XSS Hunter hosted by
Use for blind XSS detection
Feature enhancements:
* CORS analysis
* Secrets detection
* Detect exposed .git directory
#bugbounty #bugbountytips
1
9
18
📦 Mitigating RBAC-Based Privilege Escalation in Popular Kubernetes Platforms
walks through the different mitigations the platforms (AKS, EKS, GKE, ...) implemented to address privilege escalation and powerful permissions in #Kubernetes
2
4
🍀Are you as excited as we are for #OWASP Global AppSec Dublin?
Join us at Foley's Bar for Happy Hour Tues., Feb. 14, 5:00 pm - 8:00 pm, sponsored by Jit and Semgrep, for a unique networking opportunity before the conference starts.
RSVP NOW: lu.ma/owasp-dublin-h
#appsec
7
13
🛠️ automated-security-helper
Wraps a number of other open source tools, including:
* git-secrets
* bandit
* Semgrep
* Grype
* Syft
* nbconvert
* npm-audit
* checkov
* cdk-nag
* cfn-nag
3
19
✍️ Never write a commit message again
gptcommit: a new tool that uses the OpenAI completions API to summarize the changes in each file
3
13
Keep up with security research in 10min/week:
📺 Talks
🛠️ Tools and blog posts
🧪 Research projects
Join 14,000+ of the best security professionals:
tldrsec.com
Follow me for more
Show this thread
📢 Sponsor: ⏱️Don’t blink!... cloud-native #CWPP stops runtime attacks (ransomware, etc) on cloud instances in real-time. Performance, scalable, efficient. Watch the 1-min demo:
1
1
4
Show this thread
📚 tl;dr sec 167
With great work from:
, , , , , , , , , , , , , ,
and more!
1
7
24
Show this thread
Neat write-up by
I enjoyed the nuances around bypassing the server's origin check, experimenting with how browsers treat special characters, and dealing with Same Origin Policy preflight requests
Quote Tweet
Recently I discovered a one-click RCE vulnerability in #Azure that affects Function apps, App services, and Logic apps.
The vulnerability enables attackers to fully take over the targeted victim's application and managed identity token.
This is the story of #EmojiDeploy ._. 
Show this thread
GIF
1
3
8
👩💼 Employee-facing Mutual TLS
How has implemented employee-facing mutual TLS with a custom identity provider in a way that results in a positive user experience
Tons of subtleties you need to think about when supporting all major platforms
6
25
🦸 Super Agent
A browser extension which lets you decide which cookies you want and don't want, auto-accepts cookie pop-ups for you, and warns you whenever it finds a website not respecting your preferences
1
7
Truffle Security is proud to host a new XSSHunter, that finds new vulnerabilities
16
251
688
(Principal Security Architect ) shared his experience at the intersection of enterprise and solution architecture, and talks about "innersourcing" as a lever for Staff+ Impact tldrsec.com/guides/staffen 2/3
1
4
8
Show this thread
Excited to share two more Staff+ Security Engineer stories we've just published over on tldrsec.com
Jonathan Fisher (from ) shared how he's experienced "Staff Level" work in a consulting team tldrsec.com/guides/staffen 1/3
1
4
35
Show this thread
🔨 Smithy
A protocol-agnostic interface definition language and set of tools for generating clients, servers, and documentation for any programming language
8
☁️ Precloud
An open source CLI that runs checks on infrastructure as code to catch potential deployment issues before deploying
It works by comparing resources in CDK diffs and Terraform Plans against the state of your cloud account
3
11
🗺️ Caretta
An instant #Kubernetes service dependency map, right to your Grafana
Leverages eBPF to efficiently map all service network interactions in a k8s cluster, and Grafana to query and visualize the collected data
github.com/groundcover-co
GIF
2
3
22
🏊 Tampering User Attributes In AWS Cognito User Pools
In Cognito, App Integrations (Clients) have default R/W permissions on User Attributes
➡️ Auth'd users can edit their own attributes
➡️ Privilege escalation, etc.
By ,
blog.doyensec.com/2023/01/24/tam
4
11
🔥 Capital
A built-to-be-vulnerable API application based on the top 10 API vulnerabilities
Use it to learn, train and exploit API Security vulnerabilities within your own API Security #CTF
By #bugbounty #bugbountytips
7
22
☕ jbom
Generates Runtime and Static SBOMs for local and remote Java apps
4
4
🎣 AWS Could Do More About SSO Device Auth Phishing
Great overview by about SSO device auth phishing, what AWS should and could do, and what you can do to protect your org
2
6
☁️ Solving for Cloud Security at Scale with Chris Farris
joins to discuss how he wound up in the world of DevRel at Turbot and what he sees for the future of multi-cloud security practitioners
1
8
🗒️ SBOM Scorecard
When generating first-party SBOMs, it's hard to know if you're generating something good (e.g. rich metadata that you can query later) or not.
This tool hopes to quantify what a well-generated SBOM looks like.
1
14
If you frequently deliver source code review assessments of products including machine learning components, semgrep's "extract mode" now supports Jupyter Notebooks:
9
10
🐍 Using Semgrep with Jupyter Notebook files
describes how using Semgrep's "extract" mode
Extract mode can be used to analyze Bash in a Dockerfile, JS in HTML, etc.
He also submitted a PR to make extract mode better, huzzah open source! 🙌
3
12
💳 Swipe right on our new credit card tokens!
has released a new canary token type: credit cards
They'll create a valid credit card (number, expiration, and CVC) for you, and you'll get notified if it ever gets used
1
2
🔮 3 Predictions for Cyber Offense in 2023 and How You Can Prepare
1. Hackers are going to ransom our cars
2. Attackers will start creating zero day exploit farms
3. The OSS "tragedy of the commons" will continue
By #cybersecurity
1
3
9
🔑 FIDO2, New Hires & Lost Keys
Part 3/3 in 's Passwordless AuthN Series
➡️ How they handle the "chicken and egg" new FIDO2 user problem (Azure TAP codes) and when users lose keys
13
52
7️⃣ Better visibility will improve with purpose-built tools (e.g. data lakes)
8️⃣ Cloud security will increase with automated reasoning
9️⃣ Security teams will get more serious about quantum-resistant cryptography
For more, see the post 👇
1
2
Show this thread
4️⃣ Training best practices will inspire action and improve security
5️⃣ Embedded security will become more tangible with IaC
6️⃣ Orgs will increase investment and focus on business resiliency
1
Show this thread
🔮 AWS security heads offer top cybersecurity predictions for 2023
Nine predictions 🧵
1️⃣ MFA will become pervasive
2️⃣ Increasingly inclusive workforce will address talent gap
3️⃣ Collaboration across companies will improve preparedness and incident response
1
10
25
Show this thread