ncc-erik

5 ms·

1.
by ncc-erik 4y ago
My measurement was imprecise and that probably throws things off: python -m timeit '64135289477071580278790190170577389084825014742943447208116859632024532344630238623598752668347708737661925585694639798853367*3337202759497815655
2.
by ncc-erik 4y ago
Found in 2700 core-years, verified in < 1 core-second >>> 64135289477071580278790190170577389084825014742943447208116859632024532344630238623598752668347708737661925585694639798853367*33372027594978156556226010605355114227
3.
by ncc-erik 5y ago
I maintain an open-source project [1] that uses graphs to model data. I wanted to make my project as accessible as possible, so Graphviz was perfect since it's dead-simple to install and use on all major OS platforms. [1] https:/
4.
by ncc-erik 5y ago
I think what makes this hard for folks is tracking what the expected form of data is at each step of its lifecycle, especially considering people working with new and unfamiliar codebases or splitting focus on multiple projects. There are s
5.
by ncc-erik 5y ago
Depending on what your job role is, this last weekend probably sucked. But IMO it's also pretty typical that a few of these sorts of events happen every year. Reminder that this exists: https://paulbellamy.com/vulnerabi
6.
by ncc-erik 5y ago
Not a ton of benefit here, because drawing attention without having the patch fully ready means more eyeballs looking. More eyeballs means someone inevitably finds and exploits/publishes before it can be mitigated.
7.
by ncc-erik 5y ago
I only imported 10 dependencies, but those 10 dependencies each had 10 dependencies which each had 10 dependencies which each had 10 dependencies and all of the sudden I'm at 10k dependencies again...
8.
by ncc-erik 5y ago
I took a networks class during college, and there was a homework question from the textbook about a scenario like this. It had you compare transferring a large amount of data over the Internet versus loading it onto a disk and driving a phy
9.
by ncc-erik 5y ago
The one a lot of folks know about was the soft hyphen (U+00AD) to bypass swear filters. I was able to use normalization to create XSS attacks.
10.
by ncc-erik 5y ago
Very comprehensive blog, nice work. As a pentester, I always get excited when I see ACAO or an OPTIONS request in my proxy logs. It's still really hard to wrangle and get right.
11.
by ncc-erik 5y ago
Neat project, thank you for sharing. Do you currently, or plan to, handle Condition constraints? Also, how does wonk handle combinations with statements that have the Deny effect?
12.
by ncc-erik 5y ago
Big shoutout to lru_cache. I tossed in two lines of code and was able to get a 60x speedup in my code by reducing the amount of regular expression compilations I had to do.
13.
by ncc-erik 5y ago
I saw an app prefix the prompt to allow tracking with a similar-looking pop-up that said something like "please press allow on this next step ...". That pop-up only had one button, saying "Allow", then the actual pop-up
14.
by ncc-erik 5y ago
It will stand alone, but I keep in touch with the ScoutSuite folks. I'm thinking at some point I'll build in graph-creation based off of ScoutSuite's data collection.
15.
by ncc-erik 5y ago
Hi HN! Principal Mapper is a tool + library for analyzing and securing your AWS IAM configuration. It generates a model of your account and/or organization and uses it to give you a better idea of the effective permissions of your IAM
16.
Show HN: Principal Mapper v1.1.0 – AWS IAM Security Analysis(github.com)
7 points by ncc-erik 5y ago|3 comments
17.
by ncc-erik 6y ago
Thanks for the PMapper shoutout!
18.
by ncc-erik 6y ago
Note: I am a current NCC Group employee. It does one thing very well: quickly grabbing a snapshot of the security posture of a public cloud account's resources with little fuss. It's an ideal solution as an outsider looking in at
19.
by ncc-erik 7y ago
My go-to link for that class of issue is: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simpl... It's usually a lot easier to write the PoC with fetch() though.