Thread by @clintgibler, tl;dr sec 40* Uber's continuous AWS monitoring* #AWS's hands-off deployments* Auto-remove unneeded [...]

tl;dr sec 40
* Uber's continuous AWS monitoring
* #AWS's hands-off deployments
* Auto-remove unneeded feature flags
* @PhilippeDeRyck on OAuth/OpenID Connect
* @gerben_javado extract endpoints/params & @m4ll0k2 find sensitive data from JS

and more! https://tldrsec.com/blog/tldr-sec-040/

[tl;dr sec] #40 - Uber’s Continuous AWS Monitoring, AWS’s Hands-off Deployments, Auto-remove...

Uber continuous AWS monitoring tool and process, how AWS does safe, fast, continuous deployment, tool to auto-delete no longer needed feature flags.

https://tldrsec.com/blog/tldr-sec-040/

Sponsor: Databricks is looking for a Sr Staff Engineer to join their Cyber Offense Program.

Pen testing, red teaming, vulnerability assessment, security code audits, and developing automation to identify security issues at scale. https://databricks.com/company/careers/open-positions/job?gh_jid=4756953002

Senior Staff Cyber Offense | Databricks

Senior Staff Cyber Offense, San Francisco, CA at Databricks. Join us! Together we can use data to solve the challenges of tomorrow.

https://databricks.com/company/careers/open-positions/job?gh_jid=4756953002

Uber describes their continuous cloud monitoring service and the workflows and process design that makes it successfully adopted by engineering teams. https://tldrsec.com/blog/uber-aws-continuous-monitoring/

How Uber Continuously Monitors the Security of its AWS Environment

Uber describes their continuous cloud monitoring service and the workflows and process design that makes it successfully adopted by engineering teams.

https://tldrsec.com/blog/uber-aws-continuous-monitoring/

I had written a really nice thread about

, then Twitter error'ed and I lost everything.

I'll rewrite it again when I'm less frustrated

Any recs on scheduling tweet threads / saving threads muuuch appreciated

Given a feature flag, Piranha can:
* Automatically delete the code immediately surrounding the feature flag API
* Delete the code that becomes unreachable as a result of the previous step
* Finally, delete any tests related to the flag.

https://eng.uber.com/piranha/

Common #JWT mistakes and how to prevent them from entering your code
https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/

GitHub's linter wrapper
https://github.blog/2020-06-18-introducing-github-super-linter-one-linter-to-rule-them-all/

Free chapters on API security, H/T @DSotnikov https://www.manning.com/books/understanding-api-security

Understanding API Security

Gone are the days when it was acceptable for a piece of software to live in its own little silo, disconnected from the outside world. Today, services are expected to be available for programming,...

https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/

@PhilippeDeRyck A free 2-hour session on OAuth 2.0 and OpenID Connect
https://pragmaticwebsecurity.com/courses/introduction-oauth-oidc.html

@gerben_javado extract endpoints/params from JS files
https://github.com/GerbenJavado/LinkFinder

@m4ll0k2 find sensitive data in JS files https://github.com/m4ll0k/SecretFinder

m4ll0k/SecretFinder

SecretFinder - A python script for find sensitive data (apikeys, accesstoken,jwt,..) and search anything on javascript files - m4ll0k/SecretFinder

https://pragmaticwebsecurity.com/courses/introduction-oauth-oidc.html

#AWS security incident response guide
https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf

AWS Incident Response Runbook Samples
https://github.com/aws-samples/aws-incident-response-runbooks

CLI to extract useful info from Cloud Trail
https://github.com/flosell/trailscraper

A CLI that utilizes Okta IdP via SAML for temp AWS creds https://github.com/HBOCodeLabs/gimme-aws-creds

HBOCodeLabs/gimme-aws-creds

A CLI that utilizes Okta IdP via SAML to acquire temporary AWS credentials - HBOCodeLabs/gimme-aws-creds

https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf

Check CloudFormation templates for policy compliance
https://github.com/aws-cloudformation/cloudformation-guard

@jcfarris what to look for when evaluating an AWS env for the 1st time
https://www.chrisfarris.com/post/cloud-assessment/

@kestenb AWS IAM Assume Role vulns in many top vendors
https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities

How Amazon automates safe, hands-off deployments
https://aws.amazon.com/builders-library/automating-safe-hands-off-deployments/

Show container images used in a #Kubernetes cluster.
https://github.com/chenjiandongx/kubectl-images

Kubernetes Admission Controller for Image Scanning using OPA
https://github.com/sysdiglabs/opa-image-scanner

@0xbharath The Art of Packet Crafting with Scapy
https://scapy.disruptivelabs.in/

@hot3eed Reverse Engineering SnapChat
https://hot3eed.github.io/snap_part1_obfuscations.html

@bbinfosec Beginner to intermediate reverse engineering resources https://medium.com/@vignesh4303/reverse-engineering-resources-beginners-to-intermediate-guide-links-f64c207505ed

Reverse Engineering Resources-Beginners to intermediate Guide/Links

While i wanted to learn up reverse engineering , I started hunting up for blogs, I wish to share the links which i came across with…

https://scapy.disruptivelabs.in/

@tyl0us A password guessing tool that targets Kerberos and LDAP services
https://www.optiv.com/explore-optiv-insights/blog/digging-your-talons-new-take-password-guessing

@bouncyhat Excel Macro document reader/writer for #redteam-ers
https://github.com/michaelweber/Macrome

Automatically refactoring Meterpreter to bypass AV/EDR
https://blog.scrt.ch/2020/06/19/engineering-antivirus-evasion/

michaelweber/Macrome

Excel Macro Document Reader/Writer for Red Teamers & Analysts - michaelweber/Macrome

https://www.optiv.com/explore-optiv-insights/blog/digging-your-talons-new-take-password-guessing

@slashcrypto Just another Recon Guide for Pentesters and Bug Bounty Hunters
https://www.offensity.com/de/blog/just-another-recon-guide-pentesters-and-bug-bounty-hunters/

Teach Yourself Computer Science
https://teachyourselfcs.com/

59 Specific Ways to Write Better Python. Code samples from the book by @haxor
https://github.com/SigmaQuan/Better-Python-59-Ways