@sdanndev

Security Engineer, finance geek, traveler. @sdanndev@infosec.exchange

 Seattle, WA
danneman.org
Joined January 2017
  • Tweets266
  • Following306
  • Followers175
28Media
You should be aware of the term "harvest now, decrypt later". At some point, the encryption we use today will be easily crackable. Don't rely too heavily on it. Better to be very protective of where your data ends up, even if it's encrypted.
25
126
8
707
78,302
Steven Danneman retweeted
Holly Graceful@HollyGraceful3 Jul 2023
SSL/TLS issues come up all the time during PenTests and explaining the technical detail of all of the different TLS configuration options can be quite difficult - so I put together a handy guide! akimbocore.com/article/harde…

Hardening SSL/TLS: Common SSL Security Issues | Akimbo Core

Secure Sockets Layer (SSL) was a protocol designed to protect network traffic in transit, however it was superseded by Transport Layer Security (TLS) in 1999.

akimbocore.com
5
105
1
373
48,054
Steven Danneman retweeted
Jeremy Allison@jra_samba20 Jan 2023
Just got laid off from Google. If anyone needs SMB 1/2/3 protocol or Open Source experience, I'm interested.
22
93
12
290
99,482
Steven Danneman retweeted
kache
@yacineMTB28 Dec 2022
if you don't release an API people will build a whole selenium browser automation over it smh
23
36
11
901
110,947
Steven Danneman retweeted
Travis McPeak@travismcpeak23 Dec 2022
As an industry, security needs to move away from filing a vulnerability Jira ticket and calling it a day. Business risk is only reduced when vulnerabilities are mitigated or fixed. Far too many Jira tickets stay open for months or even years. In these cases, we haven't helped. 🧵
4
1
4
38
11,761
Steven Danneman retweeted
Ryan McGeehan@Magoo8 Dec 2022
A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023: A blameless post-mortem of USA v. Joseph Sullivan magoo.medium.com/a-blameless…

A blameless post-mortem of USA v. Joseph Sullivan

Our industry deserves a complete retrospective into the incidents behind the criminal case against Uber’s former Chief Security Officer.

medium.com
3
21
5
39
If you enjoyed the Web App Hacker’s Handbook, I’d encourage you to try out our Burp Challenge on @WebSecAcademy. It’s fun and current, you’ll probably learn something new, and you might even win some exclusive @Burp_Suite swag.
Web Security Academy
@WebSecAcademy2 Dec 2022
#burpchallenge Complete one practitioner lab from each of these topics CSRF, Clickjacking, CORS, XXE, DOM-based vulnerabilities - by 8 Dec, to be entered into the draw. Five people will win exclusive Burp swag - winners announced on Mon 12 Dec at 3pm (GMT) portswigger.net/blog/the-bur…

The Burp challenge

We recently launched the Burp challenge, to give our customers a unique opportunity to demonstrate their skills with Burp Suite Professional. Not only that, but the challenges involved put your web vu

portswigger.net
1
5
34
Pictured: Proof that Node + NPM is madness. This pic is showing the chain of dependencies leading to a vulnerable package, but it's so big it broke our CSS. 😂 View vuln chains for your projects (for free): github.com/marketplace/lunat… Who can find the longest chain? Share yours 👇
1
20
7
73
Steven Danneman retweeted
Feisty Duck@feistyduck18 Aug 2022
From the TLS Newsletter: Coursera announced the much-delayed Cryptography II course by Dan Boneh starting in October. Boneh created the very popular Cryptography I course many years ago. buff.ly/31olhg8, buff.ly/2lJvMCF July issue: buff.ly/3JaAvXU
3
1
10
Steven Danneman retweeted
Jason Scott@textfiles13 Jul 2022
Sumo! Sumo! Sumo! Sumo!
1
1
2
Continuing our series of chaotic IP facts: All of the items below are equivalent to 127.0.0.1. Don't believe us? 🤔 Ping them! 👇 127.1 2130706433 0x7F000001 You can also "overflow" digits, for example 127.0.256 is equivalent to 127.0.1.0 🤯 Follow us for more mayhem.
6
55
4
252
Steven Danneman retweeted
Corey Quinn
@QuinnyPig3 Jun 2022
And now, a rundown of my personal (not corporate) security posture. Let's tune in...
5
85
31
445
Steven Danneman retweeted
Colm MacCárthaigh@colmmacc1 Jun 2022
A quick rage-thread about credentials. When security auditors just say things like "Critical credentials need to be rotated every 90 days" you need to fire them into the sun with urgency. Here's what you actually need ...
41
493
91
2,749
Steven Danneman retweeted
Corben Leo
@hacker_30 Mar 2022
Hacking CAN be easy. But, often it's not. Let's develop your technical skills, they obviously matter. A roadmap:
133
806
36
3,121
Steven Danneman retweeted
Peter C@itspeterc1 Mar 2022
Are there any good examples of Ransomware incidents at organizations not using Active Directory as a single-point-of-compromise? Also, any good examples of Ransomware incidents for non-Windows majority organizations?
1
11
18
Steven Danneman retweeted
Karl (RIP )@supersat28 Jan 2022
There needs to be an anti-Plaid law which prohibits companies from asking you for your financial institution credentials And any OAuth-type solution needs fine-grained permissions. There's no need for full transaction history, let alone being able to send money (cc: @csoghoian)
1
1
5
Steven Danneman retweeted
Arkadiy Tetelman@arkadiyt5 Jan 2022
I know certifications are a perennial debate but I've never gotten a single cert & I'm very happy with my career growth. Sometimes folks early in their career or otherwise discriminated against can use it to get their foot in the door. If a company requires certs it's a red flag
Bill Pelletier@awpiii4 Jan 2022
Anyone else abandoning their CISSP and/or CISA certs this year? The ever increasing dilution of the CPE credit seems to be adding less and less value to the professional side of things. I say this after almost 2 decades of maintaining the certs.
1
1
1
7
Steven Danneman retweeted
gabsmashh
@gabsmashh12 Aug 2021
[physical pentest, 3am] me: why are any of us here, really? security guard: i'm asking about you, specifically.
38
103
4
1,311
Steven Danneman retweeted
Hal Pomeranz@hal_pomeranz18 Jul 2021
Lately I’ve been dealing with a lot of ransomware cases. And often our team runs into issues with the IT staff from the victim organization.
30
220
56
1,119
Steven Danneman retweeted
Devdatta Akhawe@frgx4 Jun 2021
new post! Kerckhoff's Law and what it means for security engineers. devd.me/log/posts/kerckhoffs… Everyone keeps repeating Kerckhoff's law but its actually more than "use public, standard encryption algorithms". Would love feedback!

Kerckhoffs’s Law for Security Engineers

What can we learn from Kerckhoffs's law for all security engineering

devd.me
4
19
8
57
Load more