Exploring the intersection of Data Science & InfoSec.
I know more about x509 and TLS than your average person out walking their cat.
Opinions are my own
my tags: #mlsec
| @turbocodr | |
| https://www.linkedin.com/in/jconwell/ | |
| Github | https://github.com/jconwell |
| Web Site | https://www.iamjohn.me/ |
I’m researching C2 beaconing and would love to talk with anyone who 1) has hands-on experience operating C2 for red team activity or 2) has first-hand observed and researched how people operate C2 servers. Please DM me if you would be willing to talk and answer some questions.
Boost for wider reach if you would
I'm happy to be releasing an update to my open source project, FQDN Parser, that adds the ability to calculate the entropy of a domain name or FQDN
The library calculates the proper character probability distribution for domain names and FQDNs from the latest Cisco Umbrella Top 1 Million FQDNs
https://github.com/jconwell/fqdn_parser#domain-name--fqdn-entropy-calculation
fqdn_parser (Fully Qualified Domain Name Parser) is a library for parsing FQDNs into their component parts, as well as providing additional contextual information about TLDs, multi-label domain suf...
One of the hard things for me about being unemployed is feeling like an abject failure. Not because I was laid off, that part sucks but I get the economics behind it.
It’s because I don't have a purpose. I wander about each day, looking for a job, doing research, working on open source projects, or on my conference talk...but to what end? What is my purpose?
There are so many things to do, but without a defining purpose it's sometimes hard to find motivation and focus to really dive into any of them.
Well shit...I just put the above question into google and it returned the title
Companies should really stop sourcing email addresses from their careers portal to use in their marketing channel. In no scenario will this be appreciated:
1) Applied for a job: “Oooo, did I get an interview?!?! <sigh> No, just marketing”
2) Waiting for an offer: “oh my gosh, did I get an offer?!?!?! <louder sigh> No, just marketing”
3) Got the job: “I work here! Why would I buy the product?”
4) Didn’t get the job: “Seriously? Too soon buddy, way too soon”
LinkedIn job text search kinda sucks. Here are some tips I found: use AND OR NOT in all caps to control boolean logic. Use quotes for multi-word search, and use parentheses for combining boolean operators
Example: (security AND "machine learning") NOT "on site"
Blue/Red Team question: does anyone have an observed example of an someone using x509 certs as part of their offensive tactics, beyond data encryption that is?
I’m putting together a talk on x509 certs and want to cover some historic examples of offensive usages in either red team or bad actor operations.
Please boost for distribution if possible
