Devs - Author - Incidental InfoSec Bloghttps://incidentalinfosec.com/authors/devs/Devs - Author - Incidental InfoSec BlogHugo -- gohugo.ioenWed, 19 Jan 2022 00:00:00 +0000Splunking DLP data with a side of active responsehttps://incidentalinfosec.com/posts/splunking-dlp-data-with-a-side-of-response/Wed, 19 Jan 2022 00:00:00 +0000devshttps://github.com/t-devshttps://incidentalinfosec.com/posts/splunking-dlp-data-with-a-side-of-response/Recently, I was attending a corporate event via conference call and I noticed a distinct phrase being mentioned over and over by the event speakers. “Please refrain from taking screenshots of these slides as they are not meant for public disclosure.” Sound familiar to anyone? How many people are actually going to abide by this suggestion?

For in-person events, this warning may be enough to ward off the rogue mobile phone picture taker…but let’s face it…when people are at home, in their office, not thinking that they are being “watched”, they definitely are going to take that screen capture (and potentially send it elsewhere). Don’t believe me?

]]>WORMCON CTF - 2021https://incidentalinfosec.com/posts/wormcon-ctf-2021/Mon, 30 Aug 2021 00:00:00 +0000devshttps://github.com/t-devshttps://incidentalinfosec.com/posts/wormcon-ctf-2021/

WORMCON CTF occurred this weekend and I had a fun time digging through a handful of Forensics and Networking challenges.

This challenge provided a PCAP file that contained quite a bit of FTP traffic. As I’m sure most know, FTP does not encrypt data while in transit. This provided me with a good starting point to try and gather some information.

Figure 1: Protocol hierarchy

Sure enough, one of the first things I noticed in the FTP requests is a username and password. I’ll hold onto this information for later.

]]>CorCTF - 2021https://incidentalinfosec.com/posts/corctf-2021/Tue, 24 Aug 2021 00:00:00 +0000devshttps://github.com/t-devshttps://incidentalinfosec.com/posts/corctf-2021/

Lately, I’ve been keeping my eye out for interesting CTF’s to compete in. This past weekend, the corCTF team hosted their own event and boy was it a tough one. Being primarily a forensics guy, I was definitely out of my comfort zone with many of the challenges being binary exploitation, reversing, and cryptography. I clung onto anything that looked familiar and in the end was able to crack a web challenge for a few points. Here’s to getting stronger with reversing + coding for the next go around!

]]>GuidePoint Security CTF - August 2021https://incidentalinfosec.com/posts/guidepoint-security-ctf-august-2021/Fri, 20 Aug 2021 00:00:00 +0000devshttps://github.com/t-devshttps://incidentalinfosec.com/posts/guidepoint-security-ctf-august-2021/

It’s been a while since I had a chance to sit down and tackle a CTF. Lucky for me, GuidePoint Security recently ran their August iteration and it gave me a chance to brush off some cobwebs! I wasn’t able to solve all the challenges (damn you Python!) but had a pretty good idea on how to approach most of ’em. Below are some write-ups on ones that I had fun trying to solve.

]]>Abouthttps://incidentalinfosec.com/about/Sun, 08 Aug 2021 18:47:21 -0400devshttps://github.com/t-devshttps://incidentalinfosec.com/about/

I run into wacky, interesting, and confusing things working within the InfoSec industry. Most of the time I don’t know what I’m doing and am scared. Hopefully I can share my trials and tribulations with others through this blog. After all, the best way to learn yourself is to teach others!

I’ve spent the last 6 years working in cybersecurity operations. What does that mean? Hats…lots and lots of hats. Spend enough time in this field and you’ll realize just how much information there is to learn.

]]>SOC work. A walk through the trenches. [Part 1]https://incidentalinfosec.com/posts/soc-work-a-walk-through-the-trenches-part-1/Sun, 08 Aug 2021 00:00:00 +0000devshttps://github.com/t-devshttps://incidentalinfosec.com/posts/soc-work-a-walk-through-the-trenches-part-1/

It’s no secret that working in a Security Operations Center (SOC) can be a demanding, thankless, and tough job (with it only getting tougher). This is especially true for folks just getting started in the industry who are building the foundational skills required for career progression. Working long hours, weekends, holidays…this is the side of cyber they don’t tell you about… If you’re not prepared for it, you might start asking yourself “What the hell did I just get myself into?”. I know I did…

]]>