Hacker Newsnew | past | comments | ask | show | jobs | submit | adricnet's commentslogin

Ange Albertini's work on collisions is pretty great and he makes lots of example images and illustrations.

https://corkami.github.io/

In particular he works on/with the PoC||GTFO team and is responsible for the MD5 collision cover art in a past issue:

https://github.com/angea/pocorgtfo

For SHA-1 (and others) you might find more at his github project:

https://github.com/corkami/collisions

hth,

adric


Probably so, the Security Onion wiki has some recommendations for affordable taps:

https://github.com/Security-Onion-Solutions/security-onion/w...


Thanks for the share this looks great!

It aligns quite well with the study (in diagrams and commented assembly) of x86 in POC || GTFO starting in pocorgtfo04.pdf chapter 3 provided by Shikhin Sethi.


Thanks for the share. I enjoyed this article and may be able to put some of it to work. I don't quite understand all of the negative responses.


The Nature article and notebooks from a few years back are still pretty good for demos, though everything has updated since then , especially iPython -> Jupyter.

https://www.nature.com/news/interactive-notebooks-sharing-th...

hth

adric


s/iPython/IPython/g otherwise it looks like an Apple product :-)


Over The Wire challenges are awesome. Bandit is very educational and easy to start. Others are quite a bit more challenging.


The advice is pretty good overall, but the excessive profanity is unprofessional and distracting.

It is interesting that he values "SANS" certifications, but not the courses for them.

Besides my own rambling[1] you might find these resources valuable instead:

* https://tisiphone.net/category/security-education/

* https://krebsonsecurity.com/category/how-to-break-into-secur...

* https://s3ctur.wordpress.com/2017/06/19/breaking-into-infose...

[1] http://dfirnotes.net/ etc.

hth,

adric


> the excessive profanity is unprofessional and distracting

I strongly disagree. Most security shops I've been in are made up of people who are blunt and speak exactly like that. You absolutely do need to be able to conduct yourself professionally in a professional setting, but when giving advice to folks I tend to use the most informal language I have, which sometimes means this level of profanity.

Not sure how it's distracting.


Besides, you're supposed to all be jaded and curse as a coping mechanism because someone just launched a site with a plaintext password database


This...is actually 100% true. One of the biggest struggles I've personally had in security is to not be super jaded and cynical. Helps immensely to not be in an organization that tolerates (or even rewards) shoddy security practices (at least that's how I solved it).


I do agree. That's actually part of why I called out the language: maintaining balance (as well as not cussing in front of the wrong people) are critical skills for security professionals and sorely lacking in many would-be candidates.

His educational advice was good but the attitude he shares via diction is unhelpful at best especially to folks who do not _yet_ have an awesome job in infosec.

Thanks, have a great weekend, cheers,

adric


I found Tobias Klein's _A Bug Hunter's Diary_ to be quite readable and enlightening even if I couldn't follow all of the code.

https://nostarch.com/bughunter


This mirror of a Purism blog post to his personal blog looks pretty interesting but I'm having trouble accessing it on homelinux or puri.sm domains due to reputation.

Here's G cache: http://webcache.googleusercontent.com/search?q=cache:dH0AFM8...

The OP, afaict: https://puri.sm/posts/primer-to-reverse-engineering-intel-fs...

Thanks for sharing!


Thank you for sharing this. It was interesting and a bit sad.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: