Jaime Lightfoot on Constellations

Next up, we’re covering digital forensics.

If something bad happens to your business, you need to recover quickly.

For an interesting look at dealing with risks, you can read “Antifragile.”

At this point, I’m convinced that the book is randomly throwing some exciting chapters (social engineering, embedded systems) in the mix to keep up moral between chapters like this one, haha.

The last chapter in the identity and access management section is all about identity and access management and controls.

The previous chapter covered some basic identity and access concepts.

This chapter begins the section on Identity and Access Management.

The last chapter of the architecture and design section covers physical security.

This chapter covers a number of (you guessed it) resiliency and automation strategies that closely relate to previous chapters.

Following some general DevOps discussion in the previous chapter, the book moves onto cloud and virtualization.

Having worked as a software developer for 3 years, most of the concepts in this chapter aren’t new to me.

This chapter is finally something my speed, after lots of very abstract topics.

Next up, system design.

This chapter is the start of part 3 of CompTIA Security+… Architecture and Design.

Next up in the CompTIA Security+ study guide is implementing secure protocols.

Next up in the CompTIA Security+ series is mobile devices.

Next up in the Security+ book is troubleshooting common security issues.

This next Security+ chapter is on security tools and technologies.

I’m back from lots of travel, and am diving back into my Security+ studying.

The last chapter of the first section of the CompTIA Security+ study guide is about vulnerabilities.

This likely isn’t the first blog post you’ve read explaining penetration testing.

Moving right along from the Attacks chapter (social engineering, application, wireless and cryptographic posts here)… threat actors.

This is the last section of the “attacks” chapter and covers cryptography-related attacks.

Next up in the “Attacks” portion of the CompTIA Security+ study guide is: wireless!

This blog post is a continuation of the CompTIA Security+ “Attacks” chapter.

The next section in the CompTIA Security+ book is about attacks.

The first (real) section of the CompTIA Security+ All-in-One Exam Guide covers “Threats, Attacks and Vulnerabilities.”

I’ve decided to start studying for the CompTIA Security+ exam, and thought that I’d document some of that studying here.

While being one the most straightforward challenges yet, pwnable’s “input” challenge took me a while because there was some C/Linux stuff that I either didn’t know, or that I forgot (sockets, aghgh). 😬 No matter, now’s a great time to (re-)learn it!

I got the CTF zoomies so I’m moving right along to the ‘random’ challenge in the Pwnable.kr “Toddler’s Bottle” CTF series.

We’re back once again with another installment of Pwnable.kr’s CTF series.

The fourth challenge in the “Toddler’s Bottle” series is called “flag.”

Next up in the Pwnable.kr “Toddler’s Bottle” series is ‘bof’.

Up next in the Toddler’s Bottle series is “collision”.

This will be (hopefully!)

In his book The Basics of Hacking and Penetration Testing, Engebretson lays out 4 different stages of testing: reconnaissance, scanning, exploitation, and post-exploitation / maintaining access.

MetaGooFil is a Python script written by Christian Martorella, who also wrote the Harvester to collect email addresses.

Another way for pen testers to learn more about their targets is through DNS servers and records.

WHOIS is a tool (and protocol) used for querying registry databases to learn information about the registered users of an internet resource like a domain name.

Another tool for reconnaissance discussed in The Basics of Hacking and Penetration Testing is “The Harvester,” which is a rather nefarious sounding name for a Python script written by Christian Martorella that finds and catalogs email addresses and subdom…

In addition to the basic set of Google directives covered in a previous post, Google “hacking” can do even more for penetration testers.

Most people are half-way decent at googling their way to the information they’re looking for.

In the “Reconnaissance” portion of The Basics of Hacking and Penetration Testing, Engebretson discusses various methods of collecting data about the target of a penetration test.

Penetration testing is kind of an… unfortunate name, but we’re stuck with it.

I recently zipped through Udacity’s Client-Server Communication course.

SHA stands for Secure Hashing Algorithm.

Transport Control Protocol, or TCP, is in the “Transport” layer (Transport Layer) of the TCP/IP model, or layer 4 of the OSI Model.

What is a MAC address?

The OSI model, or Open Systems Interconnection model, is a way of thinking about computer networking (specifically, the functionality and protocols that comprise it) as different layers of abstraction.

Even people who haven’t gotten too deep into cryptography have likely heard of “Diffie–Hellman.”