Pomba Labs

(Post exclusivamente em PT-BR).

Truffle Security recently reported that, depending on certain GCP configurations, existing public keys can now be used to access the Gemini API, potentially allowing access to sensitive data or allowing financial DOS attacks: https://trufflesecurity.com/b…

This blogpost showcases some not-so-commonly-advertised benefits and features that modern WAFs have, and how they can be used in an average company to gain benefits ranging from technical to political.

During the year 2023, I was a Cloud Security lecturer at FIAP.

Introduction The following bash script is pretty simple.

Essa talk foi apresentada na B-Sides SP 2022, que ocorreu no dia 20/11/2022.

If you’re using Splunk for Alerting, there is a problem that can occur where an event: Is generated before a scheduled search is executed But is only received after the search is done This will mean that: The scheduled search that should inspect the time-…

Table of Contents Activating IAP with OSLogin (best option) Activating IAP for Project Owners Activating IAP for Admins Activating IAP without OSLogin Introduction IAP Tunneling is extremely useful for acessing resources that don’t have public IPs.

OSLogin requires every SSH key to be tied to a user.

Introduction For some reason, users are forced to activate at least one 2FA method (SMS, token or cellphone alerts) before being allowed to activate TOTP (via Authenticator).

This is a useful command for extracting all files shared with at least one external user in Google Drive.