Viewing profile — kmcquade

These guys do an insane amount of engineering to speed up builds and everyone follows. Love their blogs. Zero chance I'd sign up for their competitors knowing how good the product …

[flagged]

Depot is freaking awesome. Sped up two of our Docker image builds from 11 minutes to 1-1.5 minutes and the drop-in Docker build replacement in GitHub Actions was super easy. Can't …

Love using Depot. The speed improvements are insane

> the tool can discover incorrect configurations that would allow someone who extracted the key to change permissions of the bucket. Nit: The tool can discover and abuse excessive …

Yes, you'd have to leverage compromised credentials. That could be obtained via SSRF, RCE on a privileged box, leakage of user access keys, or other means. In the context of a pene…

Aw, thank you. I really appreciate that.

Great feedback! I will update the docs accordingly.

Not sure. I did uncover a ridiculously destructive approach to abusing Azure Service Principals in CI/CD pipelines that deploy infrastructure in Azure (Confused Deputy problem): ht…

Dry run as default is a good idea. I'll open a GitHub issue for that. FWIW, if you run `endgame smash` with `--service all`, then it spits out a huge "WARNING" in ASCII art with an…

Thanks :)

Author here :) Endgame exploits/abuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied feat…

Did you open source it? If not, you definitely should.

I wish.

You are so right on the SELinux comparison. Of course, in this case, there are way more developers that are required to write them. Reiterating what was mentioned in the thread - t…

You just need a single IAM action - iam:GetAccountAuthorizationDetails ( https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetA... ). I’ll definitely add that to the README. …

PMapper is definitely a great tool. It’s best used in Pentests for validating some privilege escalation paths. It has the benefit of analyzing IAM trust policies, resource based po…

Thanks! I’m glad you like it. Let me know if you have any feedback - here, in the Gitter channel (link in the Readme), or on Twitter (kmcquade3)