Viewing profile — ncc-erik

My measurement was imprecise and that probably throws things off: python -m timeit '641352894770715802787901901705773890848250147429434472081168596320245323446302386235987526683477…

Found in 2700 core-years, verified in >>> 64135289477071580278790190170577389084825014742943447208116859632024532344630238623598752668347708737661925585694639798853367*333720275949…

I maintain an open-source project [1] that uses graphs to model data. I wanted to make my project as accessible as possible, so Graphviz was perfect since it's dead-simple to insta…

I think what makes this hard for folks is tracking what the expected form of data is at each step of its lifecycle, especially considering people working with new and unfamiliar co…

Depending on what your job role is, this last weekend probably sucked. But IMO it's also pretty typical that a few of these sorts of events happen every year. Reminder that this ex…

Not a ton of benefit here, because drawing attention without having the patch fully ready means more eyeballs looking. More eyeballs means someone inevitably finds and exploits/pub…

I only imported 10 dependencies, but those 10 dependencies each had 10 dependencies which each had 10 dependencies which each had 10 dependencies and all of the sudden I'm at 10k d…

I took a networks class during college, and there was a homework question from the textbook about a scenario like this. It had you compare transferring a large amount of data over …

The one a lot of folks know about was the soft hyphen (U+00AD) to bypass swear filters. I was able to use normalization to create XSS attacks.

Very comprehensive blog, nice work. As a pentester, I always get excited when I see ACAO or an OPTIONS request in my proxy logs. It's still really hard to wrangle and get right.

Neat project, thank you for sharing. Do you currently, or plan to, handle Condition constraints? Also, how does wonk handle combinations with statements that have the Deny effect?

Big shoutout to lru_cache. I tossed in two lines of code and was able to get a 60x speedup in my code by reducing the amount of regular expression compilations I had to do.

I saw an app prefix the prompt to allow tracking with a similar-looking pop-up that said something like "please press allow on this next step ...". That pop-up only had one button,…

It will stand alone, but I keep in touch with the ScoutSuite folks. I'm thinking at some point I'll build in graph-creation based off of ScoutSuite's data collection.

Hi HN! Principal Mapper is a tool + library for analyzing and securing your AWS IAM configuration. It generates a model of your account and/or organization and uses it to give you …

Thanks for the PMapper shoutout!

Note: I am a current NCC Group employee. It does one thing very well: quickly grabbing a snapshot of the security posture of a public cloud account's resources with little fuss. It…

My go-to link for that class of issue is: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simpl... It's usually a lot easier to write the PoC with fetch() though.