Viewing profile — yatralalala

Internet is no longer decenstralised. Some interesting DNS data https://news.ycombinator.com/item?id=46159249

Given what's happening with Cloudflare downtimes, we looked at internet centralisation. GoDaddy and Cloudflare alone host ~106 millions of domains – about one-third of all the doma…

I'm all for in for it. Sadly, companies host wild stuff and forget about it. What we build is primarily focused on companies that have at least hybrid stack - some on prem, some in…

I'm building Recon Wave ( https://reconwave.com ) - we monitor companies online perimeter and let them know when something's wrong. Recon Wave basically finds and scans all their s…

Sorry for a bit of self promo, but just to explain we run https://reconwave.com/ , basically EASM product but more focused on network/DNS/setup level. Finding all things about doma…

See my comment above https://news.ycombinator.com/item?id=43289743 there are many techniques!

Zone transfers are super interesting topic. Thanks for mentioning that. It's basically the way how to get all DNS records a DNS server has. Interestingly in some countries this is …

If you're using infra in a way [cloudflare -> your VM] I'd recommend setting firewall on the VM in a way that it can be accessed only from Cloudflare. This way, you will force ever…

Lifehack - it's especially awesome in cases where server operator is using self-signed certs / private cert authorities. Because you will not find these in public cert logs.

As always, depends on your threat model. Generally having private IPs in public DNS is not great, because potential attacker gets "a general idea" how your private net looks like. …

I sadly did not see the comment above, but I'd like to just add, that this bruteforce and sniffing methods are target only against our paying customers. We built global reverse-DNS…

So many thoughts on that, but from my perspective - obscurity is ok, but you can not depend on it at all. Great example is port knocking - it hides your open port from random nmap,…

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested…

similar thing - https://search.reconwave.com/ - but it's passive and includes reverse dns search (all domains for given IP)

TLDR: they're used as a revocation mechanism for DKIM. non "paywalled" link: https://threadreaderapp.com/thread/1852021884902138123.html

TIL: there's .su gtld

Very nice, I read one of your blog posts [0] and was pretty surprised, great read! Good luck on your journey. [0] https://reconwave.com/blog/post/storing-private-keys-in-txt-...

Yup, it kinda makes sense, but I agree with other commenters there that plausible deniability is not as strong here.

Oh wow, just recently started a discussion about this on reddit [0]. Still seems pretty bad idea in all possible scenarios. I don't believe that this "plausible deniability" would …