𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗔𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 Learn Map

Using Hermes’s Quicksort to run Doom: A tale of JavaScript exploitation

https://engineering.fb.com/2022/07/20/security/hermes-quicksort-to-run-doom/

PART 1: How I Met Your Beacon – Overview

…During this research we will outline a number of effective strategies for hunting for beacons, supported by our BeaconHunter tool that we developed to execute these strategies and which we intend to open source in due course. In the following posts to this research, we will then step in to a number of case studies for applying these detections to a variety of both commercial and open source frameworks…:

https://www.mdsec.co.uk/2022/07/part-1-how-i-met-your-beacon-overview/

Azure Red Team Attack and Detect Workshop

https://github.com/mandiant/Azure_Workshop

Moving from NGINX to Caddy v2

https://seanchenpiano.com/pianonotes/2021/09/11/moving-from-nginx-to-caddy-v2/

Boundary tool - Identity-based access for zero trust security

* https://www.boundaryproject.io/

#tool

Bolt like as Ansible alternative

Bolt is an open source orchestration tool that automates the manual work it takes to maintain your infrastructure.

* https://puppet.com/docs/bolt/latest/bolt.html

#tool

Artillery - Cloud-scale performance testing

Very easy tool for web services benchmarking…:

* https://www.artillery.io

#tool

2022 Unit 42 Incident Response Report

Executive Summary: Every week brings news about threat actors—new campaigns, new groups, new types of attacks, new targets. Defenders can easily wind up playing catchup, but what does it take to flip the noscript?..

Big report abpout of top attacks trends and etc.

Build an automated ecommerce app with WhatsApp Cloud API and Node.js

https://blog.logrocket.com/build-ecommerce-app-whatsapp-cloud-api-node-js/

7 Daily Hacks For Programmers To Make Coding Skills Faster

https://dev.to/devsimc/7-daily-hacks-for-programmers-to-make-coding-skills-faster-a68

Indoor optical fiber eavesdropping approach and its avoidance

🪢 A fast native data type for manipulating large strings in Redis

https://github.com/ekzhang/redis-rope

Gum - A tool for glamorous shell noscripts. Leverage the power of Bubbles and Lip Gloss in your noscripts and aliases without writing any Go code

https://github.com/charmbracelet/gum

#tool #review

The Four Golden Signals for SRE

The four golden signals of monitoring are latency, traffic, errors, and saturation. If you can only measure four metrics of your user-facing system, focus on these four…:

https://sre.google/sre-book/monitoring-distributed-systems/#xref_monitoring_golden-signals

Dart Tutorials

https://dart.dev/tutorials

OctoSQL - is a query tool that allows you to join, analyse and transform data from multiple databases and file formats using SQL:

https://github.com/cube2222/octosql

Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service (LSASS)

Process enumeration is necessary prior to injecting shellcode or dumping memory. Threat actors tend to favour using CreateToolhelp32Snapshot with Process32First and Process32Next to gather a list of running processes. And if they’re a bit more tech-savvy, they’ll use the NtQuerySystemInformation system call directly.

Although this post will focus on obtaining a PID specifically for LSASS, the methods described here can be adapted to resolve PIDs for any process. Some of these are well known and have been discussed before, but there’s also a few new ones that many readers won’t be familiar with…

* https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/

What Is Bun.js and Why Is the JavaScript Community Excited About It?

https://www.makeuseof.com/what-is-bunjs-why-the-javanoscript-community-excited/