splintersio

the wallet looks empty to me.

I'd posted this a while back, spelt the domain wrong (yay), it's a tabletop exercise ideally to help people in orgs appreciate that it takes a little bit from everyone to keep that vigilance up for ransomware, and it's a great ethical sparring partner too. - go see what you'll pay for and what you won't.

Don't give tokens away to give Claude a bollocking behind closed doors, vent about it in public, even if it's absent of context.

/plugin marketplace add Splinters-io/cludicrous /plugin install catharsis@vent-plugins

takes notes thank you for the UAT

I have that but I think translations and dialect will make it sound less convincing … I can always add it as a beta

There’s American accents ! Come on, day one it’s fun, if it gets legs I’ll add as much preferences as I can muster up

I’ve disabled adsense so you guys can enjoy it with UX in mind - tho I have allowed for adverts to sneak into the meetings cough

Hah yes

I’ll disable ads! Apologies :)

sorry bud, I'd not made it public at the time of publishing... today's been a long week :)

I'm sort of half in half out of this project, but I've put it out there incase it gives someone a better way of delivering the same kind of 'blinding' ai from context that you're rather it didnt have - ideally someone will pick it up and take it further

Yes Pedro !

Not particularly interesting for the Cyber security folk per-se, but a useful tool via lunch and learn / table top for leadership & xCO set up’s

It will take the players on a journey of ethical dilemmas reflective of real situations, and because there's no good answer other than 'becoming resilient to ransomware' all the answers you give will hurt one thing or another, but there's a nice report and crib sheet of actions when you're done. - sometimes leadershit switch off, but if you can get them engaged you can help them realise this defence nightmare isn't just for the SoC, it's a vertical problem with horizontal commitments. - the value page in the hyperlink is to set expectations, it'll take about 15-20 solo, and longer (for debate, in groups).

Post removed from r/blueteamsec unironically a think capacity challenge I suspect.

It's always irritated me how quite it is after people say 'Don't pay' (I don't think you should pay, and at the same time, the loud voices turn to whispers regarding consequences, this is awful game where everything sucks, because ... budget ? skill ? what... there is a bit of a report / action list once completed and if I've built it right you can share your decisions. the downside is, I couldn't / didn't want to really make it any shorter, it'll cost you about 15 minutes to complete and I know attention spans are about 4 seconds in this era, but here it is, most importantly, nobody is holding you ransom to click the link.

I submitted a vulnerability to Bugcrowd. Out of Scope. I published on my blog. I pointed out it was actually in scope. They acknowledged they'd made a mistake. I took the post down voluntarily. They followed up with a threat anyway. I told them to fuck off. They offered a payment to make it right. Then silence. very funny.

Hacklore, WiFi thoughts ... If I had to boil it down, I'd say they're thinking like cyber security engineers instead of information security officers and even then all they've done is mask nuanced conversations with foundational advice that has been known for years, well done you've replaced interesting conversations with advice older than the devices in question.

this was the precursor to lowlife.network but I just hadn't gotten round to publishing

What Bob and the signatories fail to recognise is that they're attempting to swap out nuanced advice for foundational advice and they're patting themselves on the back for it, actually. that foundational advice has always been

the nuanced advice is for unsolved problems, so ... if you ask a nuanced question, you'll be ... directed back to foundational security advice ?

I don't think they've thought about it, perhaps Signatories shouldn't play risk-advice cosplay at population levels.

I'd be annoyed if this influenced policy because of who they are and not how dumb the logic is.

CSP Header Analysis: Scans websites for Content Security Policy headers Domain Extraction: Identifies all external domains trusted by CSP policies Availability Checking: Uses AWS Route53 to check if trusted domains are available for registration PublicWWW Research: Discovers how available domains are used across the web (optional) Bug Bounty Reports: Auto-generates professional security reports High-Performance Scanning: Beast mode with 1000 DNS concurrency Resume Capability: Continue interrupted scans with wordlist tracking Automatic Organisation: Scan results organised into hot/archive folders

Bonus Intelligence Typosquatting Discovery: DNS enumeration naturally uncovers typosquatted domains that resolve but weren't registered by the target Identifies potential phishing domains Reveals trademark infringement Discovers forgotten test/staging domains Exposes defensive registrations that need monitoring

Using AWS availability checker has some limitations (not full tld support) but it's 100% cheaper than performing a whois lookup

Supporting article (badly formatted) https://thecontractor.io/ghosted/

well, the good news is, that the attacker (should there be one) has to be either on the same flight, or have pesistence (bi-directional entry) into that infrastructure

that's a good edge case for not using a hotspot, but at the same time, i've never been on a flight with 'good' internet, but the main question, what to tell the general population about joining untrusted networks, now, you get thousands of feet in the air, you might think it's a tolerable risk to join sleazyJetFreeWiFi, and I would agree, it's unlikely that it's an evil-twin attack, but coming back to giving population level advice, is this kind of nuance useful ? or just fun

gg