Brevity In Motion

An AWS S3 Cost Savings Tip You Need to Implement

tl;dr - Enable lifecycle policies across all of your S3 buckets to delete incomplete multipart uploads. This will likely save a considerable amount of money across both personal accounts and enterprise account organizations. I saved 30% in S3 storage costs in my personal account by enabling these policies. Walkthrough

Configuring an out-of-band callback listener and notification service in under 10 minutes using AWS Lambda function URLs and Discord webhooks

Amazon Web Services (AWS) just released Lambda function URLs which is the ability to provide external urls to invoke Lambda functions. This is a big deal for many use cases because it eliminates the need to front the Lambdas with an additional service such as AWS API Gateway. The additional

Cloud-based DNS monitoring with IPinfo Enrichment

As the Log4Shell vulnerability progressed last year, there were extensive efforts to setup callback environments for data collection, proof-of-concept development, and vulnerability validation. This intrigued my curiosity and led me to setup my own hosted Interact server (https://github.com/projectdiscovery/interactsh) by Projectdiscovery running in Digital Ocean and highly

Living off the cloud - security, insights, and predictions

cloud. automation. security. resourcing. learning. sustainability. exhaustion. These are all words that describe thousands of hours over the past year related to cloud security. This blog post will articulate: enterprise cloud security challengeslessons learnedpredictions into what will set companies apart in security posturea part 2 article that will provide information

AWS Step Functions to accelerate bug bounty recon workflows

Well... I've been talking about how great AWS Step Functions are for over a year, but have struggled to implement a working solution until now. As I work daily in the cloud security space, I think it is easily misconstrued to think that just because you are an AWS expert,

Bug Bounty Cloud Automation at Scale

Two years ago, I embarked on a journey to become a better, well-rounded security practitioner and really ramped up side projects. Whether you are red team, blue team, purple team, a hacker, an aspiring practitioner, or a seasoned expert, there is a huge opportunity to leverage cloud, automation, and modern

Agile cloud threat modeling - the fractus model

If you are looking for a walkthrough of industry based, formal threat models, this is not the correct place to look. What I am going to share is an agile, light-weight, "fractus" threat model for generating secure configurations for cloud services. The model is limited to 11 questions that can

External IP domain reconnaissance and attack surface visualization in under 2 minutes.

As part 1 of this project #straylight accelerator series, I would like to introduce a repeatable process to visualize the external, global presence of a domain (and all corresponding subdomains). This article will detail the process to retrieve extensive raw DNS data, process it, and visualize it into consumable heat

Introduction — Project Straylight — Security accelerators, mentoring, and collaboration

If you are reading this, thank you! I introduce to you an initial series of articles that I will refer to as Project Straylight. This is a component of a larger vision of Brevity In Motion (a comprehensive collection of content, training, tools, and resources), but right now, we begin