Suggestions
Haoxi Tan
Security engineer and infauxsec bullshit detector; red + blue + purple team
Haoxi Tan is a Security Engineer at haksec, based in the Greater Brisbane Area.1 He has experience in both offensive and defensive cybersecurity, describing himself as a "red + blue + purple team" professional.2 Tan is also known for his contributions to open-source security projects, with 176 repositories available on GitHub.3
Tan is an accomplished security researcher, having shared tips and best practices for finding XSS vulnerabilities in a blog post for HackerOne.4 He holds the OffSec Certified Professional (OSCP) certification, demonstrating his ability to identify vulnerabilities and execute organized attacks.5
In addition to his technical skills, Tan describes himself as an "infauxsec bullshit detector," suggesting a critical approach to security practices and claims.2 His work focuses on using technology and security for social good, as evidenced by his GitHub profile.3
Highlights
Since Ivanti hasn't released a patch yet for their #pulsesecure #vpn CVE-2023-46805 & CVE-2024-21887 (which are actively exploited by APTs), I have made a #nuclei template for scanning whether or not their mitigation XML file has been applied:
https://lnkd.in/gvfVgtp7
Thanks to watchTowr for their reverse engineering research to make this possible (https://lnkd.in/gqSvs3yB)
I had a read of Craig Ford's #Foresight tonight and honestly I am disappointed and find it a laughing material for a book so shamelessly marketed on LinkedIn by a "best selling author" asking people to post generic nice video reviews.
With the inaccurate references to hacking tools and techniques (such as "Cloning her IP", "executing the webcam and mic" and "vulnerable to credential caching"), I can clearly tell that Craig has not hacked a single thing in years, let alone done a real pentest.
Between the wild fantasies a school "forcing" a student to compete in a CTF, Sam leaving most of her "best Linux distros" at home and her loading a "skater chick" video upon owning (not pwning?) the event infrastructure, its obvious that the author is trying really hard to relate to teenage hacker culture albeit never experiencing it himself as a teenager nor hacker.
I don't blame him for being the imposter. But this quality of comic strip writing barely passes for year 12 English. Please don't call it a "best-selling series".
