Diogo Mónica

Tired of being told that you should be a leader? Do not worry. Pirate captains had great leadership skills, and they were still beaten to oblivion by Navy Captains who exercised pure command on their ships.

Strategy vs.Tactics is one of the most written-about topics in business, but most business books seem to explain it in ways that hinder both the clarity of thought and the establishment of good conceptual frameworks.

We need to start architecting our data-flows in a way that makes it harder for attackers to continue exfiltrating sensitive data our of our infrastructures

Given that the fork in November might not have replay protection, you'll have to ensure you protect yourself before you transact any BTC.

The rise of the two metrics that matter for host security: reverse uptime and golden image freshness.

If your application requires a password, SSH private key, TLS Certificate, or any other kind of sensitive data, you shouldn't pass it alongside your configs.

The guarantees provided by hashes are of critical importance for security. One of the major points of hashes is, of course, their non-invertibility. However...

Hitless TLS certificate rotation is critical to continue our quest of reducing certificate expiration times, while keeping our sanity intact.

Docker's motto is build once, run everywhere. I put that to the test by migrating my containerized blog to a new Docker hosting platform called Hyper.sh.

Applications will never be perfect, but immutable infrastructure helps with incident response, allows fast-recovery, and makes the attacker’s jobs harder.

In this post I go over how to create a least-privilege CSP policy from scratch.

Even though www.diogomonica.com is a statically generated HTML blog, I took the time to go from an F on securityheaders.io to an A+.

Why the horse battery staple is not correct: We should **not** be incentivizing people to choose passwords in the first place.

I first heard about MultiPath TCP (MPTCP) in 2007 when I met Olivier Bonaventure in Louvain-la-Neuve, Belgium. In the meantime MPTCP has been gaining a ton of traction...

At work we bought a few telepresence robots from SuitableTech called Beam. The Beam robots allow anyone from a remote location to have face-to-face interaction with the people at our HQ. Each Beam robot boasts two wide-angle HD cameras, a 6-microphone array that cancels echo and reduces background noise, a 17" screen, and a built-in speaker. It has a top speed of 3mph, and the battery lasts for 8 hours of active use. The first thing that I thought when I used them the first time was how a

I love food. This means that I'm always competing for reservations at restaurants with the hipsters that are native to San Francisco. Take a peek into the arms race going on in restaurants reservation

Once in a while I open wireshark and just look at my baseline traffic. It's useful for when I actually want to find something weird to quickly distinguish between what's normal and what looks fishy.

Chances are that you have deleted files that you had no backups of. This is the story of how I partially recovered some of my files after deleting them on a Linux ext4 filesystem.

I've been noticing for a while a huge delay when opening new tabs on iTerm (or terminal.app). This would range from 3 to 7 seconds when opening a new tab. It was driving me nuts.

There have been hundreds of articles about the recent password hash leaks from Linked-in and eHarmony.

This tool essentially outputs a list of exploits that you might want to try out after you gain local access to a host. Nothing you cannot do manually, and not the most brilliant tool ever but still, useful. Motivation The next stage after gaining local access to a host is to escalate privileges, right? Typical techniques include: * Manipulation of any custom tools which might installed (SUID files, cron jobs) * Obtaining credentials from backup files (other places) which may have weak f

Services like pastebin.com are useful for sharing and discussing code. However, people trust the generated URLs to be unknown to anyone else, other than the people we want to share them with.

Sometimes, this is all you need: glow:~ dmonica$ python -m SimpleHTTPServer 8000 Serving HTTP on 0.0.0.0 port 8000 ... This simple command has saved me hours of precious time. I've even used it to transfer files between multiple hosts (HTTP server on one end, one wget on all the other hosts). More details here.

Sniffing in OS X has been a reality for quite some time, thanks to the effort of people like the guys from Kismet and KisMAC.

I've just released a tool called py-cookieJsInjection on github.

If you have compromised a system (while doing penetration testing, obviously), or if you are just a BOFH that wishes to have a little fun, you can do something as easy as this.

I wanted to capture, for statistical purposes, the inter-arrival time of packets sent from a remote machine.

Today I needed to merge 40 ~600Mb .pcap

I've had to change my MAC address for countless reasons. Either because I was doing some penetration testing, or just to debug some network errors...

Differences between Monitor VS Promiscuous mode in wireless NICs