Independent notes on information security
Stay curious.
Look closer.
I’ve always wanted to understand how things work—and what happens when they don’t. Security, research, and code are where that curiosity takes me.
The thread that connects it all: curiosity.
My background
My career has taken me from software development and systems administration to information security.
Read my story ↗Published writing
All writing ↗An API authorization test matrix for tenant isolation
Cyber Kill Chain Analysis: Evidence, Gaps, and Defensive Opportunities
Intrusion Analysis: From Alert to Defensible Findings
A threat-model worksheet for a design review
A vulnerability triage checklist that records the decision
Tool Release: OSINTive
OSINT, aka know thy enemy.
Passwords, aka that thing people hate and try their hardest to mess up.
Things I build
All tools ↗From the workbench
killthegibson
A Linux log-removal script recreated from the #OpNASADrones pastebin. Destructive: removes log files, not just symbolic links.
Read about the tool From the workbenchrobotsrecon
A reconnaissance tool that reads a website’s robots.txt file and checks whether its disallowed paths exist.
Read about the tool