Joe M.

I’ve started reading a new sci-fi book, and it has the single most realistic and terrifying depiction of first contact I’ve ever encountered. It’s called The Killing Star and I can’t stop thinking about it. First, let me save you a click - physical editions are priced in the low hundreds of dollars. Even though the book was only published in ‘95, it must’ve had a small run. The good news is it’s available as an ebook.

Over the years of avidly collecting my niche (New Age science fiction from the 60s and 70s), I’ve picked up a few germs of knowledge about book collecting, preservation, and general enthusiasm. It is an addicting hobby, and like any pursuit, something you can improve at with just a tiny bit of perfectly normal, not-clinical, garden-variety obsession. Buy your Bible Before anything else, buy the excellent Science Fiction and Fantasy Authors: A Bibliography of First Printings of their Fiction edited by L.W Currey (Currey also runs an excellent antiquarian book store you can buy from online. They are one of my favorite stores because of their careful packaging). You can either track down one of slightly rarer-but-still-affordable hardcover editions or purchase a CD of the contents from Currey himself.

Introduction Last year I published my first book with a publisher, Hands on Bug Hunting For Penetration Testers. Going in, I was determined to set up a workflow that would allow me to: Keep a backup of the book. Allow me to easily track my writing progress. Work on the book offline. Keep my own copy of the book. What set of tools could possibly control the versioning, backup, access control, and portability of plain text?

Hands-On Bug Hunting for Penetration Testers is now available. The book covers how to detect, validate, and write submission reports for XSS, SQLi and NoSQLi, XXE, CSRF, and more vulnerabilities, including sections on detecting hidden content, crowdsourcing code injection snippets and other malicious inputs, writing quality submission reports, and more. It uses Burp Suite as a principal tool and proxy, with Python (3.6.5) and Bash scripts thrown in to augment, extend, and automate different testing functions. All the tools used are free. You can find the work in both ebook and print versions:

When I was setting out to revamp my personal blog and create a new site for my book, I had a couple of considerations in mind. I wanted both sites to be highly-available (I don’t get much traffic, but also don’t want a hug of death), simple (with as few moving parts as possible), and easy-to-update and generally extend. All of that led me to a static workflow. Settling on (but not for) Static I love static sites. They’re a zen koan in a universe of epics: As large as they need to be (and no larger). Leaning into static sites means that your application is easy to reason about, since it’s just HTML or a simple template generator. And it’s also easy to deploy and host - even just rsync-ing a folder to an nginx server could do for a basic setup.

Update: The book has since been released. See how to purchase it at handsonbughunting.com or use the Amazon link included in the article below. This October I’ll be releasing my first book with Packt publishing, Hands-On Bug Hunting for Penetration Testers. The book covers: Preparing for pentesting engagements Building an automated pentesting workflow Detecting and reporting OWASP’s Top 10 most common bugs Finding the best bug bounty programs Focusing on testing the right parts of a web application Formatting vulnerability reports to maximize your payouts Going further If you have some experience with penetration testing, it’ll be a good introduction to public bug bounty programs, and if you’re just getting into security, it’s a great series of walkthroughs for getting up to speed - even if you have to search for the meaning of a term or two (or three).