codesnips
ruby 
cookies.encrypted[:trusted_device] = {
  value: { user_id: current_user.id, fingerprint: device_fingerprint }.to_json,
  expires: 30.days.from_now,
  httponly: true,
  secure: Rails.env.production?,
  same_site: :strict,

Signed and encrypted Rails cookies for tamper resistant state

rails cookies encryption
by Kai Nakamura 1 tab
plaintext 
local   all             postgres                                peer
hostssl app_production  app_user        10.0.0.0/16             scram-sha-256
hostssl app_production  reporting_user  10.0.1.0/24             scram-sha-256
host    all             all             0.0.0.0/0               reject

PostgreSQL hardening with pg_hba and strict role separation

postgresql database-hardening roles
by Kai Nakamura 1 tab
plaintext 
bind 127.0.0.1 10.0.0.15
protected-mode yes
port 6379
rename-command FLUSHALL ""
rename-command CONFIG ""
aclfile /etc/redis/users.acl

Redis hardening with ACLs protected mode and network isolation

redis hardening infrastructure
by Kai Nakamura 1 tab
ruby 
Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins 'https://app.example.com', 'https://admin.example.com'
    resource '/api/*',
      headers: %w[Authorization Content-Type],
      methods: %i[get post patch delete options],

Security focused CORS configuration for browser APIs

cors browser-security api-security
by Kai Nakamura 1 tab
ruby 
event_id = request.headers.fetch('X-Event-Id')
timestamp = request.headers.fetch('X-Signature-Timestamp').to_i

raise ActionController::BadRequest, 'stale request' if Time.now.to_i - timestamp > 300
raise ActionController::BadRequest, 'replay detected' if WebhookEvent.exists?(external_id: event_id)

Secure webhook endpoint design with replay protection

webhooks replay-protection hmac
by Kai Nakamura 1 tab
bash 
#!/usr/bin/env bash
docker run --rm -t owasp/zap2docker-stable zap-baseline.py \
  -t https://preview.example.com \
  -r zap-report.html \
  -I

Web application DAST automation with OWASP ZAP baseline scans

dast zap ci
by Kai Nakamura 1 tab
plaintext 
index=auth sourcetype=linux_secure "Failed password" | stats count by src_ip, user | where count > 20
index=proxy "POST" url="*/oauth/token" | stats count by client_ip | where count > 100
index=endpoint process_name=powershell.exe command_line="*EncodedCommand*"

Threat hunting query ideas mapped to MITRE ATT and CK patterns

threat-hunting mitre-attck siem
by Kai Nakamura 1 tab
python 
import requests

response = requests.get('https://crt.sh/', params={'q': '%.example.com', 'output': 'json'}, timeout=15)
response.raise_for_status()
certs = response.json()
print(certs[:5])

Certificate transparency checks for unexpected certificate issuance

certificate-transparency tls monitoring
by Kai Nakamura 1 tab
ruby 
secret = ROTP::Base32.random
current_user.update!(otp_secret: secret)

totp = ROTP::TOTP.new(secret, issuer: 'CodeSnips')
provisioning_uri = totp.provisioning_uri(current_user.email)

TOTP based multi factor authentication for sensitive actions

mfa totp authentication
by Kai Nakamura 1 tab
json 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",

S3 bucket policy that enforces TLS and blocks public reads

s3 aws tls
by Kai Nakamura 1 tab
json 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],

Least privilege IAM policy for an application on AWS

aws iam least-privilege
by Kai Nakamura 1 tab
bash 
#!/usr/bin/env bash
set -euo pipefail

find / -perm -4000 -type f 2>/dev/null | sort
sudo -l
find /etc/systemd/system -type f -writable 2>/dev/null

Linux privilege escalation checks for suspicious local state

privilege-escalation linux auditing
by Kai Nakamura 1 tab