Eduard Schwarzkopf

Eduard Schwarzkopf

Latest — Jun 4, 2024

Visit from a sad and hot R2D2

Debugging is a crucial skill in the world of software engineering. It is far more common to read code than to write it. Knowing how to approach a problem systematically is what makes a good developer, an even better one. The best part? You can transfer this skill to any

More issues

CloudGoat - Fixing vulnerable_lambda scenario

This is a follow-up to my recent blog post CloudGoat – vulnerable_lambda with Pacu. In my recent exploration of cloud vulnerabilities with the help of Pacu and CloudGoat by Rhino Security Labs, we were able to demonstrate how a combination of overlooked permissions and an SQL injection vulnerability in a

FastAPI with async Celery tasks

Like all developers with too many side projects and an immense imposter syndrome, I was working on the next great feature for my side-project. Import via CSV! First I implemented a working solution with FastAPI's BackoundTasks feature. But this didn't feel right. In the documentation Celery recommended, so I go

CloudGoat - vulnerable_cognito

Deploying a secure environment in AWS is like threading a needle in the vast expanse of cloud services—a single misstep can leave you vulnerable to a security breach. This post will delve into the intricate details of deploying a vulnerable AWS Cognito scenario using CloudGoat and document every twist

flAWS Write-up

flAWS, the brainchild of Scott Piper from Summit Route, is a unique cloud security game designed to educate users on the common pitfalls and misconfigurations that can occur when employing Amazon Web Services (AWS). Unlike traditional web-based security challenges, flAWS focuses exclusively on AWS-specific issues, eschewing more commonplace vulnerabilities like

CloudGoat – vulnerable_lambda with Pacu

As I aim to sharpen my cloud security expertise, I embrace the concept of practical, hands-on experience. Rhino Security Labs provides the indispensable tools for this journey. CloudGoat will deploy intentionally vulnerable cloud environments. Yes, intentionally vulnerable! So when you use it yourself, make sure to use a dedicated AWS

Secure Your AWS Account: The Critical Importance of MFA and the Ease of a CloudFormation Stack

The world of cybersecurity is grappling with increasingly complex threats, with sophisticated cyber-attacks becoming the norm rather than an exception. A testament to this is the recent revelation from Microsoft, where the security team uncovered an intrusion by a nation-state actor dubbed Midnight Blizzard. The attack unveiled a critical gap:

How to backup your SMB shares and blob storage from Azure to AWS with DataSync

Introduction Have you ever been in a situation where you had files on Azure but would like to have them on another cloud provider? Well, one of our customers had exactly this requirement. We provided a solution for this problem and since sharing is caring, I’m going to provide

Website under attack: Insights into a WordPress security attack

One morning a client contacted me because his website had some cool new sweepstakes on his WordPress instance. Unfortunately, he also told me that this is probably not from him, but his site is probably compromised. So, nothing to win here. This means I have to see what exactly happened

I Exposed AWS Access Keys, On Purpose: Here's What I Learned and How I Boosted Incident Response

Introduction Who doesn't know that, you just write a quick fix for your code? After a few hours, the function is finally finished. Proud to have finally done it. Your Brain, toast. Your commit, fast. Pushing your credentials without realising, even faster! Let's find out what happens next. It happens