Pinned Tweet
@ZeroNights have published presentation about how we do SAST in Yandex.
At the first part we introduce the orchestrator that unify work with SAST.
At the second part we talk about writing custom queries for CodeQL.
Video: bit.ly/2Yeg1ub
Slides: bit.ly/3ixDopP
Alexei also share some examples on how we write custom rules for Semgrep. Semgrep is unable to make complex taint tracking. Although we use it for rapid writing for rules that look for unsafe programming patterns.
Today me and @tank1st99 make a workshop on #TheSAS2021.
Short intro to our orchestrator. And then we would dive into 50 minute CodeQL journey with a demos. We would discuss how to write queries, cases when CodeQL fails and how to improve analysis quality.
See you at 19:45 MSK.
Evgenii Protsenko retweeted
@yandex developers created the imPulse orchestrator that unifies analyzers’ startup processes. The most important tool of imPulse is CodeQL that helps to find the most severe vulnerabilities. @procenkoeg
Join #TheSAS2021 workshops on Sept 29 to learn more!
thesas2021.online/
Evgenii Protsenko retweeted
GitHub Security Lab disclosed a bug submitted by japroc: hackerone.com/reports/121714… - Bounty: $1,800 #hackerone #bugbounty
Evgenii Protsenko retweeted
Do you use ZooKeeper in your infrastructure? Keep it secure. A story of exploiting ClickHouse vulnerability via ZooKeeper. medium.com/@kyprizel/why-kee…
VolgaCTF conference was held from 17 till 20 of September. And I showed up with a research. It was about selecting functions for fuzzing according to static analysis.
I did it for first time ever. I was so nervous. But this opportunity bring me a lotta emotions to dig in harder
See you at VolgaCTF: volgactf.ru/en/volgactf-2019…. I am going to show up with some fuzzing targets research.