Bobo T. Jones

Breather

Mon, 22 Jun 2026 09:39:17 -0500

I am publishing an incomplete post on proxies along with this one. Not exactly sure what happened but as I tried to compose that post, I found myself getting uncomfortably frustrated. Angry, even. In the grand scheme of things (and in hindsight), it was always likely that web application penetration testing was a stopgap discipline. The shittiness of most web pentesting tools makes that abundantly clear. There was no point to finishing the post because I learned what I needed to learn: the reason I hated doing that work is because while I was good at it, the value of it was obviously decreasing over time. The only people who respect that line of work are other web pentesters. Everyone else shat on us. Even though the sexier hacking was less likely to be exploited in the wild; that will also change in the near future.

Proxies

Mon, 09 Mar 2026 09:59:05 -0500

No surprise, it has not taken long for me to hit something of a productivity sandbar. The post I started writing for today is about proxies… specifically, web proxies for web application assessment work. The goto standard for this tool is Burp Suite from PortSwigger. I have linked to the Community Edition, which is the free version. I’ve never been a fan of Burp, even though PortSwigger has made a fair number of positive changes to the tool over the past maybe 15 years. But I still remember the version that would hang on large server responses or freeze entirely, which was problematic because it did not automatically save any logs or state. I lost a lot of work over those years and I am naturally wired to hold a grudge for a long time.

Secrets Scanning

Wed, 25 Feb 2026 16:27:19 -0600

Secrets scanning is a checkbox for a pentest but it should also be part of a healthy security operations practice. Before I get to the review of the secrets scanning tools, I want to take a wee detour and share a useful Unix (yes, Unix) tool: script(1). The script command logs everything in a terminal session. Most of the tools I am reviewing are run on the command line in a shell and sometimes it is the case that not all of the work I am doing gets saved in a way that is useful for later. It is very useful at the start of a day to run the script command:

ProjectDiscovery Part 2: nuclei

Mon, 23 Feb 2026 14:42:25 -0600

Continuing with the theme of running a pentest, nuclei is a logical next step in the discovery phase after subfinder, in that you have a bunch of targets and you’re going to scan them for known vulnerabilities.

The gist of vulnerability scanning is that there are databases of vulnerabilities scattered around the internet. My goto is the Common Vulnerabilities and Exposures (CVEs) database. These databases are not exhaustive; I’ve personally found and facilitated the remediation of dozens of exploitable oopsies and there are no CVEs (or really anything) with my name on them. Occasionally someone I worked with on an assessment will send me a CVE for something I found and we’ll share a sensible chuckle. See also,

ProjectDiscovery Part 1: subfinder

Mon, 16 Feb 2026 13:25:40 -0600

The first phase of a penetration test is almost always discovery. Up until the middle of 2025, I was still using older versions of OWASP amass and Sublist3r for discovery… until a coworker gently mocked me and told me to use subfinder instead.

It was A Moment for me. I realized just how stale my skills had gotten over the last 4 years. An elephant has never sat on me but I’m pretty sure that’s what it feels like when one does. It hurt. That was the inspiration for this sabbatical project, to catch up on all of the training I was promised over the decades but never seem to get. Meanwhile, the “bills for skills” problem in security is a clusterfuck… we’re all expected to know how to hack into anything and everything, even as tech stacks get more bloated and convoluted, to learn on our own AND pay for the 999 services necessary to, you know, practice? Let’s learn together. My treat.

Starting Line

Fri, 13 Feb 2026 10:37:04 -0600

Reluctantly crouched…

This morning, I created a GitHub repo: bigbookofcyber. The inspiration for this work comes from the awesome repos. I started with enaqx/awesome-pentest. While I have shared this repo with many people who are new to the cybersecurity industry, I have not had much time in the past to download, build and use these tools. Because I was busy working. One of my goals for my current sabbatical is to evaluate as much security tooling as I can grind through, starting with the stuff that is most popular and currently maintained. As I work my way through the top 100 of the nearly 2000 repos I have found so far, I will write at least one post for each. This should keep me occupied for a while.

Hello World

Thu, 12 Feb 2026 00:00:00 +0000

Look! I have a blog! For funsies, here are some survivers from when I tried this before:

After that… yes I know the font looks weird. I am visually impaired. Deal. XD

About Me

Mon, 01 Jan 0001 00:00:00 +0000

Hello

My name is Erin L. Ptacek. I do security stuff, primarily application or product and offensive security stuff. I have also been a systems administrator, a startup founder and a full stack developer when necessary. This nonsense has consumed over three decades of my life. I have opinions.

The T is for Tiberius.

Read This First

Mon, 01 Jan 0001 00:00:00 +0000

My career started in the early 1990s; back then, security was barely a thing. Because of the nature of the work I have done for the last 3 decades, I want to be very clear:

I cannot and will NEVER share specifics about any former clients or employers.

Occasionally I may make observations on the software industry, the cybersecurity industry or the types of people I have encountered in my career. I might write something like “I did the Y2K audit for Charles Schwab” or “I did the first pentest of Twitter,” but I will never provide any details that could be risky.