I have grumped and groaned about being bored recently and I was called out by Dinis Cruz from OWASP. He suggested that I get involved with OWASP (back in April) and I have signed on and am ramping up the rusted out technical side of my brain. A funny aside, when I was at Defcon I was jumping into a cab after the second day with Myrcurial. There was an extra seat so I offered to a guy standing waiting for a ride. After talking this guy up for a couple minutes we came to the realization that we had talked before. It was Dinis Cruz. Very weird/cool. That is a downside to this line of work. We tend to “talk” to hundreds of people never having a face to put to the name.

OK, where was I, oh yes, rust removal. As part of my endeavour to get things rolling along I signed up to take the course offering Web Application (In)security that was being offered at Black Hat (originally I had signed up for David Litchfield’s course but figured I was way out of my depth). The course was fantastic. It was taught by two gents from NGS Software, Dafydd Studdart and Wade Alcorn. It got the brain churning again. Much to my chagrin I learned later on that the winner of the in class CTF was offered a job. I guess I should have worked harder at that challenge.

For another component of the rust removal I picked up the book XSS Attacks. This collective effort from Jeremiah Grossman, Robert Hansen (RSnake), Petko Petkov (pdp), Anton Rager and Seth Fogie has been a blast of a read. Since I have been reading this book I have managed to torment some friends by messing with their websites and the like. This has also has managed to reacquaint me with JavaScript and just how powerful it truly can be. As a result, I have decided to head back to school (nights) to take programming. It has been ten years since I wrote any code so, I’m heading back to the beginning. I envision a rather humbling experience sitting in a room with a bunch of teenagers learning programming logic and Java. It has been over a decade since I last was a student.

This should be interesting.

So, thanks to the likes of PortSwigger, Wade, Dinis and others who have collectively (if inadvertently) given me the kick in the ass that I sorely needed.

Tags: Dinis Cruz, OWASP, XSS, Javascript, Back to School