Brennon Thomas
Infosec / Automator / Builder / Creator
Hello! I'm Brennon and I love building at the intersection of infosec, Python, automation, and APIs. These days, I find building more rewarding than breaking and love the creation of new tools, frameworks, and processes and excel at distilling strategic high-level problem sets into tactical and operational solutions that are sustainable and secure.
I've been in the information security field for 19 years doing everything from computer network exploitation, hunt, research/development, vulnerability analysis, bug bounties (disclosing and responding), and computer network operations.
Opsdisk LLC is used for my various side projects. If you're a startup, established company, or have an interesting product or idea I may be able to help or consult with, feel free to reach out via Email, LinkedIn, or Twitter / 𝕏
Projects
- PhishBarrel - My magnum opus, PhishBarrel is a security-focused API for your organization's inbound email, enabling your Incident Response team and network defenders to identify, search, and remediate phishing emails faster. PhishBarrel was acquired by Arctic Wolf in 2021. I currently work on this full time at Arctic Wolf and lead our email security and analytics platform development.
- The Cyber Plumber's Handbook and Interactive Lab - The definitive guide to SSH tunneling, port redirection, and bending traffic like a boss. The book is free and the interactive lab access can be purchased here.
- Scantron A distributed nmap / masscan scanning framework complete with scan scheduling, engine pooling, subsequent scan port diff-ing, and an API client for automation workflows. The original code was developed and open-sourced while I was working at Rackspace. It is the most starred open source project in Rackspace's history.
- pagodo Automate Google Hacking Database scraping and searching using Google "dorks".
- yagooglesearch - Yet another googlesearch - a Python library for executing intelligent, realistic-looking, and tunable Google searches.
Code Repositories
I publish code under two GitHub users, one for personal projects and the other for software developed while working at various employers.
Blog
My blog can be found at here
Presentations / Publications
-
BSides SATX 2019 - There's
no place like 169.254.169.254 - Ab(using) cloud metadata URLs". The research was featured in the Wall
Street Journal article How the Accused Capital One Hacker Stole Reams of
Data From the Cloud.
- BSides Austin 2019 - Scantron - A distributed Nmap / masscan scanning framework
- Seventh Annual IFIP WG 11.9 International Conference on Digital Forensics (2011) - An FPGA-Based System for Detecting Malicious DNS Network Traffic
Certifications
- Offensive Security Certified Professional (OSCP) - Certification ID OS-101-05743
- Azure Security Engineer Associate (AZ-500)
- Azure Fundamentals (AZ-900)
- Amazon Web Services Certified Solutions Architect