hacking: security in practice
Nmap MS-SQL Server Recon

MSSQL is Microsoft' SQL Server used by many companies. In this post, I have covered how to perform reconnaissance against the MSSQL server with the Nmap tool.

From scanning ports to execute arbitrary system commands, Nmap is used

https://www.secjuice.com/recon-basics-mssql-server/

submitted by /u/tbhaxor
[link] [comments]

hacking: security in practice
Is it possible for a totally random stranger on kik to find my address? They know nothing about me

They're threatening to find me and stuff....... I'm a little scared

submitted by /u/WereWolf_Engine
[link] [comments]

Functionality Bypass — IDOR
https://antaramane.medium.com/functionality-bypass-idor-7df76e15e77b?source=rss------bug_bounty-5

OTP Bypass to IDOR (Insecure Direct Object Reference)Continue reading on Medium » (https://antaramane.medium.com/functionality-bypass-idor-7df76e15e77b?source=rss------bug_bounty-5)

Medical Provider — Reflected XSS in Search Results
https://medium.com/@pr1sas/medical-provider-reflected-xss-in-search-results-2dc829c50543?source=rss------bug_bounty-5

Yesterday I read a Medium article where another security researcher discovered some interesting issues in a medical provider subdomains…Continue reading on Medium » (https://medium.com/@pr1sas/medical-provider-reflected-xss-in-search-results-2dc829c50543?source=rss------bug_bounty-5)

Hacking on Medium
The Hacker that Double Crossed the Secret Service

https://cdn-images-1.medium.com/max/600/1*lY8Q0YK1T-XUhrFipyqWzQ.jpeg
Life advice; don’t bite the hand that kept you out of federal prison.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Krane - Kubernetes RBAC Static Analysis And Visualisation Tool

https://1.bp.blogspot.com/-mnxsu5qcoZs/YLc2t6BK9FI/AAAAAAAAXuI/tFELTagA54UfUVTRjljGXS5hvoGN4rlawCNcBGAsYHQ/w640-h590/krane.png Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its definition. Features* RBAC Risk rules - Krane evaluates a set of built-in RBAC risk rules. These can be modified or extended with a set of custom rules.
* Portability - Krane can run in one of the following modes:
* Locally as a CLI or docker container.
* In CI/CD pipelines as a step action detecting potential RBAC flaws before it gets applied to the cluster.
* As a standalone service continuously analysing state of RBAC within a Kubernetes cluster.

* Reporting - Krane produces an easy to understand RBAC risk report in machine-readable format.
* Dashboard - Krane comes with a simple Dashboard UI helping you understand in-cluster RBAC design. Dashboard presents high-level overview of RBAC security posture and highlights detected risks. It also allows for further RBAC controls inspection via faceted tree and graph network views.
* Alerting - It will alert on detected medium and high severity risks via its Slack integration.
* RBAC in the Graph - Krane indexes entirety of Kubernetes RBAC in a local Graph database which makes any further ad-hoc interrogating of RBAC data easy, with arbitrary CypherQL queries. Local Quick StartGet started locally with Docker Compose. PrerequisitesIt is assumed that you have docker running on your local machine. Install docker-compose if you haven't already. Run Krane locallyKrane depends on RedisGraph. docker-composestack defines all what's required to build and run Krane service locally. It'll also take care of its RedisGraph dependency. docker-compose up -d Krane docker image will be pre-built automatically if not already present on local machine.

Note that when running docker-composelocally, Krane won't start RBAC report and dashboard automatically. Instead, the container will sleep for 24h by default - this value can be adjusted in docker-compose.override.yml. Exec into a running Krane container to run commands. Local docker-composewill also mount kube config (~/.kube/config) inside the container enabling you to run reports against any Kubernetes clusters to which you already have access to. # Exec into a running Krane container

docker-compose exec krane bash

# Once in the container you can start using `krane` commands. Try `krane -help`.

$ krane -hTo inspect what services are running and the associated ports: docker-compose ps To stop Krane and its dependency services: docker-compose down Usage GuideCommands$ krane --help

NAME:

krane

DESCRIPTION:

Kubernetes RBAC static analysis & visualisation tool

COMMANDS:

dashboard Start K8s RBAC dashboard server
help Display global or [command] help documentation
report Run K8s RBAC report

GLOBAL OPTIONS:

-h, --help
Display help documentation

-v, --version
Display version information

-t, --trace
Display backtrace when an error occurs

AUTHOR:

Marcin Ciszak Generate RBAC reportWith local kubectlcontextTo run a report against a running cluster you must provide a kubectl context krane report -k You may also pass -c flag if you plan to run the tool against multiple clusters and index RBAC graph separately for each cluster na[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Krane - Kubernetes RBAC Static Analysis And Visualisation Tool

___________________________
@hacking_Attack
@Hacking_Video

Missed the boat on hardware?
https://www.reddit.com/r/Pentesting/comments/ntx61n/missed_the_boat_on_hardware/

I've been looking to expand my skillset a bit and I was hoping to invest in some hardware for on-site pen testing. But besides maybe the Pineapple, it kind of feels like nothing is available. I found a ton of articles about all kinds of cool covert devices that were disguised to be able to leave in plain sight, and be able to provide tons of functionality in tiny packages. But those are all from like 2016-2018, and it seems like every project got discontinued, all the people ended up getting sucked up by companies and their tools taken off the internet. Obviously a few things like the pineapple and various USB keys are still available, but everything else is gone. So, am I just completely failing at my Google abilities and I'm missing out on all the good stuff, or is it really the case that the glory days are over? submitted by /u/QuerulousPanda (https://www.reddit.com/user/QuerulousPanda)
[link] (https://www.reddit.com/r/Pentesting/comments/ntx61n/missed_the_boat_on_hardware/) [comments] (https://www.reddit.com/r/Pentesting/comments/ntx61n/missed_the_boat_on_hardware/)

___________________________
@hacking_Attack
@Hacking_Video

Krane - Kubernetes RBAC Static Analysis And Visualisation Tool
http://www.kitploit.com/2021/06/krane-kubernetes-rbac-static-analysis.html

___________________________
@hacking_Attack
@Hacking_Video

Krane is a simple Kubernetes (https://www.kitploit.com/search/label/Kubernetes) RBAC static analysis (https://www.kitploit.com/search/label/Static%20Analysis) tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its definition.
Features
RBAC Risk rules - Krane evaluates a set of built-in RBAC risk rules. These can be modified or extended with a set of custom rules. Portability - Krane can run in one of the following modes: Locally as a CLI or docker container (https://quay.io/repository/appvia/krane?tab=tags). In CI/CD pipelines as a step action detecting potential RBAC flaws before it gets applied to the cluster. As a standalone service continuously analysing state of RBAC within a Kubernetes cluster. Reporting - Krane produces an easy to understand RBAC risk report in machine-readable format. Dashboard - Krane comes with a simple Dashboard UI helping you understand in-cluster RBAC design. Dashboard presents high-level overview of RBAC security posture and highlights detected risks. It also allows for further RBAC controls inspection via faceted tree and graph network views. Alerting - It will alert on detected medium and high severity risks via its Slack integration. RBAC in the Graph - Krane indexes entirety of Kubernetes RBAC in a local Graph database which makes any further ad-hoc interrogating of RBAC data easy, with arbitrary CypherQL queries.
Local Quick Start
Get started locally with Docker Compose.
Prerequisites
It is assumed that you have docker (https://docs.docker.com/get-docker/) running on your local machine. Install docker-compose (https://docs.docker.com/compose/install/#install-compose) if you haven't already.
Run Krane locally
Krane depends on RedisGraph. docker-compose stack defines all what's required to build and run Krane service locally. It'll also take care of its RedisGraph (https://oss.redislabs.com/redisgraph/) dependency. docker-compose up -d
Krane docker image will be pre-built automatically if not already present on local machine. Note that when running docker-compose locally, Krane won't start RBAC report and dashboard automatically. Instead, the container will sleep for 24h by default - this value can be adjusted in docker-compose.override.yml. Exec into a running Krane container to run commands. Local docker-compose will also mount kube config (~/.kube/config) inside the container enabling you to run reports against any Kubernetes clusters to which you already have access to. # Exec into a running Krane container

docker-compose exec krane bash

# Once in the container you can start using `krane` commands. Try `krane -help`.

$ krane -h To inspect what services are running and the associated ports: docker-compose ps
To stop Krane and its dependency services: docker-compose down

Usage Guide

Commands
- Appvia Ltd ">$ krane --help

NAME:

krane

DESCRIPTION:

Kubernetes RBAC static analysis & visualisation tool

COMMANDS:

dashboard Start K8s RBAC dashboard server
help Display global or [command] help documentation
report Run K8s RBAC report

GLOBAL OPTIONS:

-h, --help
Display help documentation

-v, --version
Display version information

-t, --trace
Display backtrace when an error occurs

AUTHOR:

Marcin Ciszak - Appvia Ltd

Generate RBAC report

With local kubectl context
To run a report against a running cluster you must provide a kubectl context ">krane report -k
You may also pass -c flag if you plan to run the tool against multiple clusters and index RBAC graph separately for each cluster name.
From RBAC files stored in directory
To run a report against local RBAC yaml/json files, provide a directory path ">krane report -d

___________________________
@hacking_Attack
@Hacking_Video

NOTE: Krane expects the following files (in either YAML or JSON format) to be present in specified directory path: psp roles clusterroles rolebindings clusterrolebindings
Inside a Kubernetes cluster
To run a report from a container running in Kubernetes cluster krane report --incluster
NOTE: Service account used by Krane will require access to RBAC resources. See Prerequisites (https://github.com/appvia/krane/blob/master/k8s/one-time/prerequisites.yaml) for details.
In CI/CD pipeline
To validate RBAC definition as a step in CI/CD pipeline ">krane report --ci -d
NOTE: Krane expects certain naming convention to be followed for locally stored RBAC resource files. See section (https://github.com/appvia/krane#from-rbac-files-stored-in-the-filesystem) above. In order to run krane commands it's recommended that CI executor references quay.io/appvia/krane:latest (https://quay.io/repository/appvia/krane?tab=tags) docker image. CI mode is enabled by --ci flag. Krane will return non zero status code along with details of breaking risk rules when one or more dangers have been detected.
Visualisation Dashboard
To view RBAC facets tree, network graph and latest report findings you need to start dashboard server first. krane dashboard
Cluster flag -c may be passed if you want to run the dashboard against specific cluster name. Dashboard will look for data related to specified cluster name which is cached on the file system. Command above will start local web server on default port 8000, and display the dashboard link.
Architecture

RBAC Data indexed in a local Graph database
Krane indexes RBAC entites in RedisGraph. This allows us to query network of dependencies efficiently and simply using subset of CypherQL (https://oss.redislabs.com/redisgraph/cypher_support/) supported by RedisGraph (https://oss.redislabs.com/redisgraph/).
Schema

___________________________
@hacking_Attack
@Hacking_Video

Nodes
The following nodes are created in the Graph for the relevant RBAC objects: Psp - A PSP node containing attributes around the pod security policy. Rule - Rule node represents access control rule around Kubernetes resources. Role - Role node represents a given Role or ClusterRole. kind attribute defines type of role. Subject - Subject represents all possible actors in the cluster (kind: User, Group and ServiceAccount) Namespace - Kubernetes Namespace node.
Edges
:SECURITY - Defines a link between Rule and Psp nodes. :GRANT - Defines a link between Role and Rule associated with that role. :ASSIGN - Defines a link between an Actor (Subject) and given Role/ClusterRole (Role node). :RELATION - Defines a link between two different Actor (Subject) nodes. :SCOPE - Defines a link between Role and Namespace nodes. :ACCESS - Defines a link between Subject and Namespace nodes. :AGGREGATE - Defines a link between ClusterRoles (one ClusterRole aggregates another) A-(aggregates)->B :COMPOSITE - Defines a link between ClusterRoles (one ClusterRole can be aggregated in another) A<-(is a composite of)-B All edges are bidirectional, which means graph can be queried in either direction. Only exceptions are :AGGREGATE and :COMPOSITE relations which are uni-directional, though concerned with the same edge nodes.
Querying the Graph
In order to query the graph directly you can exec into a running redisgraph container, start redis-cli and run your arbitrary queries. Follow official instructions (https://oss.redislabs.com/redisgraph/) for examples of commands (https://oss.redislabs.com/redisgraph/commands/). You can also query the Graph from Krane console. First exec into running Krane container, then # Start Krane console - this will open interactive ruby shell with Krane code preloaded

console

# Instantiate Graph client

graph = Krane::Clients::RedisGraph.client cluster: 'default'

# Run arbitrary CypherQL query against indexed RBAC Graph

res = graph.query(%Q(
MATCH (r:Rule {resource: "configmaps", verb: "update"})<-[:GRANT]-(ro:Role)<-[:ASSIGN]-(s:Subject)
RETURN s.kind as subject_kind, s.name as subject_name, ro.kind as role_kind, ro.name as role_name))

# Print the results

res.print_resultset # Results...
+----------------+--------------------------------+-----------+------------------------------------------------+
| subject_kind | subject_name | role_kind | role_name |
+----------------+--------------------------------+-----------+------------------------------------------------+
| ServiceAccount | bootstrap-signer | Role | system:controller:bootstrap-signer |
| User | system:kube-controller-manager | Role | system::leader-locking-kube-controller-manager |
| ServiceAccount | kube-controller-manager | Role | system::leader-locking-kube-controller-manager |
| User | system:kube-scheduler | Role | system::leader-locking-kube-scheduler |
| ServiceAccount | kube-scheduler | Role | system::leader-locking-kube-scheduler |
+----------------+-------------- ------------------+-----------+------------------------------------------------+
Note: Example query above will select all Subjects with assigned Roles/ClusterRoles granting access to update configmaps.
Configuration

RBAC Risk Rules
RBAC risk rules are defined in the Rules (https://github.com/appvia/krane/blob/master/config/rules.yaml) file. The structure of each rule is largely self-explanatory. Built-in set can be expanded / overridden by adding extra custom rules to the Cutom Rules (https://github.com/appvia/krane/blob/master/config/custom-rules.yaml) file.
Risk Rule Macros

___________________________
@hacking_Attack
@Hacking_Video

Macros are "containers" for a set of common/shared attributes, and referenced by one or more risk rules. If you choose to use macro in a given risk rule you would need to reference it by name, e.g. macro: . Note that attributes defined in referenced macro will take precedence over the same attributes defined on the rule level. Macro can contain any of the following attributes: query - RedisGraph query (https://github.com/appvia/krane#querying-the-graph). Has precedence over template. Requires writer to be defined. writer - Writer is a Ruby expression used to format query result set. Writer has precedence over template. template - Built-in query/writer template name. If query & writer are not specified then chosen query generator will be used along with matching writer.
Risk Rule attributes
Rule can contain any of the following attributes: id [Required] Rule id is a unique rule identifier. group_title [Required] Title applying to all items falling under this risk check. severity [Required] Severity, as one of :danger, :warning, :info. info [Required] Textual information about the check and suggestions on how to mitigate the risk. query [Conditonal] RedisGraph query (https://github.com/appvia/krane#querying-the-graph). Has precedence over template. Requires writer to be defined. writer [Conditonal] Writer is a Ruby expression used to format query result set. Writer has precedence over template. Requires query to be defined. template [Conditonal] Built-in query/writer template name. If query & writer are not specified then chosen query generator will be used along with matching writer. Some built-in templates require match_rules attribute to be specified on individual rule level in order to build correct query. Templates currently requiring it: risky-role - Builds multi-match graph query based on the access rules specified by match_rules. Generated graph query returns the following columns: role_name role_kind namespace_name (an array is returned if multiple items returned) match_rules [Conditonal] Required when template relies on match rules in order to build a query. Example: match_rules:
- resources: ['cronjobs']
verbs: ['update'] Attributes and values follow Kubernetes RBAC role specification (https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-examples). custom_params [Optional] List of custom key-value pairs to be evaluated and replaced in a rule query and writer representation. Example: custom_params:
- attrA: valueA
- attrB: valueB Template placeholders for the keys above {{attrA}} and {{attrB}} will be replaced with valueA and valueB respectively. threshold [Optional] Numeric value. When definied this will become available as template placeholder {{threshold}} in the writer expression. macro [Optional] Reference to common parameters defined in a named macro. disabled [Optional] When set to true it'll disable given rule and exclude it from evaluation. By default all rules are enabled.
Risk Rule examples

Explicit query & writer expression
(ns:Namespace) WHERE NOT s.name IN {{whitelist_subject_names}} RETURN s.kind as subject_kind, s.name as subject_name, COLLECT(ns.name) as namespace_names ORDER BY subject_kind, subject_name, namespace_names DESC threshold: 2 writer: | if result.namespace_names.count > {{threshold}} "#{result.subject_kind} #{result.subject_name} can access namespaces: #{result.namespace_names.join(', ')}" end disabled: true ">- id: verbose-rule-example
group_title: Example rule
severity: :danger
info: Risk description and instructions on how to mitigate it goes here
query: |
MATCH
(s:Subject)-[:ACCESS]->(ns:Namespace)
WHERE
NOT s.name IN {{whitelist_subject_names}}
RETURN

___________________________
@hacking_Attack
@Hacking_Video