subject_kind,
subject_name,
namespace_names DESC
threshold: 2
writer: |
if result.namespace_names.count > {{threshold}}
"#{result.subject_kind} #{result.subject_name} can access namespaces: #{result.namespace_names.join(', ')}"
end
disabled: true The example above explicitly defines a graph query which is used to evaluate RBAC risk, and a writer expression used to format query result set. The query simply selects all Subjects (excluding whitelisted) and Namespaces to which they have access to. Note that the result set will only include Subjects having access to more than 2 Namespaces (https://www.kitploit.com/search/label/Namespaces) (Noticed threshold value there?). Last writer's expression will be captured as formatted result item output. writer can access the result set item via result object with methods matching elements returned by the query, e.g. result.subject_kind, result.subject_name etc. Note: {{threshold}} placeholder in the writer expression will be replaced by the rule's threshold keyword value. {{whitelist_subject_names}} represents a custom field which will be interpolated with Whitelist (https://github.com/appvia/krane#rbac-risk-whitelist) values defined for a given rule id. If a placeholder field name is not defined in the whitelist it'll be substituted with an empty array [''] by default. Read more on whitelisting (https://www.kitploit.com/search/label/Whitelisting) below.
Templated Risk Rule
Built-in templates simplify risk rule definition significantly, however, they are designed to extract specific kind of information and may not be a good fit for your custom rules. If you find yourself reusing the same query or writer expressions across multiple rules, you should consider extracting those to a macro and reference it in your custom rules to DRY them up. - id: risky-any-verb-secrets
group_title: Risky Roles/ClustersRoles allowing all actions on secrets
severity: :danger
info: Roles/ClusterRoles allowing all actions on secrets. This might be dangerous. Review listed Roles!
template: risky-role
match_rules:
- resources: ['secrets']
verbs: ['*'] Example above shows one of the built-in rules. It references risky-role template which upon processing will expand the rule by injecting query and writer expressions before rule evalutation triggers. match_rules will be used to build appropriate match query.
RBAC Risk Whitelist
Optional whitelist contains a set of custom defined attribute names and respective (whitelisted) values.
Whitelist attributes
Attribute names and their values are arbitrary. They are defined in the Whitelist (https://github.com/appvia/krane/blob/master/config/whitelist.yaml) file and divided into three separate sections: global - Top level scope. Custom attributes defined here will apply to all Risk Rules regardless of the cluster name. common - Custom attributes will be scoped to specific Risk Rule id regardless of the cluster name. cluster (with nested list of cluster names) - Custom attributes will apply to specific Risk Rule id for a given cluster name. Each Risk Rule (https://github.com/appvia/krane#rbac-risk-rules), upon evaluation, will attempt to interpolate all parameter placeholders used in the query, e.g. {{your_whitelist_attribute_name}}. If a placeholder parameter name (i.e. a name between the double curly brackets) matches any of the whitelisted attribute names for that Risk Rule id, it will be replaced with its calculated value. If no values are found for a given placeholder, it'll be substituted with [''].
Whitelist examples
Example whitelist below produces the following placeholder-key => value mapping for a Risk Rule (https://github.com/appvia/krane#rbac-risk-rules) with id attribute value matching "some-risk-rule-id" ['acp:prometheus:operator'] {{whitelist_subject_names}} => ['privileged-psp-user', 'another-user'] ">{{whitelist_role_names}} => ['acp:prometheus:operator']

___________________________
@hacking_Attack
@Hacking_Video

{{whitelist_subject_names}} => ['privileged-psp-user', 'another-user']
The placeholder keys above, when used in the custom graph queries, will be replaced by their respective values upon Risk Rule evaluation. Example: ---
rules:
global: # global scope - applies to all risk rule and cluster names
whitelist_role_names: # custom attribute name
- acp:prometheus:operator # custom attribute values

common: # common scope - applies to specific risk rule id regardless of cluster name
some-risk-rule-id: # this corresponds to risk rule id defined in config/rules.yaml
whitelist_subject_names: # custom attribute name
- privileged-psp-user # custom attribute values

cluster: # cluster scope - applies to speciifc risk rule id and cluster name
default: # example cluster name
some-risk-rule-id: # risk rule id
whitelist_subject_names: # custom attribute nane
- another-user # custom attribute values
Kubernetes Deployment
Krane can be deployed to a local or remote Kubernetes clusters easily.
K8s Prerequisites
Kubernetes namespace, service account along with appropriate RBAC must be present in the cluster. See the Prerequisites (https://github.com/appvia/krane/blob/master/k8s/one-time/prerequisites.yaml) for reference. Default Krane entrypoint executes bin/in-cluster-run (https://github.com/appvia/krane/blob/master/bin/in-cluster-run) which waits for RedisGraph instance to become available before starting RBAC report loop and dashboard web server. You may control certain aspects of in-cluster execution with the following environment variables: KRANE_REPORT_INTERVAL - Defines interval in seconds for RBAC static analysis report run. Default: 300 (in seconds, i.e. 5 minutes). KRANE_REPORT_OUTPUT - Defines RBAC risk report output format. Possible values :json, :yaml, :none. Default: :json.
Local or Remote K8s Cluster
If your K8s cluster comes with built-in Compose-on-Kubernetes (https://github.com/docker/compose-on-kubernetes) controller support (docker-desktop supports it by default), then you can deploy Krane and its dependencies with a single docker stack (https://docs.docker.com/engine/reference/commandline/stack_deploy/) command: docker stack deploy \
--orchestrator kubernetes \
--namespace krane \
--compose-file docker-compose.yml \
--compose-file docker-compose.k8s.yml krane
Note: Make sure your current kube context is set correctly prior to running the command above! The application Stack should be now deployed to a Kubernetes cluster and all services ready and exposed. Note that Krane will automatically start its report loop and dashboard server. 6379/tcp aa377a5f-62b krane_krane replicated 1/1 quay.io/appvia/krane:latest *:8000->8000/tcp ">$ docker stack services --orchestrator kubernetes --namespace krane krane

ID NAME MODE REPLICAS IMAGE PORTS
0de30651-dd5 krane_redisgraph replicated 1/1 redislabs/redisgraph:1.99.7 *:6379->6379/tcp
aa377a5f-62b krane_krane replicated 1/1 quay.io/appvia/krane:latest *:8000->8000/tcp
Check your Kubernetes cluster RBAC security posture by visiting http://localhost:8000
Note that for remote cluster deployments you'll likely need to port-forward Krane service first kubectl --context=my-remote-cluster --namespace=krane port-forward svc/krane 8000
To delete the Stack docker stack rm krane \
--orchestrator kubernetes \
--namespace krane
Alternatively, deploy with kubectl (https://kubectl.docs.kubernetes.io/): kubectl create \
--context docker-desktop \
--namespace krane \
-f k8s/redisgraph-service.yaml \
-f k8s/redisgraph-deployment.yaml \

___________________________
@hacking_Attack
@Hacking_Video

-f k8s/krane-service.yaml \
-f k8s/krane-deployment.yaml
Note that Krane dashboard services are not exposed by default! kubectl port-forward svc/krane 8000 \
--context=docker-desktop \
--namespace=krane

# Open Krane dashboard

http://localhost:8000 You can find the example deployment manifests in k8s (https://github.com/appvia/krane/blob/master/k8s) directory. Modify manifests as required for your deployments making sure you reference the correct version of Krane docker image in its deployment file (https://github.com/appvia/krane/blob/master/k8s/krane-deployment.yml). See Krane Docker Registry (https://quay.io/repository/appvia/krane?tab=tags) for available tags, or just use latest.
Notifications
Krane will notify you about detected anomalies of medium and high severity via its Slack integration. To enable notifications specify Slack webhook_url & channel in the config/config.yaml (https://github.com/appvia/krane/blob/master/config/config.yaml) file, or alternatively set both SLACK_WEBHOOK_URL and SLACK_CHANNEL environment variables. Environment variables will take precedence over config file values.
Local Development
This section describes steps to enable local development.
Setup
Install Krane code dependencies with ./bin/setup

Dependencies
Krane depends on RedisGraph (https://oss.redislabs.com/redisgraph/). docker-compose is the quickest way to get Krane's dependencies running locally. docker-compose up -d redisgraph
To inspect RedisGraph service is up: docker-compose ps
To stop services: docker-compose down

Development
At this point you should be able to modify Krane codebase and test results by invoking commands in local shell. ./bin/krane --help # to get help
./bin/krane report -k docker-desktop # to generate your first report for
# local docker-desktop k8s cluster
... To enable Dashboard UI local development mode cd dashboard
npm install
npm start
This will automatically start the Dashboard server, open default browser and watch for source files changes. Krane comes preconfigured for improved developer experience with Skaffold (https://skaffold.dev/). Iterating on the project and validating the application by running the entire stack in local or remote Kubernetes cluster just got easier. Code hot-reload enables local changes to be automatically propagated to the running container for faster development lifecycle. skaffold dev --kube-context docker-desktop --namespace krane --port-forward

Tests
Run tests locally with bundle exec rspec

Contributing to Krane
We welcome any contributions from the community! Have a look at our contribution (https://github.com/appvia/krane/blob/master/CONTRIBUTING.md) guide for more information on how to get started. If you use Krane, find it useful, or are generally interested in Kubernetes security then please let us know by Starring and Watching this repo. Thanks!
Community
//TODO
Roadmap
See our Roadmap (https://github.com/appvia/krane/projects/1) for details about our plans for the project.

Download Krane (https://github.com/appvia/krane)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Did I get hacked?

So I got added on Snapchat by someone I didn't know, but we ended up talking for a bit. She added me from quick add, and she ended up asking for my phone number. So I gave it to her, and seconds later she texts me that she's an escort. I told I wasn't interested, but she then sends me a nude. At this she told me her price, and I replied "lol is this a bot? also that price is way to high" she then tells me

"my full name that's disrespectful"

I stopped texting her after that because I have no clue how she got my full name. did I just get hacked?

submitted by /u/WhatsUpDudeee
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking

I only want to start hacking so I can change how many credits I have in school

submitted by /u/YUNGSLEEZKITTZ
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

All about unrestricted file upload

File upload attacksContinue reading on InfoSec Write-ups »
Read more...

Hacking on Medium
Les Anonymous menacent de s’attaquer à Elon Musk .

https://cdn-images-1.medium.com/max/1200/1*bzdpQcJsDp6QqLmB1czb6g.jpeg
Le collectif de hackers dénonce l’attitude du milliardaire sur les réseaux sociaux.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Steam Scam: spectrumcup

https://cdn-images-1.medium.com/max/1165/1*EnZjoMMVqAlTQ1QAl-QR5w.png
Today I was added by a random person on Steam who claimed to invite me to a TF2 tournament. He also asked me to upvote his team on…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How can I Hack my Husbands WhatsApp Messages

https://cdn-images-1.medium.com/max/1024/1*lAYyVvtAWsDI7U9Exs0cRA.jpeg
Hiring a hacker to hack your husbands WhatsApp messages is much more easier now with the help of hackactivities, you will be able to Know…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Burp suite: Intruder — Much more powerful than you think!

https://cdn-images-1.medium.com/max/753/1*7VoBHlMQHqRQ-RCycTVUiA.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kerberos Attacks — AS-REP Roasting

https://cdn-images-1.medium.com/max/1350/1*4JBrcN9yfRNtv8_Y3XoM4g.jpeg
Dumping user hashes for Kerberos disabled pre-authentication accounts

Continue reading on R3d Buck3T »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
ScriptKiddie

https://cdn-images-1.medium.com/max/1075/1*3rcvGQKzH0t6IJ0S1kluXw.png
Hola todos el día de hoy les traigo el WriteUp de la recién maquina retirada #ScriptKiddie de #Hack_the_box #HTB, este contenido esta…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Caronte - A Tool To Analyze The Network Flow During Attack/Defence Capture The Flag Competitions

https://1.bp.blogspot.com/-a0CIO8ee_pg/YL1fRvEJQyI/AAAAAAAAZ7s/ugyTkBAdoQgxpBGFkQWxGFMcR_94lBU3ACNcBGAsYHQ/w640-h360/caronte_8_main.png Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using protocol specific rules. The connection flows are saved into a database and can be visualized with the web application. REST API are also provided. Features* immediate installation with docker-compose
* no configuration file, settings can be changed via GUI or API
* pcaps to be analyzed can be loaded via curl, either locally or remotely, or via the GUI
* it is also possible to download the pcaps from the GUI and see all the analysis statistics for each pcap

* rules can be created to identify connections that contain certain strings
* pattern matching is done through regular expressions (regex)
* regex in UTF-8 and Unicode format are also supported

* connections can be labeled by type of service, identified by the port number
* each service can be assigned a different color

* ability to filter connections by addresses, ports, dimensions, time, duration, matched rules
* a timeline shows statistics with different metrics sampled per minute
* some of these metrics are connections_per_service, client_bytes_per_service, server_bytes_per_service, duration_per service, matched_rules
* with matched_rules metric it can be possible to see the relationship between flag_in and flag_out

* the timeline contains a sliding window which can be used to search for connections in a certain time interval

* advanced search by term, negated term, exact phrase, regex, negated regex
* the performed searches are saved to be instantly repeated the following times

* the detected HTTP connections are automatically reconstructed
* HTTP requests can be replicated through curl, fetchand python requests* compressed HTTP responses (gzip/deflate) are automatically decompressed

* ability to export and view the content of connections in various formats, including hex and base64
* JSON content is displayed in a JSON tree viewer, HTML code can be rendered in a separate window
* occurrences of matched rules are highlighted in the connection content view
* supports both IPv4 and IPv6 addresses
* if more addresses are assigned to the vulnerable machine to be defended, a CIDR address can be used InstallationThere are two ways to install Caronte:

* with Docker and docker-compose, the fastest and easiest way
* manually installing dependencies and compiling the project Run with DockerThe only things to do are:

* clone the repo, with git clone https://github.com/eciavatta/caronte.git* inside the carontefolder, run docker-compose up -d* wait for the image to be compiled and open browser at http://localhost:3333Manually installationThe first thing to do is to install the dependencies:

* go >= 1.14 https://golang.org/doc/install
* node >= v12 https://nodejs.org/it/download/
* yarnpkg https://classic.yarnpkg.com/en/docs/install/
* hyperscan >= v5 https://www.hyperscan.io/downloads/

Next you need to compile the project, which is composed of two parts:

* the backend, which can be compiled with go mod download && go build* the frontend, which can be compiled with cd frontend && yarn install && yarn buildBefore running Caronte starts an instance of MongoDB https://docs.mongodb.com/manual/administration/install-community/ [...]

___________________________
@hacking_Attack
@Hacking_Video

that has no authentication. Be careful not to expose the MongoDB port on the public interface.

Run the binary with ./caronte. The available configuration options are: -bind-address address where server is bind (default "0.0.0.0") -bind-port port where server is bind (default 3333) -db-name name of database to use (default "caronte") -mongo-host address of MongoDB (default "localhost") -mongo-port port of MongoDB (default 27017) ConfigurationThe configuration takes place at runtime on the first start via the graphical interface or via API. It is necessary to setup:

* the server_address: the ip address of the vulnerable machine. Must be the destination address of all the connections in the pcaps. If each vulnerable service has an own ip, this param accept also a CIDR address. The address can be either IPv4 both IPv6
* the flag_regex: the regular expression that matches a flag. Usually provided on the competition rules page
* auth_required: if true a basic authentication is enabled to protect the analyzer
* an optional accountsarray, which contains the credentials of authorized users DocumentationThe backend, written in Go language, it is designed as a service. It exposes REST API that are used by the frontend written using React. The list of available APIs with their explanation is available here: https://app.swaggerhub.com/apis-docs/eciavatta/caronte/WIP ScreenshotsBelow there are some screenshots showing the main features of the tool. Main window, with connections list and stream contenthttps://1.bp.blogspot.com/-dwP1XL8FFXY/YL1gThx0T5I/AAAAAAAAZ70/dz_otlVpCb0-zS0ba-kWoIY0b2s8-2WFQCNcBGAsYHQ/w640-h360/caronte_8_main.png Main window, with the timeline expandedhttps://1.bp.blogspot.com/-wgojUn6Oocc/YL1gX2QOKEI/AAAAAAAAZ74/GQEh0ThXj0Yhan5kKVqeAvAZhYHLqGfiwCNcBGAsYHQ/w640-h360/caronte_9_main2.png Rules and services viewhttps://1.bp.blogspot.com/-GDevNMvHC1Y/YL1gbqWWyKI/AAAAAAAAZ78/fucXa9bOKvon59S0Xsse7yvNwiu1015RgCNcBGAsYHQ/w640-h360/caronte_10_rules_services.png Searches and pcaps viewhttps://1.bp.blogspot.com/-dfSeEgkz0dw/YL1gh47LzTI/AAAAAAAAZ8A/WA387T3QDIo56USSN1maasHYfBcwuHz2gCNcBGAsYHQ/w640-h360/caronte_11_searches_pcaps.png Download Caronte

___________________________
@hacking_Attack
@Hacking_Video