Hacking on Medium
¿Que tan seguro es PyPI (Python Package Index)?.

https://cdn-images-1.medium.com/max/1161/0*ESuC5KBz-N4lrOui
POR MAURICIO MATIAS

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Pickle Rick(Tryhackme) Room Writeup By Jonty Bhardwaj

https://cdn-images-1.medium.com/max/1044/1*u9iR4Ri4Tccuzh_btM_PDQ.png
Hello Reader, I am Jonty Bhardwaj currently enrolled in Master Certificate in Cyber Security HackerU program. Today I am here to share a…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

How I found my first Chrome bug (CVE-2021–21210)

On October 31, 2020, @SamyKamkar published his research on NAT Slipstreaming. According to his own words, NAT Slipstreaming —Continue reading on Medium »
Read more...

The Future of Audits in DeFi Security

Audits have become a staple of the DeFi industry. They’re an essential part of the DeFi security stack, which also includes automated…Continue reading on Immunefi »
Read more...

Performing internal pentesting remotely?
https://www.reddit.com/r/Pentesting/comments/o9r0uh/performing_internal_pentesting_remotely/

<!-- SC_OFF -->What setups do you use for performing internal pentests remotely? <!-- SC_ON --> submitted by /u/mountainhacker1 (https://www.reddit.com/user/mountainhacker1)
[link] (https://www.reddit.com/r/Pentesting/comments/o9r0uh/performing_internal_pentesting_remotely/) [comments] (https://www.reddit.com/r/Pentesting/comments/o9r0uh/performing_internal_pentesting_remotely/)

Deep Web
how to create date of birth form with html css | date of birth form html & css

https://external-preview.redd.it/RpXt-gwhhH-bxuhy6cDRm0O4vS1qrni3HUfs0Kpt0hU.jpg?width=320&crop=smart&auto=webp&s=2b011bfea6ce46f3dc0bdc8eb940224096a2fe4e submitted by /u/TaylorM_Clark
[link] [comments]

hacking: security in practice
what is the best method to ddos a website using loic

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ

submitted by /u/redleigh1
[link] [comments]

AWS Pen-Testing Laboratory - Pentesting Lab With A Kali Linux Instance Accessible Via Ssh And Wireguard VPN And With Vulnerable Instances In A Private Subnet
http://www.kitploit.com/2021/06/aws-pen-testing-laboratory-pentesting.html

PenTesting laboratory deployed as IaC with Terraform (https://www.kitploit.com/search/label/Terraform) on AWS. It deploys a Kali Linux (https://www.kitploit.com/search/label/Kali%20Linux) instance accessible via ssh & wireguard VPN. Vulnerable instances in a private subnet. NOTE: Ids only defined for region "eu-west-1" For other regions, kali ami id must be specified and metasploitable3 (https://www.kitploit.com/search/label/Metasploitable3) id (after building it)
Changelog
[2021-06-02] AMI IDs changed to use Kali 2021.2 [2021-03-10] Use new Kali version 2021.1
Diagram

Components
Kali 2021.2 instance (private key is saved into kali.pem) Wireguard VPN service: client file client_vpn.wg Accessible via ssh/scp Public Subnet 10.0.0.5/24 Vulnerable machine "Metasploitable" (ami build is public) Private subnet 10.0.1.5/24 More vulnerable (https://www.kitploit.com/search/label/Vulnerable) labs/machines/docker (to-be-done)
Features added
User management Automatically create non privileged users in kali instance with rsa Wireguard VPN client file per user Command line audit logging in syslog auditd enabled with sudo_log and users_log keys for auditing user actions (see also ausearch command) ToDO: Forward terminal audit to CloudWatch or an S3 Bucket with write once policy
How-To
Requirements: Terraform CLI install guide (https://learn.hashicorp.com/terraform/getting-started/install.html) AWS CLI install guide (https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) $PATH configured for AWS CLI & Terraform AWS account and configure credentials (https://www.kitploit.com/search/label/Credentials) via aws cli: aws configure Kali Linux Subscription in AWS Marketplace (version 2020.04) Metasploitable3 AMI image previously built (public AMI available for eu-west-1 region) see (https://github.com/juanjoSanz/aws-pentesting-lab/blob/main/metasploitable3)
Deploy
Enable/disable vulnerable instances to be deployed setting 0 or 1 in variables.tf: variable "deploment-control" {
type = map
default = {
#"instance" = 0 or 1, to disable or enable
"metasploitable3" = 1
"dvca" = 0
}
description = "Control which EC2 instances are deployed, 0 for none or 1"
}
Use terraform for deploy infraestructure terraform init
terraform plan
terraform apply -auto-approve

Outputs
Terraform outputs will show following entries: ssh connection command for kali user (root via sudo) wireguard client file for kali user will be automatically retrieved from kali server scp command to retrieve wireguard client file (just in case defined terraform local-exec command fails) For each of the normal users created in Kali instance Private key file for ssh connection Wireguard client file for VPN connectivity
Usage
Either connect to Kali via ssh or wireguard: SSH: (Only command line) Use autogenerated private key (see terraform output) # configure kali public ip ssh -i kali.pem -o StrictHostKeyChecking=no -o IdentitiesOnly=yes kali@${KALI_IP} ">KALI_IP= # configure kali public ip
ssh -i kali.pem -o StrictHostKeyChecking=no -o IdentitiesOnly=yes kali@${KALI_IP}
Wireguard: Connect your local kali instance via wireguard (see client_vpn.wg generated file) # configure kali public ip scp -i kali.pem -o StrictHostKeyChecking=no IdentitiesOnly=yes kali@${KALI_IP}:/home/kali/client_vpn.wg . #### (local_kali)$ sudo apt-get install –y wireguard (local_kali)$ sudo gedit /etc/wireguard/wg0.conf # copy contents of client_vpn.wg (local_kali)$ sudo chmod 700 /etc/wireguard/wg0.conf (local_kali)$ sudo wg-quick up wg0 (local_kali)$ ping 10.0.0.5 # test connectivity with kali instance in AWS ">KALI_IP= # configure kali public ip
scp -i kali.pem -o StrictHostKeyChecking=no IdentitiesOnly=yes kali@${KALI_IP}:/home/kali/client_vpn.wg .

####
(local_kali)$ sudo apt-get install –y wireguard
(local_kali)$ sudo gedit /etc/wireguard/wg0.conf # copy contents of client_vpn.wg
(local_kali)$ sudo chmod 700 /etc/wireguard/wg0.conf
(local_kali)$ sudo wg-quick up wg0

(local_kali)$ ping 10.0.0.5 # test connectivity with kali instance in AWS

Destroy
terraform destroy -auto-approve

References
rapid7 / metasploitable3 (https://github.com/rapid7/metasploitable3) - license (https://github.com/rapid7/metasploitable3/blob/master/LICENSE) Kali 2021.2 AWS Marketplace (https://aws.amazon.com/marketplace/pp/B08LL91KKB) terraform-aws-ec2-kali-linux

(https://github.com/offensive-terraform/terraform-aws-ec2-kali-linux)

Download Aws-Pentesting-Lab (https://github.com/juanjoSanz/aws-pentesting-lab)

Dark Reading: Attacks/Breaches
Microsoft Tracks Attack Campaign Against Customer Support Agents

The company attributes the attack to Nobelium, the same group it linked to the SolarWinds campaign earlier this year.

Dark Reading: Attacks/Breaches
Microsoft Refining Third-Party Driver Vetting Processes After Signing Malicious Rootkit

Rogue driver was distributed within gaming community in China, company says.

Dark Reading: Attacks/Breaches
New House Bill Aims to Drive Americans' Security Awareness

The legislation requires the National Telecommunications and Information Administration to establish a cybersecurity literacy campaign.