Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Red-Shadow - Lightspin AWS IAM Vulnerability Scanner

http://3.bp.blogspot.com/-JIHt9E_p2UU/YNEtE4TIN9I/AAAAAAAAdj4/E-RnSIOlbqc-yvrcce05eoSCbQ1qxS-MQCK4BGAYYCw/w640-h640/red-shadow_1_red-shadow-788839.png Scan your AWS IAM Configuration for shadow admins in AWS IAM based on misconfigured deny policies not affecting users in groups discovered by Lightspin's Security Research Team.

The tool detects the misconfigurations in the following IAM Objects:

*
Managed Policies

*
Users Inline Policies

*
Groups Inline Policies

*
Roles Inline Policies Research SummaryAWS IAM evaluation logic for deny policies applied to groups does not work the same way as most security engineers may be used to with other authorization mechanisms.

Suppose a policy with a group resource has an explicit deny. In that case, this will only impact group actions and not user actions, opening organizations up to misconfiguration and vulnerabilities if they assume the process to be the same as with Active Directory, for example.

Example for vulnerable json policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ProtectManagersByDeny",
"Effect": "Deny",
"Action": "*",
"Resource": "arn:aws:iam::123456789999:group/managers"
}
]
}

In this example, the policy should deny any iam action done by users, groups, or roles with that policy attached to, towards the group called managers.

The fact is that simple IAM action like iam:ChangePasswordwould work as the deny policy is ineffective. Link to the full security research blog DetectionAWS IAM has a clear seperation between user object actions and group object actions.

The following list includes the user object actions the tool is scanning over deny policies affecting groups (besides wildcard):

AWS_USER_ACTIONS = ["iam:CreateUser",
"iam:GetUser",
"iam:UpdateUser",
"iam:DeleteUser",
"iam:GetUserPolicy",
"iam:PutUserPolicy",
"iam:DeleteUserPolicy",
"iam:ListUserPolicies",
"iam:AttachUserPolicy",
"iam:DetachUserPolicy",
"iam:ListAttachedUserPolicies",
"iam:SimulatePrincipalPolicy",
"iam:GetContextKeysForPrincipalPolicy",
"iam:TagUser",
"iam:UpdateSSHPublicKey",
"iam:UntagUser",
"iam:GetSSHPublicKey",
"iam:ListUserTags",
"iam:DeleteSSHPublicKey",
"iam:GetLoginProfile",
"iam:   GetAccessKeyLastUsed",
"iam:UpdateLoginProfile",
"iam:UploadSigningCertificate",
"iam:DeleteLoginProfile",
"iam:ListSigningCertificates",
"iam:CreateLoginProfile",
"iam:UpdateSigningCertificate",
"iam:EnableMFADevice",
"iam:DeleteSigningCertificate",
"iam:ResyncMFADevice",
"iam:ListServiceSpecificCredentials",
"iam:ListMFADevices",
"iam:ResetServiceSpecificCredential",
"iam:DeactivateMFADevice",
"iam:CreateServiceSpecificCredential",
"iam:ChangePassword",
"iam:UpdateServiceSpecificCredential",
"iam:CreateAccessKey",
"iam:DeleteServiceSpecifi   cCredential",
"iam:ListAccessKeys",
"iam:PutUserPermissionsBoundary",
"iam:UpdateAccessKey",
"iam:DeleteUserPermissionsBoundary",
"iam:DeleteAccessKey",
"iam:ListGroupsForUser",
"iam:ListSSHPublicKeys",
"iam:UploadSSHPublicKey"]

Many of the user object actions mentioned above can easily lead to a privilege escalation or compromising the account, such as resetting the admin's password, deactivating the root account MFA, and more. RequirementsRed-Shadow is built with Python 3 and Boto3.

The tool requires:

* IAM User with Access Key in OS Env
* Sufficient permissions for the IAM User to run the scanner
* Python 3 and pip3 installed Installation

sudo git clone https://github.com/lightspin-tech/red-shadow.git
cd red-shadow
pip3 install -r requirements.txt

Usagepython3 red-shadow.pyAnalyze ResultsThe results discover any IAM object that is vulnerable to such authorization bypass in AWS.

Exam[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Red-Shadow - Lightspin AWS IAM Vulnerability Scanner

11 viewsedited 23:15

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Red-Shadow - Lightspin AWS IAM Vulnerability Scanner

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Red-Shadow - Lightspin AWS IAM Vulnerability Scanner

10 viewsedited 23:15

Hacking Articles Tips Tricks Videos Tutorials

Testing Cookies worth $500

Hello everybody, I am Sankalpa Acharya from Nepal. A few weeks ago I had found IDOR vulnerability on cookies, which worth $500 to me. SO…Continue reading on Medium »
Read more...

13 views23:47

Hacking Articles Tips Tricks Videos Tutorials

Why is my boss purposely limiting our scope to our own security appliances??
https://www.reddit.com/r/Pentesting/comments/ob9gme/why_is_my_boss_purposely_limiting_our_scope_to/

I work in a “ SOC” and I kid you not, he gave the pen testers links only to our SIEM, waf, hids and said try to break in… We are an azure shop, why would he not give them azure subscriptions/IPs/Hosts within our cluster so we can test our detections?! Am I missing something? submitted by /u/bankster24 (https://www.reddit.com/user/bankster24)
[link] (https://www.reddit.com/r/Pentesting/comments/ob9gme/why_is_my_boss_purposely_limiting_our_scope_to/) [comments] (https://www.reddit.com/r/Pentesting/comments/ob9gme/why_is_my_boss_purposely_limiting_our_scope_to/)

___________________________
@hacking_Attack
@Hacking_Video

Why is my boss purposely limiting our scope to our own security...

I work in a “ SOC” and I kid you not, he gave the pen testers links only to our SIEM, waf, hids and said try to break in… We are an azure shop,...

19 viewsedited 23:47

Hacking Articles Tips Tricks Videos Tutorials

Deep Web
Finding the location of someone?

Is there anything on the dark web that can help get someone's house location. I know the persons name, socials, area they live around, school they go to. This isn't to harm them, I can tell the reason if you really wanna know

submitted by /u/thecomicnerd101
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Finding the location of someone?

Is there anything on the dark web that can help get someone's house location. I know the persons name, socials, area they live around, school they...

17 viewsedited 00:37

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Is there a legal way to find out who is texting

Have a bit of a harassment issue with my best friend. She's an assault survivor so this is extremely troubling. The police said they can't do anything and to block the number.

But whoever is texting her knows everything about her and she's terrified.

We tried to locate the number but get nothing. I even paid one of those scam sites just in case it would be helpful.

Can someone help. Please. She's scared to go to work, she's scared to go home. Basically she's hiding at my place, but I work tomorrow and she doesn't want to be alone. We only want a name to see if it's just someone messing with her or if it's more serious

submitted by /u/Featherypickles
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - Is there a legal way to find out who is texting

0 votes and 0 comments so far on Reddit

17 viewsedited 01:36

Hacking Articles Tips Tricks Videos Tutorials

14 views03:14

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Hacking con Go — Goroutines con WaitGroup

https://cdn-images-1.medium.com/max/1300/0*rs9e2N81fxl4n-Dx.png
Introducción a Goroutines

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Hacking con Go — Goroutines con WaitGroup

Introducción a Goroutines

16 viewsedited 03:14