CS major that wants to get into the field of pentesting
https://www.reddit.com/r/Pentesting/comments/mdx41i/cs_major_that_wants_to_get_into_the_field_of/
<!-- SC_OFF -->Hello everyone like the title says I am currently working for my computer science degree I need about a year to get my bachelor's and my interest has always been on the "hacking" side of it which is why I joined computer science in the first place but now that I am getting closer to finish I have realized I haven't really learned much about security or hacking in general. I know several languages that they've taught us along with theory but I don't see myself actually getting a job with just a bachelors in CS so what would be the best thing that I could do right now to actually be able to become a pen tester would the best thing to do be join a boot camp and get a certificate? Or just learn the necessary skills online through personal projects? Thanks in advance. <!-- SC_ON --> submitted by /u/Jack_Mihoff998 (https://www.reddit.com/user/Jack_Mihoff998)
[link] (https://www.reddit.com/r/Pentesting/comments/mdx41i/cs_major_that_wants_to_get_into_the_field_of/) [comments] (https://www.reddit.com/r/Pentesting/comments/mdx41i/cs_major_that_wants_to_get_into_the_field_of/)
https://www.reddit.com/r/Pentesting/comments/mdx41i/cs_major_that_wants_to_get_into_the_field_of/
<!-- SC_OFF -->Hello everyone like the title says I am currently working for my computer science degree I need about a year to get my bachelor's and my interest has always been on the "hacking" side of it which is why I joined computer science in the first place but now that I am getting closer to finish I have realized I haven't really learned much about security or hacking in general. I know several languages that they've taught us along with theory but I don't see myself actually getting a job with just a bachelors in CS so what would be the best thing that I could do right now to actually be able to become a pen tester would the best thing to do be join a boot camp and get a certificate? Or just learn the necessary skills online through personal projects? Thanks in advance. <!-- SC_ON --> submitted by /u/Jack_Mihoff998 (https://www.reddit.com/user/Jack_Mihoff998)
[link] (https://www.reddit.com/r/Pentesting/comments/mdx41i/cs_major_that_wants_to_get_into_the_field_of/) [comments] (https://www.reddit.com/r/Pentesting/comments/mdx41i/cs_major_that_wants_to_get_into_the_field_of/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Microsoft Shares Exchange Server Post-Compromise Attack Activity
Microsoft shares the details of post-exploitation attack activity, including multiple ransomware payloads and a cryptocurrency botnet.
Microsoft Shares Exchange Server Post-Compromise Attack Activity
Microsoft shares the details of post-exploitation attack activity, including multiple ransomware payloads and a cryptocurrency botnet.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Apple Patches iOS Zero-Day
Apple today released iOS 14.4.2 to address a security vulnerability that may have been actively exploited.
Apple Patches iOS Zero-Day
Apple today released iOS 14.4.2 to address a security vulnerability that may have been actively exploited.
cve_manager_VS - A Collection Of Python Apps And Shell Scripts To Email An Xlsx Spreadsheet Of New Vulnerabilities In The NIST CVE Database And Their Associated Products On A Daily Schedule
http://www.kitploit.com/2021/03/cvemanagervs-collection-of-python-apps.html
http://www.kitploit.com/2021/03/cvemanagervs-collection-of-python-apps.html
A collection of python apps and shell scripts to email an xlsx spreadsheet of new vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in the NIST CVE database and their associated products on a daily schedule. The spreadsheet can then be manually interpreted for risk to your specific organization. Based off of an opensource product on github originally by Antonios Atlasis Syncs the NIST database for CVEs and CPEs locally and provides basic query capabilities Creates xlsx reports from the data and Emails those reports
File: cve_manager.py
A python script originally authored by Antonios Atlasis - aatlasis@secfu.net (mailto:aatlasis@secfu.net)
https://github.com/aatlasis/cve_manager create postgresql (https://www.kitploit.com/search/label/PostgreSQL) databases and views downloads the latest NIST CVE, CPE, and CWE raw data files unzips and loads the NIST raw data files into the database automates custom queries, searches and reports of the NIST data creates csv export reports of the data Changes from original:
Added import of data manipulation (https://www.kitploit.com/search/label/Manipulation) library (https://www.kitploit.com/search/label/Library) pandas
sudo pip3 install pandas openpyxl
Added database view that joins cve and cpe data
Modified default cpe queries and reports to include cvssv3 vector string instead of cvssv2 score
Modified default cpe queries and reports to sort by published date ASC, CVSS DESC, and CPE ASC
Modified cpe output to csv function to automatically save a copy in xlsx format for every csv saved File: email_xlsx_attach.py
New python script, authored by Shane Lawrence
sends the xlsx reports as email attachments through a local smtp relay File: daily.sh
a bash shell script, authored by Shane Lawrence
Puts it all together in something that cron can run daily
Automates the following uses of cve_manager.py: truncates the old database, deletes old datafiles downloads new raw datafiles for CVE data - the vulnerabilities downloads new raw data file for CPE - the vulnerable (https://www.kitploit.com/search/label/Vulnerable) products downloads new top 1000 CWE - the code problems that cause vulnerabilities jams all of the above into a postgres database runs the searches relevant to you creates csv reports of the relevant searches, formatted and sorted for your preferences reads in the csv reports and outputs to xlsx deletes the csvs
Automates the usage of email_xlsx_attach.py
New server setup:
Read the original pdf at:
https://github.com/aatlasis/cve_manager/blob/master/CVE%20Manager.pdf Setup python:
Requires python 3
Do yourself a favor and install pip3 also
pip3 install psycopg2, openpyxl, pandas
Required includes:
psycopg2 - data science libs
pandas - data manipulation libs (dependency on openpyxl)
sys, argparse, os, zipfile, json, requests, re, io, csv, smtplib, base64, email, datetime Setup postgres:
Install the latest postgreql database for your distribution.
as root, systemctl enable postgresql
systemctl start postgresql
then set a password for postgresql user by:
sudo -u postgres psql
\l lists databases
\du lists users
CREATE USER username WITH PASSWORD 'password'; Use cve_manager to create the database:
The user must have create privlileges
./cve_manager.py -u postgres -ps $PASSWORD -server localhost -db $DB -ow $USER -cd Use cve_manager.py to create the schema
The user must have create privileges
./cve_manager.py -u postgres -ps $PASSWORD -server localhost -db $DB -ct Use cve_manager to download the CVE and CPE data
./cve_manager.py -u $user -ps $pass -host $host -db $db -d -p -csv Manually download and unzip the CWE data
wget https://cwe.mitre.org/data/csv/1000.csv.zip
unzip 1000.csv.zip Use cve_manager to import the NIST CVE and CPE data into the database
File: cve_manager.py
A python script originally authored by Antonios Atlasis - aatlasis@secfu.net (mailto:aatlasis@secfu.net)
https://github.com/aatlasis/cve_manager create postgresql (https://www.kitploit.com/search/label/PostgreSQL) databases and views downloads the latest NIST CVE, CPE, and CWE raw data files unzips and loads the NIST raw data files into the database automates custom queries, searches and reports of the NIST data creates csv export reports of the data Changes from original:
Added import of data manipulation (https://www.kitploit.com/search/label/Manipulation) library (https://www.kitploit.com/search/label/Library) pandas
sudo pip3 install pandas openpyxl
Added database view that joins cve and cpe data
Modified default cpe queries and reports to include cvssv3 vector string instead of cvssv2 score
Modified default cpe queries and reports to sort by published date ASC, CVSS DESC, and CPE ASC
Modified cpe output to csv function to automatically save a copy in xlsx format for every csv saved File: email_xlsx_attach.py
New python script, authored by Shane Lawrence
sends the xlsx reports as email attachments through a local smtp relay File: daily.sh
a bash shell script, authored by Shane Lawrence
Puts it all together in something that cron can run daily
Automates the following uses of cve_manager.py: truncates the old database, deletes old datafiles downloads new raw datafiles for CVE data - the vulnerabilities downloads new raw data file for CPE - the vulnerable (https://www.kitploit.com/search/label/Vulnerable) products downloads new top 1000 CWE - the code problems that cause vulnerabilities jams all of the above into a postgres database runs the searches relevant to you creates csv reports of the relevant searches, formatted and sorted for your preferences reads in the csv reports and outputs to xlsx deletes the csvs
Automates the usage of email_xlsx_attach.py
New server setup:
Read the original pdf at:
https://github.com/aatlasis/cve_manager/blob/master/CVE%20Manager.pdf Setup python:
Requires python 3
Do yourself a favor and install pip3 also
pip3 install psycopg2, openpyxl, pandas
Required includes:
psycopg2 - data science libs
pandas - data manipulation libs (dependency on openpyxl)
sys, argparse, os, zipfile, json, requests, re, io, csv, smtplib, base64, email, datetime Setup postgres:
Install the latest postgreql database for your distribution.
as root, systemctl enable postgresql
systemctl start postgresql
then set a password for postgresql user by:
sudo -u postgres psql
\l lists databases
\du lists users
CREATE USER username WITH PASSWORD 'password'; Use cve_manager to create the database:
The user must have create privlileges
./cve_manager.py -u postgres -ps $PASSWORD -server localhost -db $DB -ow $USER -cd Use cve_manager.py to create the schema
The user must have create privileges
./cve_manager.py -u postgres -ps $PASSWORD -server localhost -db $DB -ct Use cve_manager to download the CVE and CPE data
./cve_manager.py -u $user -ps $pass -host $host -db $db -d -p -csv Manually download and unzip the CWE data
wget https://cwe.mitre.org/data/csv/1000.csv.zip
unzip 1000.csv.zip Use cve_manager to import the NIST CVE and CPE data into the database
./cve_manager.py -u $user -ps $pass -host $host -db $db -idb -p Use cve_manager to import the CWE data into the database
./cve_manager.py -u $user -ps $pass -host $host -db $db -icwe 1000.csv Run an example report.
This example creates a csv and xlsx of the vulnerabilities and products they affect,
only rated severity 7.0 or greater, created or updated since 01 July 2020
./cve_manager.py -u $user -ps $password -host $host -db $db -sc 7.0 -dt 2020-07-01 -cpe cpe -csv -o $reports Email the xlsx reports
Modify email_xlsx_attach.py for your smtp relay, sender, recipients, and reports directory.
TODO:
Next iteration is to figure out how to incorperate a list of a critical product inventory,
and only create reports that apply to the CPEs on product inventory.
Shane Lawrence
Sr Advisor, Cloud Platform Security
Download cve_manager_VS (https://github.com/shanelawrence/cve_manager_VS)
./cve_manager.py -u $user -ps $pass -host $host -db $db -icwe 1000.csv Run an example report.
This example creates a csv and xlsx of the vulnerabilities and products they affect,
only rated severity 7.0 or greater, created or updated since 01 July 2020
./cve_manager.py -u $user -ps $password -host $host -db $db -sc 7.0 -dt 2020-07-01 -cpe cpe -csv -o $reports Email the xlsx reports
Modify email_xlsx_attach.py for your smtp relay, sender, recipients, and reports directory.
TODO:
Next iteration is to figure out how to incorperate a list of a critical product inventory,
and only create reports that apply to the CPEs on product inventory.
Shane Lawrence
Sr Advisor, Cloud Platform Security
Download cve_manager_VS (https://github.com/shanelawrence/cve_manager_VS)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hackeando metasploit con metasploit
https://cdn-images-1.medium.com/max/694/0*if3fCs_i63OEQ8i5.png
Para empezar, primero tenemos que hablar del servicio “Msfd”
Continue reading on Medium »
Hackeando metasploit con metasploit
https://cdn-images-1.medium.com/max/694/0*if3fCs_i63OEQ8i5.png
Para empezar, primero tenemos que hablar del servicio “Msfd”
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hacking metasploit with metasploit
https://cdn-images-1.medium.com/max/694/0*51nL0tXdIrHEyBS4.png
msfd — Provides an instance of msfconsole that remote clients can connect to
Continue reading on InfoSec Write-ups »
Hacking metasploit with metasploit
https://cdn-images-1.medium.com/max/694/0*51nL0tXdIrHEyBS4.png
msfd — Provides an instance of msfconsole that remote clients can connect to
Continue reading on InfoSec Write-ups »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Otro defecto crítico de RCE descubierto en la plataforma SolarWinds Orion.
https://cdn-images-1.medium.com/max/895/0*zuD9fsb6bU5cDrOw
El proveedor de administración de infraestructura de TI SolarWinds lanzó el jueves una nueva actualización de su herramienta de monitoreo…
Continue reading on Medium »
Otro defecto crítico de RCE descubierto en la plataforma SolarWinds Orion.
https://cdn-images-1.medium.com/max/895/0*zuD9fsb6bU5cDrOw
El proveedor de administración de infraestructura de TI SolarWinds lanzó el jueves una nueva actualización de su herramienta de monitoreo…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
OpenSSL lanza parches para 2 vulnerabilidades de seguridad de alta gravedad.
https://cdn-images-1.medium.com/max/836/0*tUoRjcksTFdDQrp3
Los mantenedores de OpenSSL han publicado una solución para dos fallas de seguridad de alta gravedad en su software que podrían explotarse…
Continue reading on Medium »
OpenSSL lanza parches para 2 vulnerabilidades de seguridad de alta gravedad.
https://cdn-images-1.medium.com/max/836/0*tUoRjcksTFdDQrp3
Los mantenedores de OpenSSL han publicado una solución para dos fallas de seguridad de alta gravedad en su software que podrían explotarse…
Continue reading on Medium »