Hacking on Medium
Burp Suite Certified Practitioner — Getting Started

https://cdn-images-1.medium.com/max/2000/0*Nr1jSxuL5kZPW8nE
Hello and welcome to HaXeZ, today we’re going to be talking about the Burp Suite Certified Practitioner certification. For those new to…

Continue reading on Medium »

Hacking on Medium
PortSwigger Web Security Academy: SQL injection 1

https://cdn-images-1.medium.com/max/2000/0*uHWHJdjlAWEHCQsN
Hello friends and thanks for coming to HaXeZ where today we’re looking at the first SQL injection lab on PortswiggerWeb Security Academy…

Continue reading on Medium »

Vimana - An Experimental Security Framework That Aims To Provide Resources For Auditing Python Web Applications

Vimana is a modular security framework designed to audit Python web applications.The base of the Vimana is composed of crawlers focused on frameworks (in addition to the generic ones for web), trackers, discovery, fuzzer, parser among other types of modules. The main idea, from where the framework emerged, is to identify, through a blackbox approach, configuration flaws and inadequate and/or insufficient implementations that allow unhandled exceptions to be triggered. Depending on the framework settings (or specific libs even when not using frameworks, for example raw wsgi) this can lead to leakage of sensitive and critical information that can allow to compromising the entire application, server, apis, databases, services and any third part software with tokens, secrets or api keys in current exposed environment variables.Another important step performed by Vimana is to obtain and reconstruct the source code snippets of the affected modules (leaked by exceptions) that allow the discovery of hardcoded credentials, connection strings to databases, vulnerable libraries, in addition to allowing the analysis of logic of the application of a mixed perspective between the black and whitebox approaches, since the initial analysis starts from a blind test, but ends up allowing access to code snippets.Content Getting Started with Vimana About this Version Vimana is not Use Cases Acknowledgment Disclaimer Download Vimana-Framework
Read more...

Vimana - An Experimental Security Framework That Aims To Provide Resources For Auditing Python Web Applications
http://www.kitploit.com/2021/11/vimana-experimental-security-framework.html

Vimana is a modular security framework designed to audit (https://www.kitploit.com/search/label/Audit) Python web applications.
The base of the Vimana is composed of crawlers focused on frameworks (in addition to the generic ones for web), trackers, discovery, fuzzer, parser among other types of modules. The main idea, from where the framework emerged, is to identify, through a blackbox approach, configuration flaws and inadequate and/or insufficient implementations that allow unhandled exceptions to be triggered. Depending on the framework settings (or specific libs even when not using frameworks, for example raw wsgi) this can lead to leakage of sensitive and critical information that can allow to compromising the entire application, server, apis, databases, services and any third part software with tokens, secrets or api keys in current exposed environment variables.
Another important step performed by Vimana is to obtain and reconstruct the source code snippets of the affected modules (leaked by exceptions) that allow the discovery of hardcoded credentials, connection strings to databases, vulnerable libraries, in addition to allowing the analysis of logic of the application of a mixed perspective between the black and whitebox approaches, since the initial analysis starts from a blind test, but ends up allowing access to code snippets.
Content
Getting Started with Vimana (https://github.com/s4dhulabs/vimana-framework/wiki/Getting-Started-with-Vimana) About this Version (https://github.com/s4dhulabs/vimana-framework/wiki/About-this-version) Vimana is not (https://github.com/s4dhulabs/vimana-framework/wiki/Vimana-is-not) Use Cases (https://github.com/s4dhulabs/vimana-framework/wiki/Use-cases) Acknowledgment (https://github.com/s4dhulabs/vimana-framework/wiki/Acknowledgment) Disclaimer (https://github.com/s4dhulabs/vimana-framework/wiki/Disclaimer)

Download Vimana-Framework (https://github.com/s4dhulabs/vimana-framework)

KitPloit - PenTest Tools!
Vimana - An Experimental Security Framework That Aims To Provide Resources For Auditing Python Web Applications

http://3.bp.blogspot.com/-cczMu4yCVFk/YXsv7pWnVUI/AAAAAAAAzCE/cGHZSTd5C5k33P-DzxX1FjHSATpMz5GwgCK4BGAYYCw/w640-h358/vimana-framework_1_vimana1-743256.png
Vimana is a modular security framework designed to audit Python web applications.
The base of the Vimana is composed of crawlers focused on frameworks (in addition to the generic ones for web), trackers, discovery, fuzzer, parser among other types of modules. The main idea, from where the framework emerged, is to identify, through a blackbox approach, configuration flaws and inadequate and/or insufficient implementations that allow unhandled exceptions to be triggered. Depending on the framework settings (or specific libs even when not using frameworks, for example raw wsgi) this can lead to leakage of sensitive and critical information that can allow to compromising the entire application, server, apis, databases, services and any third part software with tokens, secrets or api keys in current exposed environment variables.
Another important step performed by Vimana is to obtain and reconstruct the source code snippets of the affected modules (leaked by exceptions) that allow the discovery of hardcoded credentials, connection strings to databases, vulnerable libraries, in addition to allowing the analysis of logic of the application of a mixed perspective between the black and whitebox approaches, since the initial analysis starts from a blind test, but ends up allowing access to code snippets.
Content

* Getting Started with Vimana
* About this Version
* Vimana is not
* Use Cases
* Acknowledgment
* Disclaimer
Download Vimana-Framework

Dark Reading: Attacks/Breaches
Free Tool Scans Web Servers for Vulnerability to HTTP Header-Smuggling Attacks

A researcher will release an open source tool at Black Hat Europe next week that roots out server weaknesses to a sneaky type of attack.

Dark Reading: Attacks/Breaches
SonicWall: 'The Year of Ransomware' Continues with Unprecedented Late-Summer Surge

2021 will be the most costly and dangerous year on record.

Dark Reading: Attacks/Breaches
CrowdStrike to Buy Zero-Trust SaaS Provider

SecureCircle provides data-level zero-trust control to endpoints.

Dark Reading: Attacks/Breaches
How AI-Driven Security Analytics Speeds Up Enterprise Defense

Fresh off a $250 million Series E round, Devo Technology plans to expand the core security analytics platform with new features to help enterprise defenders work with security data faster and more effectively.

Dark Reading: Attacks/Breaches
Zscaler’s 2021 Encrypted Attacks Report Reveals 314% Spike in HTTPS Threats

Massive increase in cyberattacks targeting technology and retail industries confirms immediate need for zero-trust security

Dark Reading: Attacks/Breaches
CISA and Partners Coordinate on Security, Combatting Misinformation for Election Day

CISA will host an election situational awareness room to coordinate with federal partners, state and local election officials, private sector election partners, and political organizations to share real-time information and provide support as needed.

Dark Reading: Attacks/Breaches
New 'Trojan Source' Method Lets Attackers Hide Vulns in Source Code

Researchers discover a new technique attackers could use to encode vulnerabilities into software while evading detection.