Hi, I would like to share how I was able to bypass 2FA. This is a private program on Hackerone, so we will call it example.com.Continue reading on Medium » (https://medium.com/@mohamedtaha_42562/how-i-earned-by-bypassing-2fa-b5487942a86d?source=rss------bug_bounty-5)

Log4j Vulnerability Explanation In Details
https://infosecwriteups.com/log4j-vulnerability-explanation-in-details-73f7556c5ff1?source=rss------bug_bounty-5

Everything you need to know about log4j vulnerability as a hacker !Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/log4j-vulnerability-explanation-in-details-73f7556c5ff1?source=rss------bug_bounty-5)

Powershell .Net Assembly loader for the [CVE-2021-42287 - CVE-2021-42278] Scanner & Exploiter
https://www.reddit.com/r/redteamsec/comments/rlc046/powershell_net_assembly_loader_for_the/

submitted by /u/v1brio (https://www.reddit.com/user/v1brio)
[link] (https://github.com/ricardojba/Invoke-noPac) [comments] (https://www.reddit.com/r/redteamsec/comments/rlc046/powershell_net_assembly_loader_for_the/)

CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter Fork with some improvements
https://www.reddit.com/r/redteamsec/comments/rlc0ve/cve202142287cve202142278_scanner_exploiter_fork/

submitted by /u/v1brio (https://www.reddit.com/user/v1brio)
[link] (https://github.com/ricardojba/noPac) [comments] (https://www.reddit.com/r/redteamsec/comments/rlc0ve/cve202142287cve202142278_scanner_exploiter_fork/)

Mesh-Kridik - An Open-Source Security Checker That Performs Various Security Checks On A Kubernetes Cluster With Istio Service Mesh And Is Leveraged By OPA (Open Policy Agent) To Enforce Security Rules
http://www.kitploit.com/2021/12/mesh-kridik-open-source-security.html

Enhance your Kubernetes (https://www.kitploit.com/search/label/Kubernetes) service mesh security !!mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report.The security checks tests are the full implementation of istio security best practices (https://istio.io/latest/docs/ops/best-practices/security/)
The security checks performed on a Kubernetes cluster with istio service mesh and is leveraged by OPA (Open Policy Agent) to enforce security rules, and the output audit report includes: the root cause of the security issue and proposed remediation for the security issue.

Available commands are:
-r , --report : run audit tests and generate remediation reportExecute tests and generate failure tests report and it remediation's./mesh-kridik -r
Istio Security ChecksNameDescriptionImpact Mutual TLS Istio Mutual TLS proxies are configured in permissive mode by default proxies will accept both mutual TLS and plaintext trafficIstio Safer Authorization (https://www.kitploit.com/search/label/Authorization) Policy Patterns Use ALLOW-with-positive-matching or DENY-with-negative-match patternsThese authorization policy patterns are safer because the worst result in the case of policy mismatch is an unexpected 403 rejection instead of an authorization policy bypass.path normalization in authorization policyThe enforcement point for authorization policies is the Envoy proxy instead of the usual resource access point in the backend applicationA mismatch can lead to either unexpected rejection or a policy bypassTLS origination for egress trafficUse of DestinationRule on service ServiceEntry for egress trafficNot using TLS origination for egress traffic to an external service will be send with plain/textProtocol detectionexplicitly declare the service protocolmiss detection may result in unexpected traffic behaviorCNI supportistio transparent traffic capturenot al net traffic will not be captureoverly broad hostsavoid overly broad hosts settings in Gatewaymay cause potential exposure of unexpected domainsRestrict Gateway creation privilegesrestrict creation of Gateway resources to trusted cluster administratorsmay cause creation of gateway by untrusted usersConfigure a limit on downstream connectionsUpdate global_downstream_max_connections in the config map according to the number of concurrent connections needed by individual gateway instances in your deployment. Once the limit is reached, Envoy will start rejecting tcp connectionsno limit on the number of downstream connections can cause exploited by a malicious actorConfigure third party service account tokensIt is recommended to configure 3rd party tokens Because the properties of the first party token are less securefirst party token properties are less secure and might cause authentication (https://www.kitploit.com/search/label/Authentication) breachControl PlaneIstiod exposes a few unauthenticated plaintext ports for convenience by defaultexposes the XDS service port 15010 and debug port 8080 over unauthenticated plaintextData PlaneThe proxy exposes a variety of portsThe applications running in the same pod as the proxy have access; there is no trust boundary between the sidecar and applicationUnderstand traffic capture (https://www.kitploit.com/search/label/Capture) limitationsSecuring egress traffic by setting the meshConfig.outboundTrafficPolicy.mode external service access will not be controlledUser Plugin Usage (via go plugins)The Kube-kridik expose a hook for user plugins Example (https://github.com/chen-keinan/mesh-kridik/tree/master/examples/plugins) :MeshSecurityCheckResultHook - this hook accepts k8s service mesh security checks resultsCompile user plugin/.so ~//.go ">go build -buildmode=plugin -o=~//.so ~//.goCopy plugin to folder (.kube-kridik folder is created on the 1st startup)/.so ~/.kube-kridik/plugins/compile/.so ">cp ~//.so ~/.kube-kridik/plugins/compile/.soSupported SpecThe Kube-kridik support this specs and can be easily extended:The full Istio service mesh best practices istio security best practices (https://github.com/chen-keinan/mesh-kridik/tree/master/internal/security/mesh/istio)this specs can be easily extended by amended the spec files under ~/.mesh-kridik/security/mesh/istio folderContributioncode contribution is welcome !! , contribution with tests and passing linter is more than welcome :)/.dev folder include vagrantfile (https://www.kitploit.com/search/label/Vagrantfile) to be used for development : Dev Instruction (https://github.com/chen-keinan/mesh-kridik/tree/master/.dev)

Download Mesh-Kridik (https://github.com/chen-keinan/mesh-kridik)

Hacking on Medium
Certified Kubernetes Administrator (CKA) Training & Certification Exam Center

https://cdn-images-1.medium.com/max/1154/1*TegEUco8igkasNP3daCkWg.jpeg
Certified Kubernetes Administrator (CKA) Training & Certification Exam Center

Continue reading on Medium »

Hacking on Medium
Log4j Vulnerability Explanation In Details

https://cdn-images-1.medium.com/max/650/1*qhFpcoL2YTRzxDW-rT3d1Q.jpeg
Everything you need to know about log4j vulnerability as a hacker !

Continue reading on InfoSec Write-ups »

Log4j Vulnerability Explanation In Details

Everything you need to know about log4j vulnerability as a hacker !Continue reading on InfoSec Write-ups »
Read more...

Does Umbacro RCE work in the latest version 7.15.4 of Umbacro? I have tried but it didn't work or maybe I misconfigured something?
https://www.reddit.com/r/Pentesting/comments/rldegt/does_umbacro_rce_work_in_the_latest_version_7154/

submitted by /u/noobsix9 (https://www.reddit.com/user/noobsix9)
[link] (https://www.reddit.com/r/Pentesting/comments/rldegt/does_umbacro_rce_work_in_the_latest_version_7154/) [comments] (https://www.reddit.com/r/Pentesting/comments/rldegt/does_umbacro_rce_work_in_the_latest_version_7154/)

KitPloit - PenTest Tools!
Mesh-Kridik - An Open-Source Security Checker That Performs Various Security Checks On A Kubernetes Cluster With Istio Service Mesh And Is Leveraged By OPA (Open Policy Agent) To Enforce Security Rules

https://blogger.googleusercontent.com/img/a/AVvXsEgA2d8xLaq7Cqm5Fo8hGTWPTguZuiOccXdKlRUFr45rBgtUUVt0hMhJcIvwEGVXZiz9AUFYB1sl9R8c8rLN_RsprSNuDIvnt6jRoTkey46WxAAca2kbwsZBFkSYEvdZgkGl8Uq3TWOZGDzqshdb586bKxolLRKmB_r80e8MZYwZmd5vOKCnC_GxgzeTYw=w640-h348 Enhance your Kubernetes service mesh security !!

mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report.

The security checks tests are the full implementation of istio security best practices
The security checks performed on a Kubernetes cluster with istio service mesh and is leveraged by OPA (Open Policy Agent) to enforce security rules, and the output audit report includes: the root cause of the security issue and proposed remediation for the security issue. https://blogger.googleusercontent.com/img/a/AVvXsEg9Sc1holGlczJ_BD_QVrF2YDhyUXPwODsAvOxWTfB81xEQcTz5xK5m92ZWmuj2IX9bjetUdRWCK5vsmV-IwFr-DFyDldwJ5lSFlZY18dcwAy3EDQUVohqUCBjKi_61oO-YMJcWIDOeCxIQ0gQ6GeiKQkgYnMl0VhxVjUvTN-ZEdKFAvovvImirEn7UKQ=w640-h362 Requirements* Go 1.16+
* jq
* istio Installationgit clone https://github.com/chen-keinan/mesh-kridik
cd mesh-kridik
make build* Note: mesh-kridik require root user to be executed Quick StartExecute Mesh-Kridik without any flags , execute all tests ./mesh-kridik Execute mesh-kridik with flags , execute test on demand Usage: mesh-kridik [--version] [--help] [<args]

Available commands are:
-r , --report : run audit tests and generate remediation reportExecute tests and generate failure tests report and it remediation's ./mesh-kridik -r Istio Security ChecksNameDescriptionImpact Mutual TLS Istio Mutual TLS proxies are configured in permissive mode by default proxies will accept both mutual TLS and plaintext trafficIstio Safer Authorization Policy Patterns Use ALLOW-with-positive-matching or DENY-with-negative-match patternsThese authorization policy patterns are safer because the worst result in the case of policy mismatch is an unexpected 403 rejection instead of an authorization policy bypass.path normalization in authorization policyThe enforcement point for authorization policies is the Envoy proxy instead of the usual resource access point in the backend applicationA mismatch can lead to either unexpected rejection or a policy bypassTLS origination for egress trafficUse of DestinationRule on service ServiceEntry for egress trafficNot using TLS origination for egress traffic to an external service will be send with plain/textProtocol detectionexplicitly declare the service protocolmiss detection may result in unexpected traffic behaviorCNI supportistio transparent traffic capturenot al net traffic will not be captureoverly broad hostsavoid overly broad hosts settings in Gatewaymay cause potential exposure of unexpected domainsRestrict Gateway creation privilegesrestrict creation of Gateway resources to trusted cluster administratorsmay cause creation of gateway by untrusted usersConfigure a limit on downstream connectionsUpdate global_downstream_max_connections in the config map according to the number of concurrent connections needed by individual gateway instances in your deployment. Once the limit is reached, Envoy will start rejecting tcp connectionsno limit on the number of downstream connections can cause exploited by a malicious actorConfigure third party service account tokensIt is recommended to configure 3rd party tokens Because the properties of the first party token are less securefirst party token properties are less secure and might c[...]

ause authentication breachControl PlaneIstiod exposes a few unauthenticated plaintext ports for convenience by defaultexposes the XDS service port 15010 and debug port 8080 over unauthenticated plaintextData PlaneThe proxy exposes a variety of portsThe applications running in the same pod as the proxy have access; there is no trust boundary between the sidecar and applicationUnderstand traffic capture limitationsSecuring egress traffic by setting the meshConfig.outboundTrafficPolicy.mode external service access will not be controlled User Plugin Usage (via go plugins)The Kube-kridik expose a hook for user plugins Example :

* MeshSecurityCheckResultHook - this hook accepts k8s service mesh security checks results Compile user plugingo build -buildmode=plugin -o=~/<plugin/<plugin.so ~/<plugin/<plugin.goCopy plugin to folder (.kube-kridik folder is created on the 1st startup)cp ~/<plugin/<plugin.so ~/.kube-kridik/plugins/compile/<plugin.soSupported SpecThe Kube-kridik support this specs and can be easily extended:

* The full Istio service mesh best practices istio security best practices

this specs can be easily extended by amended the spec files under ~/.mesh-kridik/security/mesh/istiofolder Contribution* code contribution is welcome !! , contribution with tests and passing linter is more than welcome :)
* /.dev folder include vagrantfile to be used for development : Dev Instruction Download Mesh-Kridik