Available commands are:
-r , --report : run audit tests and generate remediation reportExecute tests and generate failure tests report and it remediation's./mesh-kridik -r
Istio Security ChecksNameDescriptionImpact Mutual TLS Istio Mutual TLS proxies are configured in permissive mode by default proxies will accept both mutual TLS and plaintext trafficIstio Safer Authorization (https://www.kitploit.com/search/label/Authorization) Policy Patterns Use ALLOW-with-positive-matching or DENY-with-negative-match patternsThese authorization policy patterns are safer because the worst result in the case of policy mismatch is an unexpected 403 rejection instead of an authorization policy bypass.path normalization in authorization policyThe enforcement point for authorization policies is the Envoy proxy instead of the usual resource access point in the backend applicationA mismatch can lead to either unexpected rejection or a policy bypassTLS origination for egress trafficUse of DestinationRule on service ServiceEntry for egress trafficNot using TLS origination for egress traffic to an external service will be send with plain/textProtocol detectionexplicitly declare the service protocolmiss detection may result in unexpected traffic behaviorCNI supportistio transparent traffic capturenot al net traffic will not be captureoverly broad hostsavoid overly broad hosts settings in Gatewaymay cause potential exposure of unexpected domainsRestrict Gateway creation privilegesrestrict creation of Gateway resources to trusted cluster administratorsmay cause creation of gateway by untrusted usersConfigure a limit on downstream connectionsUpdate global_downstream_max_connections in the config map according to the number of concurrent connections needed by individual gateway instances in your deployment. Once the limit is reached, Envoy will start rejecting tcp connectionsno limit on the number of downstream connections can cause exploited by a malicious actorConfigure third party service account tokensIt is recommended to configure 3rd party tokens Because the properties of the first party token are less securefirst party token properties are less secure and might cause authentication (https://www.kitploit.com/search/label/Authentication) breachControl PlaneIstiod exposes a few unauthenticated plaintext ports for convenience by defaultexposes the XDS service port 15010 and debug port 8080 over unauthenticated plaintextData PlaneThe proxy exposes a variety of portsThe applications running in the same pod as the proxy have access; there is no trust boundary between the sidecar and applicationUnderstand traffic capture (https://www.kitploit.com/search/label/Capture) limitationsSecuring egress traffic by setting the meshConfig.outboundTrafficPolicy.mode external service access will not be controlledUser Plugin Usage (via go plugins)The Kube-kridik expose a hook for user plugins Example (https://github.com/chen-keinan/mesh-kridik/tree/master/examples/plugins) :MeshSecurityCheckResultHook - this hook accepts k8s service mesh security checks resultsCompile user plugin/.so ~//.go ">go build -buildmode=plugin -o=~//.so ~//.goCopy plugin to folder (.kube-kridik folder is created on the 1st startup)/.so ~/.kube-kridik/plugins/compile/.so ">cp ~//.so ~/.kube-kridik/plugins/compile/.soSupported SpecThe Kube-kridik support this specs and can be easily extended:The full Istio service mesh best practices istio security best practices (https://github.com/chen-keinan/mesh-kridik/tree/master/internal/security/mesh/istio)this specs can be easily extended by amended the spec files under ~/.mesh-kridik/security/mesh/istio folderContributioncode contribution is welcome !! , contribution with tests and passing linter is more than welcome :)/.dev folder include vagrantfile (https://www.kitploit.com/search/label/Vagrantfile) to be used for development : Dev Instruction (https://github.com/chen-keinan/mesh-kridik/tree/master/.dev)

Download Mesh-Kridik (https://github.com/chen-keinan/mesh-kridik)

Hacking on Medium
Certified Kubernetes Administrator (CKA) Training & Certification Exam Center

https://cdn-images-1.medium.com/max/1154/1*TegEUco8igkasNP3daCkWg.jpeg
Certified Kubernetes Administrator (CKA) Training & Certification Exam Center

Continue reading on Medium »

Hacking on Medium
Log4j Vulnerability Explanation In Details

https://cdn-images-1.medium.com/max/650/1*qhFpcoL2YTRzxDW-rT3d1Q.jpeg
Everything you need to know about log4j vulnerability as a hacker !

Continue reading on InfoSec Write-ups »

Log4j Vulnerability Explanation In Details

Everything you need to know about log4j vulnerability as a hacker !Continue reading on InfoSec Write-ups »
Read more...

Does Umbacro RCE work in the latest version 7.15.4 of Umbacro? I have tried but it didn't work or maybe I misconfigured something?
https://www.reddit.com/r/Pentesting/comments/rldegt/does_umbacro_rce_work_in_the_latest_version_7154/

submitted by /u/noobsix9 (https://www.reddit.com/user/noobsix9)
[link] (https://www.reddit.com/r/Pentesting/comments/rldegt/does_umbacro_rce_work_in_the_latest_version_7154/) [comments] (https://www.reddit.com/r/Pentesting/comments/rldegt/does_umbacro_rce_work_in_the_latest_version_7154/)

KitPloit - PenTest Tools!
Mesh-Kridik - An Open-Source Security Checker That Performs Various Security Checks On A Kubernetes Cluster With Istio Service Mesh And Is Leveraged By OPA (Open Policy Agent) To Enforce Security Rules

https://blogger.googleusercontent.com/img/a/AVvXsEgA2d8xLaq7Cqm5Fo8hGTWPTguZuiOccXdKlRUFr45rBgtUUVt0hMhJcIvwEGVXZiz9AUFYB1sl9R8c8rLN_RsprSNuDIvnt6jRoTkey46WxAAca2kbwsZBFkSYEvdZgkGl8Uq3TWOZGDzqshdb586bKxolLRKmB_r80e8MZYwZmd5vOKCnC_GxgzeTYw=w640-h348 Enhance your Kubernetes service mesh security !!

mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report.

The security checks tests are the full implementation of istio security best practices
The security checks performed on a Kubernetes cluster with istio service mesh and is leveraged by OPA (Open Policy Agent) to enforce security rules, and the output audit report includes: the root cause of the security issue and proposed remediation for the security issue. https://blogger.googleusercontent.com/img/a/AVvXsEg9Sc1holGlczJ_BD_QVrF2YDhyUXPwODsAvOxWTfB81xEQcTz5xK5m92ZWmuj2IX9bjetUdRWCK5vsmV-IwFr-DFyDldwJ5lSFlZY18dcwAy3EDQUVohqUCBjKi_61oO-YMJcWIDOeCxIQ0gQ6GeiKQkgYnMl0VhxVjUvTN-ZEdKFAvovvImirEn7UKQ=w640-h362 Requirements* Go 1.16+
* jq
* istio Installationgit clone https://github.com/chen-keinan/mesh-kridik
cd mesh-kridik
make build* Note: mesh-kridik require root user to be executed Quick StartExecute Mesh-Kridik without any flags , execute all tests ./mesh-kridik Execute mesh-kridik with flags , execute test on demand Usage: mesh-kridik [--version] [--help] [<args]

Available commands are:
-r , --report : run audit tests and generate remediation reportExecute tests and generate failure tests report and it remediation's ./mesh-kridik -r Istio Security ChecksNameDescriptionImpact Mutual TLS Istio Mutual TLS proxies are configured in permissive mode by default proxies will accept both mutual TLS and plaintext trafficIstio Safer Authorization Policy Patterns Use ALLOW-with-positive-matching or DENY-with-negative-match patternsThese authorization policy patterns are safer because the worst result in the case of policy mismatch is an unexpected 403 rejection instead of an authorization policy bypass.path normalization in authorization policyThe enforcement point for authorization policies is the Envoy proxy instead of the usual resource access point in the backend applicationA mismatch can lead to either unexpected rejection or a policy bypassTLS origination for egress trafficUse of DestinationRule on service ServiceEntry for egress trafficNot using TLS origination for egress traffic to an external service will be send with plain/textProtocol detectionexplicitly declare the service protocolmiss detection may result in unexpected traffic behaviorCNI supportistio transparent traffic capturenot al net traffic will not be captureoverly broad hostsavoid overly broad hosts settings in Gatewaymay cause potential exposure of unexpected domainsRestrict Gateway creation privilegesrestrict creation of Gateway resources to trusted cluster administratorsmay cause creation of gateway by untrusted usersConfigure a limit on downstream connectionsUpdate global_downstream_max_connections in the config map according to the number of concurrent connections needed by individual gateway instances in your deployment. Once the limit is reached, Envoy will start rejecting tcp connectionsno limit on the number of downstream connections can cause exploited by a malicious actorConfigure third party service account tokensIt is recommended to configure 3rd party tokens Because the properties of the first party token are less securefirst party token properties are less secure and might c[...]

ause authentication breachControl PlaneIstiod exposes a few unauthenticated plaintext ports for convenience by defaultexposes the XDS service port 15010 and debug port 8080 over unauthenticated plaintextData PlaneThe proxy exposes a variety of portsThe applications running in the same pod as the proxy have access; there is no trust boundary between the sidecar and applicationUnderstand traffic capture limitationsSecuring egress traffic by setting the meshConfig.outboundTrafficPolicy.mode external service access will not be controlled User Plugin Usage (via go plugins)The Kube-kridik expose a hook for user plugins Example :

* MeshSecurityCheckResultHook - this hook accepts k8s service mesh security checks results Compile user plugingo build -buildmode=plugin -o=~/<plugin/<plugin.so ~/<plugin/<plugin.goCopy plugin to folder (.kube-kridik folder is created on the 1st startup)cp ~/<plugin/<plugin.so ~/.kube-kridik/plugins/compile/<plugin.soSupported SpecThe Kube-kridik support this specs and can be easily extended:

* The full Istio service mesh best practices istio security best practices

this specs can be easily extended by amended the spec files under ~/.mesh-kridik/security/mesh/istiofolder Contribution* code contribution is welcome !! , contribution with tests and passing linter is more than welcome :)
* /.dev folder include vagrantfile to be used for development : Dev Instruction Download Mesh-Kridik

Can you use sqlmap to test a url within a database?
https://www.reddit.com/r/Pentesting/comments/rlf55d/can_you_use_sqlmap_to_test_a_url_within_a_database/

<!-- SC_OFF -->I have a database containing a url. Can I run sqlmap against the database and test the url within it directly? <!-- SC_ON --> submitted by /u/shady_bananas (https://www.reddit.com/user/shady_bananas)
[link] (https://www.reddit.com/r/Pentesting/comments/rlf55d/can_you_use_sqlmap_to_test_a_url_within_a_database/) [comments] (https://www.reddit.com/r/Pentesting/comments/rlf55d/can_you_use_sqlmap_to_test_a_url_within_a_database/)

Will attack such as LLMNR, NBT-NS and MDNS poisoner cause any issue to internal network?
https://www.reddit.com/r/Pentesting/comments/rlg29d/will_attack_such_as_llmnr_nbtns_and_mdns_poisoner/

<!-- SC_OFF -->I've seen these kind of attacks are pretty common in any internal pentest tutorial. But is this save? Will it cause any issue to customer's network? <!-- SC_ON --> submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/rlg29d/will_attack_such_as_llmnr_nbtns_and_mdns_poisoner/) [comments] (https://www.reddit.com/r/Pentesting/comments/rlg29d/will_attack_such_as_llmnr_nbtns_and_mdns_poisoner/)

Dark Reading: Attacks/Breaches
How Is Zero Trust Evolving to Be More Continuous in Verifying Trust?

For zero trust to be successful, organizations need to be able to check user identity, device posture, and overall behavior without adding friction to the experience.

Web Security Academy Question
https://www.reddit.com/r/Pentesting/comments/rlghoo/web_security_academy_question/

<!-- SC_OFF -->Is it possible to complete all Labs without PortSwigger? I know it’s a good tool however the professional edition is out of my budget. <!-- SC_ON --> submitted by /u/JefferyHolland_ (https://www.reddit.com/user/JefferyHolland_)
[link] (https://www.reddit.com/r/Pentesting/comments/rlghoo/web_security_academy_question/) [comments] (https://www.reddit.com/r/Pentesting/comments/rlghoo/web_security_academy_question/)

Kali Linux Tutorials
What is Cyber Resilience and How to Measure It?

When it comes to protecting your castle against hackers, ransomware crooks, and all manner of digital lowlifes cyber resilience is one of your most important weapons — it’s a key factor that determines your success on that battlefield. Basically, in a nutshell, cyber resilience is the capacity for your organisation to take a hit and keep on ticking. It’s how you handle and get off the mat, and continue to operate, in the middle of a doomsday scenario. What is cyber resilience?Cyber resilience is your ability to continuously deliver your products, your services, your intended outcomes, your whole operation despite being against the ropes and suffering a security breach or a crisis. It’s the ability to say, and act, as if everything is alright, business as usual, in the middle of a crisis.

This concept also refers to your ability to restore or recover regular mechanisms after such a troubling event — backups, disaster recovery operations, etc. A cyber resilient operation is nimble and can adapt rapidly to unknown crises, threats, adversities, and multiple attacks. Why is it so important?Because, despite your best defence, despite how many updates you have on hand, and the tech you’ve employed, and how much you’ve invested in cyber-security, there’s a good chance that during the lifetime of your business you will suffer an attack. And maybe not just one.

All businesses have experienced cyber-breach. Not just small mom and pops, but huge, heavily protected, cyber-robust companies. Businesses like Apple, Sony, Microsoft, Google. Not just business but governments and actual espionage agencies.

In 2017, a security breach of the NSA shook the nation. It slowed all intelligence operations, resulted in hacking attacks to multiple companies, and basically punched that agency’s moral right in the guts. And you want to know what’s even more frustrating? It was one of many hacks and cyber breaches the agency has faced during the last couple of years. In 2016, due to a Windows security vulnerability, the hacker group Shadow Brokers made off like bandits with top-level security codes. In 2014, a Chinese group known as Judgement Panda gained access to the agency’s mainframe and managed to install mirroring tools —- that were active for over 3 years. The most famous case? Edward Snowden breached the agency, through the use of SSH keys and stealing trojans. The Wikileaks scandal became a worldwide event.

In other words, if the NSA, as well as the CIA, MI-6, and all other premier Federal organisations, have been breached – constantly – by cyber-crooks, despite all their firewalls, what makes you think you’re immune to an attack, to a successful attack. This is where cyber resilience comes in. Cyber resiliency level.There are multiple cyber resiliency levels or frameworks used to assess how well you react to a threat and a crisis. Each corporation, each institute has one. Lockheed Martin, for example, developed the Cyber Resiliency Level (CRL) Framework. The Department of Homeland Security coined the CRR or Cyber Resiliency Review. Apple has one. Microsoft has another. Even Nike has a framework in place.

What they all have in common are 4 pillars: Protection, Detection, Respond and Recovery. Our adaptive capacity to coordinate, diversify, position ourselves, hide critical assist, confuse the adversary, and realign our operation amid an attack. What’s the difference between cyber-security and cyber resilience?Cyber security consists of the process, tools, and different measures you take to protect your systems, data, and networks. It basically reduces the risk of an attack. Cyber resilience meanwhile helps businesses come to terms with one glaring certainty — hackers have the upper hand. They have better innovative tools, [...]

they have the element of surprise, and they only need to be successful once to make a dent and truly hurt you.

Hackers are extremely motivated and well funded. Professionals in this field are in fact huge groups and not individuals that invest a lot in their gear and training. Why? Because a small job, a tiny breach can end up giving them huge profits. Profits in the millions. Components of cyber resilienceIt’s important to understand the 4 major components of cyber resilience. These 4 pillars will determine how you pivot in the middle of a crisis and maintain your operation running despite an attack. Protection Protection is mainly a task of your cyber security team. They will do everything in their power to safeguard your systems and networks. DetectionAnalytic monitoring and detection of adverse actions and conditions is key to a great cyber resilience strategy. The quicker you understand the attack, and have a dynamic position, the faster you can react and minimise how said attack affects your business. Respond Having a dynamic position increases your ability to rapidly recover from an attack. In many cases, it’s like a good game of chess. You’ll have to diversify your moves, mislead, confuse, and hide critical assets, expose tainted assets, and in many cases even sacrifice a few ones.

There are multiple ways to respond to an attack and only your team, based on your organisation, can give you an efficient cyber resilience plan. RecoveryRecovery is based mostly on the idea that “one is none and two is one,” in other words on multiple levels of redundancy. You’ll need separate systems that will allow you to continue working and recover rapidly in the event of a strike. Systems with backups or critical resources and data. The benefits of a high-level cyber resiliencyThe truth is that cyber resilience services give you a key advantage — the knowledge and certainty that sooner or later you will be breached. Think about your operation, just for a second. Imagine what one day of being offline, unable to operate will cost you. Now multiply that by 21, that’s the number of days most businesses find themselves rudderless and lost at sea in the middle of an attack. Businesses with no cyber resilience plan can spend up to 3 weeks motionless, bleeding money, with no operational capacity. Most lose more money because of that period of inaction than from the attack itself.

Will attack such as LLMNR, NBT-NS and MDNS poisoner cause any issue to internal network?
https://www.reddit.com/r/redteamsec/comments/rlg2at/will_attack_such_as_llmnr_nbtns_and_mdns_poisoner/

<!-- SC_OFF -->I've seen these kind of attacks are pretty common in any internal pentest tutorial. But is this save? Will it cause any issue to customer's network? <!-- SC_ON --> submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/redteamsec/comments/rlg2at/will_attack_such_as_llmnr_nbtns_and_mdns_poisoner/) [comments] (https://www.reddit.com/r/redteamsec/comments/rlg2at/will_attack_such_as_llmnr_nbtns_and_mdns_poisoner/)

Hacking on Medium
What’s up with Bent Finance Hack?

https://cdn-images-1.medium.com/max/1390/1*9iKDlpkZzdam4gOkB4Pddw.png
The precise flow of the Bent Finance hack incident:

Continue reading on Medium »