to create a dynamic block list for firewalls and intrusion prevention (https://www.kitploit.com/search/label/Intrusion%20Prevention) systems, the CodeBuild projects can be repurposed to drop CSV or flat files to almost any location (e.g. Palo Alto firewalls, Squid forward proxy URL filters, etc.).3. What are the gaps in this solution?SyntheticSun currently lacks full coverage across all main log sources - namely, S3 Access Logs and CloudFront Access Logs, which are integral to the way a lot of folks deliver services (especially for SPAs on S3 buckets). The anomaly detection does not extend past WAF, API Gateway Access Logs, or CloudTrail due to my obsession with IP Insights and complete lack of any data science training (seriously, I don't even know how to use pandas or numpy). There is not any in-depth analysis of raw threat intelligence IoCs other than attempting to match it in the logs.4. Outside of the Masters for the AWS Security Services, what considerations are there for an Organizational deployment?The easiest way to deploy this solution for an organization is to deploy it in a centralized security services account. For the lower-level telemetry such as VPC Flow Logs and WAF Logs, you should consider providing helper scripts or CloudFormation templates via AWS Service Catalog to promote enablement in lower environments. You will need to evaluate your shard consumption and index rotation of Elasticsearch Service, as well as the permissions, if you will be having cross-account Kinesis Data Firehose delivery streams publishing into a centralized location. I built this solution in my personal sandbox account, hence why I did not bake any of the considerations from above into the solution, I will be happy to work on a PR with this in mind and may do it myself in the future.As of 31 JULY 2020 AWS Firewall Manager Policies support the multi-account aggregation of WAF Logging which brings you one step closer to making this a lot less painful...5. What is the IP Insights algorithm? Is your usage really what it was intended for?CAVEATS: I am not a data scientist and this is going to be a long answer. Tl;dr: It's an anomaly finder and I think?Given that I am not remotely close to a data scientist or have any training you are better served reading the docs (https://docs.aws.amazon.com/sagemaker/latest/dg/ip-insights-howitworks.html) on this. That said, here is my layman's attempt at it: IP Insights is an unsupervised machine learning algorithm that learns the relationship between an IPv4 address and an entity (e.g. Account number, user name, user-agent). IP Insights then attempts to determine how likely it is that the entity would use that IPv4 address. Behind the curtains of IP Insights is a neural network that learns the latent vector representation of these entities and IPv4 addresses. The distance between these vectorized representations is emblematic for how anomalous (or not) it is for an entity to be associated with (e.g send a request from) an IPv4 address.Neural networks are almost exactly like they sound; they form a machine learning system designed to behave similarly to the human brain, complete with computerized neurons and synapses. In unsupervised machine learning, the algorithm can suss out what "good" (i.e. True Negative) looks like versus "bad" (i.e. True Positive) by looking at the association between all IPv4 addresses and their paired entities. This association is evaluated in order to identify what vectors are similar to the others by their "distance". In IP Insights' case, a prebuilt encoder is provided that searches for IPv4 addresses and then hashes out all entities into clusters. It then iterates over them using vectorization. Vectorization is a way to perform computations as a matrix instead of looping over them (think of a "For" loop for a list containing tens of millions of values).When you are training an IP Insights model, it will actually create itself false positives by pairing IPv4 addresses

___________________________
@hacking_Attack
@Hacking_Video

with entities that have a far distance (i.e. highly anomalous) and are less likely to actually occur in reality; the model can now discriminate between True Positives, False Positives and True Negatives. This is done to prevent another crazy ass term called "cross entropy" (AKA "log loss" as if that makes it better), and introduces another term, binary classification. IP Insights is essentially asking, "What is the chance that this IP address paired with this entity is anomalous?" This is what makes it binary, I think, so "yes it's bad" or "not it is not". The probability is represented as a value between 0 and 1, the goal of all machine learning models is to make this as close to 0 as possible, so predicting a value of 0.01 for something that is really 1 (known True Positive) would result in very high log loss. So, with all that said, by making purposely garbage data IP Insights helps to reduce that log loss (i.e. bad predictions) during training.That brings us to the output from the endpoint. When you query it (either via batches or in near real-time using the InvokeEndpoint API) the response is an unbounded float that can be negative or positive. The higher above 0 it is, the more likely it is anomalous, which is where your work begins. For this solution I chose anything above 0.03, which is largely notional, to get closer to the truth you should provide True Positives to the endpoint and see what your response is. Based on those findings, you could configure a tiered approach where you application may issue a second factor challenge, raise an alert or block it outright depending on the score. The answer to the second part of the question is "Yes, I think so", training the model with user-agents paired with an IP is actually pretty sketchy. Now for other less volatile entities (account number, user name, IAM user) it feels like the intended usage.6. What threat intelligence feeds should I use? What happens if there are duplicates?In the solution I provide some example feeds that you should use, some are pretty obvious like the cybercrime domain feed, Emerging Threats and CI-badguys. In my real job I work with one of the most talented cyber threat intelligence specialists in the entire world (no joke she is awesome!), who also influenced the choices. Like machine learning models and anything else you will build, you should tailor your threat intel feeds and aggregation to match your current threat environment. Duplicates are identified in MISP and only a hash key is specified in the DynamoDB tables to enforce uniqueness, so even if there are 5 feeds reporting on the same IPv4 address, only one will make it to the table.You can also bring your own commercial threat intel platforms and feeds such as InfoBlox or Recorded Future into this solution by pointing them at the DynamoDB tables with similar syntax.7. I did a look up against the raw log sources in S3 and I am not seeing the entries in Elasticsearch; why is this?Most log delivery from AWS is "best effort," so there is not an official SLA published; however, I would assume it is around 99.5 - 99.9%, where anything in that last 0.5 - 0.1% will not be delivered. "Production" traffic is also first class in AWS; if there are network bandwidth constraints it will default to delivering connectivity back to clients versus sending out logs. The more likely event is that the raw log file was too large for Lambda to process the entire thing in time; you see this a lot when you are being hosed by a DOS or crawler from the same client IP. WAF and ALB bundle log files by the caller (from what I can tell), so if you absorb hundreds of requests, the log file can be very large.8. I have an existing Elasticsearch Service domain in a VPC; will this solution work?Yes, however you will need to perform one of the following:Place the Lambda functions into a VPC and attach VPC Endpoints for S3, DynamoDB, and CloudWatch Logs.Alternatively, modify the solution to publish the final formatted logs

___________________________
@hacking_Attack
@Hacking_Video

Misconfiguration OAuth Lead Account Takeover

Assalamuallaikum Wr.Wb Hello friends I want to explain about the bug bounty that I got in 2020, this vulnerability lies in the weak OAuthContinue reading on Medium »
Read more...

Hacking on Medium
SQLbit | Just Another Script For Automatize Boolean-Based Blind SQL Injections

https://cdn-images-1.medium.com/max/640/0*-HZ7t68mm1fqy4X5.png
A script for automatizing boolean-based blind SQL injections.
Works with SQLite at least supports using cookies.
It uses bitwise…

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TrojanSourceFinder | Help Find Trojan Source Vulnerability In Code

https://cdn-images-1.medium.com/max/1280/1*JP6vr1oSUPoiNzpa1Pj-Bw.png
TrojanSourceFinder helps developers detect “Trojan Source” vulnerability in source code.

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Polygon Fixes the Critical Vulnerability in the Network, Saving Matic Worth of Billions.

https://cdn-images-1.medium.com/max/1024/1*04yEjp-qPjFM-9M9ZTGTZQ.jpeg
Polygon Network, on December 29th, fixed the bug in the system that saved $9 Billion worth of MATIC. Whitehat hacker, Leon Spacewalker…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

How to freely borrow all the TVL from the Jet Protocol

Recently I discovered a critical vulnerability that could possibly lead to the loss of funds in the smart contract of Jet Protocol, a…Continue reading on Medium »
Read more...

Spotlight: Earn Bitcoin While Browsing The Web On Desktop And Mobile
https://medium.com/@daniel.j.hunt/spotlight-earn-bitcoin-while-browsing-the-web-on-desktop-and-mobile-6512636addd3?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Is it too good to be true? Well, join me on my quest to find out.Continue reading on Medium » (https://medium.com/@daniel.j.hunt/spotlight-earn-bitcoin-while-browsing-the-web-on-desktop-and-mobile-6512636addd3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

SQL Injection - The File Upload Playground
https://shahjerry33.medium.com/sql-injection-the-file-upload-playground-6580b089d013?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Summary :Continue reading on Medium » (https://shahjerry33.medium.com/sql-injection-the-file-upload-playground-6580b089d013?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do hackers handle the pressure of the day to day?

Lets be real. Name one successful hacker that ISNT paranoid as balls. Shit eats at you no matter how great you think you are.

How are we managing mental health while we work is my question? Any anonymous homies want to share tips on how to manage the stress? What do you do to unwind? How do you find a mentor if you need help?

Appreciate anyone that takes the time to sincerely answer this

submitted by /u/totie01010
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to combine Data Science with hacking / IT-security?

Since I was a kid, ~20 years ago, I was interested in IT security. Even though there was not much information out there, I still did simple stuff like scripting, playing with trojans/viruses, wireless wiretap, hacking computer games etc. . But I had no support / help / person to ask, so it got more and more difficult for my 11 year old brain, and I stopped.

Now many years later I study Data Science, which is a lot of statistics (also with many ML topics like (un)supervised learning, reinforcement learning etc.) with a bit of CompSci topics like Data structures, Algorithm, programming, data bases, SW engineering...

My question: Is there any way to combine this Data Science knowledge with hacking/ IT-security? So that I can specialize in a topic Im really interested in? So far, I really miss the technical stuff in Data Science, which inspires me since I was a kid. Finding out gaps, errors and weak points in a system is something that really intrinsically motivates me.

Thanks in advance!

submitted by /u/dongpal
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Misconfiguration OAuth Lead Account Takeover
https://human-error.medium.com/misconfiguration-oauth-lead-account-takeover-f695c6f44d6e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Assalamuallaikum Wr.Wb Hello friends I want to explain about the bug bounty that I got in 2020, this vulnerability lies in the weak OAuthContinue reading on Medium » (https://human-error.medium.com/misconfiguration-oauth-lead-account-takeover-f695c6f44d6e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video