with entities that have a far distance (i.e. highly anomalous) and are less likely to actually occur in reality; the model can now discriminate between True Positives, False Positives and True Negatives. This is done to prevent another crazy ass term called "cross entropy" (AKA "log loss" as if that makes it better), and introduces another term, binary classification. IP Insights is essentially asking, "What is the chance that this IP address paired with this entity is anomalous?" This is what makes it binary, I think, so "yes it's bad" or "not it is not". The probability is represented as a value between 0 and 1, the goal of all machine learning models is to make this as close to 0 as possible, so predicting a value of 0.01 for something that is really 1 (known True Positive) would result in very high log loss. So, with all that said, by making purposely garbage data IP Insights helps to reduce that log loss (i.e. bad predictions) during training.That brings us to the output from the endpoint. When you query it (either via batches or in near real-time using the InvokeEndpoint API) the response is an unbounded float that can be negative or positive. The higher above 0 it is, the more likely it is anomalous, which is where your work begins. For this solution I chose anything above 0.03, which is largely notional, to get closer to the truth you should provide True Positives to the endpoint and see what your response is. Based on those findings, you could configure a tiered approach where you application may issue a second factor challenge, raise an alert or block it outright depending on the score. The answer to the second part of the question is "Yes, I think so", training the model with user-agents paired with an IP is actually pretty sketchy. Now for other less volatile entities (account number, user name, IAM user) it feels like the intended usage.6. What threat intelligence feeds should I use? What happens if there are duplicates?In the solution I provide some example feeds that you should use, some are pretty obvious like the cybercrime domain feed, Emerging Threats and CI-badguys. In my real job I work with one of the most talented cyber threat intelligence specialists in the entire world (no joke she is awesome!), who also influenced the choices. Like machine learning models and anything else you will build, you should tailor your threat intel feeds and aggregation to match your current threat environment. Duplicates are identified in MISP and only a hash key is specified in the DynamoDB tables to enforce uniqueness, so even if there are 5 feeds reporting on the same IPv4 address, only one will make it to the table.You can also bring your own commercial threat intel platforms and feeds such as InfoBlox or Recorded Future into this solution by pointing them at the DynamoDB tables with similar syntax.7. I did a look up against the raw log sources in S3 and I am not seeing the entries in Elasticsearch; why is this?Most log delivery from AWS is "best effort," so there is not an official SLA published; however, I would assume it is around 99.5 - 99.9%, where anything in that last 0.5 - 0.1% will not be delivered. "Production" traffic is also first class in AWS; if there are network bandwidth constraints it will default to delivering connectivity back to clients versus sending out logs. The more likely event is that the raw log file was too large for Lambda to process the entire thing in time; you see this a lot when you are being hosed by a DOS or crawler from the same client IP. WAF and ALB bundle log files by the caller (from what I can tell), so if you absorb hundreds of requests, the log file can be very large.8. I have an existing Elasticsearch Service domain in a VPC; will this solution work?Yes, however you will need to perform one of the following:Place the Lambda functions into a VPC and attach VPC Endpoints for S3, DynamoDB, and CloudWatch Logs.Alternatively, modify the solution to publish the final formatted logs

___________________________
@hacking_Attack
@Hacking_Video

Misconfiguration OAuth Lead Account Takeover

Assalamuallaikum Wr.Wb Hello friends I want to explain about the bug bounty that I got in 2020, this vulnerability lies in the weak OAuthContinue reading on Medium »
Read more...

Hacking on Medium
SQLbit | Just Another Script For Automatize Boolean-Based Blind SQL Injections

https://cdn-images-1.medium.com/max/640/0*-HZ7t68mm1fqy4X5.png
A script for automatizing boolean-based blind SQL injections.
Works with SQLite at least supports using cookies.
It uses bitwise…

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TrojanSourceFinder | Help Find Trojan Source Vulnerability In Code

https://cdn-images-1.medium.com/max/1280/1*JP6vr1oSUPoiNzpa1Pj-Bw.png
TrojanSourceFinder helps developers detect “Trojan Source” vulnerability in source code.

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Polygon Fixes the Critical Vulnerability in the Network, Saving Matic Worth of Billions.

https://cdn-images-1.medium.com/max/1024/1*04yEjp-qPjFM-9M9ZTGTZQ.jpeg
Polygon Network, on December 29th, fixed the bug in the system that saved $9 Billion worth of MATIC. Whitehat hacker, Leon Spacewalker…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

How to freely borrow all the TVL from the Jet Protocol

Recently I discovered a critical vulnerability that could possibly lead to the loss of funds in the smart contract of Jet Protocol, a…Continue reading on Medium »
Read more...

Spotlight: Earn Bitcoin While Browsing The Web On Desktop And Mobile
https://medium.com/@daniel.j.hunt/spotlight-earn-bitcoin-while-browsing-the-web-on-desktop-and-mobile-6512636addd3?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Is it too good to be true? Well, join me on my quest to find out.Continue reading on Medium » (https://medium.com/@daniel.j.hunt/spotlight-earn-bitcoin-while-browsing-the-web-on-desktop-and-mobile-6512636addd3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

SQL Injection - The File Upload Playground
https://shahjerry33.medium.com/sql-injection-the-file-upload-playground-6580b089d013?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Summary :Continue reading on Medium » (https://shahjerry33.medium.com/sql-injection-the-file-upload-playground-6580b089d013?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do hackers handle the pressure of the day to day?

Lets be real. Name one successful hacker that ISNT paranoid as balls. Shit eats at you no matter how great you think you are.

How are we managing mental health while we work is my question? Any anonymous homies want to share tips on how to manage the stress? What do you do to unwind? How do you find a mentor if you need help?

Appreciate anyone that takes the time to sincerely answer this

submitted by /u/totie01010
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to combine Data Science with hacking / IT-security?

Since I was a kid, ~20 years ago, I was interested in IT security. Even though there was not much information out there, I still did simple stuff like scripting, playing with trojans/viruses, wireless wiretap, hacking computer games etc. . But I had no support / help / person to ask, so it got more and more difficult for my 11 year old brain, and I stopped.

Now many years later I study Data Science, which is a lot of statistics (also with many ML topics like (un)supervised learning, reinforcement learning etc.) with a bit of CompSci topics like Data structures, Algorithm, programming, data bases, SW engineering...

My question: Is there any way to combine this Data Science knowledge with hacking/ IT-security? So that I can specialize in a topic Im really interested in? So far, I really miss the technical stuff in Data Science, which inspires me since I was a kid. Finding out gaps, errors and weak points in a system is something that really intrinsically motivates me.

Thanks in advance!

submitted by /u/dongpal
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Misconfiguration OAuth Lead Account Takeover
https://human-error.medium.com/misconfiguration-oauth-lead-account-takeover-f695c6f44d6e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Assalamuallaikum Wr.Wb Hello friends I want to explain about the bug bounty that I got in 2020, this vulnerability lies in the weak OAuthContinue reading on Medium » (https://human-error.medium.com/misconfiguration-oauth-lead-account-takeover-f695c6f44d6e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How to freely borrow all the TVL from the Jet Protocol
https://medium.com/@0xjayne/how-to-freely-borrow-all-the-tvl-from-the-jet-protocol-25d40e35920e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video