ze cyber threat intelligence feeds meaningfully. Those aforementioned personas are likely security engineering, SecOps / SOC analysts & engineers, or a DevSecOps engineer; however, this list is not exhaustive, and they do not need to be product / application-aligned as central teams can use this as well. Another usage is those same personas (SecOps, security engineering) that work for a centralized team and want to create a dynamic block list for firewalls and intrusion prevention systems, the CodeBuild projects can be repurposed to drop CSV or flat files to almost any location (e.g. Palo Alto firewalls, Squid forward proxy URL filters, etc.). 3. What are the gaps in this solution?SyntheticSun currently lacks full coverage across all main log sources - namely, S3 Access Logs and CloudFront Access Logs, which are integral to the way a lot of folks deliver services (especially for SPAs on S3 buckets). The anomaly detection does not extend past WAF, API Gateway Access Logs, or CloudTrail due to my obsession with IP Insights and complete lack of any data science training (seriously, I don't even know how to use pandasor numpy). There is not any in-depth analysis of raw threat intelligence IoCs other than attempting to match it in the logs. 4. Outside of the Masters for the AWS Security Services, what considerations are there for an Organizational deployment?The easiest way to deploy this solution for an organization is to deploy it in a centralized security services account. For the lower-level telemetry such as VPC Flow Logs and WAF Logs, you should consider providing helper scripts or CloudFormation templates via AWS Service Catalog to promote enablement in lower environments. You will need to evaluate your shard consumption and index rotation of Elasticsearch Service, as well as the permissions, if you will be having cross-account Kinesis Data Firehose delivery streams publishing into a centralized location. I built this solution in my personal sandbox account, hence why I did not bake any of the considerations from above into the solution, I will be happy to work on a PR with this in mind and may do it myself in the future.

As of 31 JULY 2020 AWS Firewall Manager Policies support the multi-account aggregation of WAF Logging which brings you one step closer to making this a lot less painful... 5. What is the IP Insights algorithm? Is your usage really what it was intended for?CAVEATS: I am not a data scientist and this is going to be a long answer. Tl;dr: It's an anomaly finder and I think?

Given that I am not remotely close to a data scientist or have any training you are better served reading the docs on this. That said, here is my layman's attempt at it: IP Insights is an unsupervised machine learning algorithm that learns the relationship between an IPv4 address and an entity (e.g. Account number, user name, user-agent). IP Insights then attempts to determine how likely it is that the entity would use that IPv4 address. Behind the curtains of IP Insights is a neural network that learns the latent vector representation of these entities and IPv4 addresses. The distance between these vectorized representations is emblematic for how anomalous (or not) it is for an entity to be associated with (e.g send a request from) an IPv4 address.

Neural networks are almost exactly like they sound; they form a machine learning system designed to behave similarly to the human brain, complete with computerized neurons and synapses. In unsupervised machine learning, the algorithm can suss out what "good" (i.e. True Negative) looks like versus "bad" (i.e. True Positive) by looking at the association between all IPv4 addresses and their paired entities. This association is evaluated in order to identify what vectors are similar to the others by their "distance". In IP Insights' case, a prebuilt encoder is provided that searches for IPv4 addresses and then hashes out all entities [...]

___________________________
@hacking_Attack
@Hacking_Video

into clusters. It then iterates over them using vectorization. Vectorization is a way to perform computations as a matrix instead of looping over them (think of a "For" loop for a list containing tens of millions of values).

When you are training an IP Insights model, it will actually create itself false positives by pairing IPv4 addresses with entities that have a far distance (i.e. highly anomalous) and are less likely to actually occur in reality; the model can now discriminate between True Positives, False Positives and True Negatives. This is done to prevent another crazy ass term called "cross entropy" (AKA "log loss" as if that makes it better), and introduces another term, binary classification. IP Insights is essentially asking, "What is the chance that this IP address paired with this entity is anomalous?" This is what makes it binary, I think, so "yes it's bad" or "not it is not". The probability is represented as a value between 0 and 1, the goal of all machine learning models is to make this as close to 0 as possible, so predicting a value of 0.01 for something that is really 1 (known True Positive) would result in very high log loss. So, with all that said, by making purposely garbage data IP Insights helps to reduce that log loss (i.e. bad predictions) during training.

That brings us to the output from the endpoint. When you query it (either via batches or in near real-time using the InvokeEndpointAPI) the response is an unbounded float that can be negative or positive. The higher above 0 it is, the more likely it is anomalous, which is where your work begins. For this solution I chose anything above 0.03, which is largely notional, to get closer to the truth you should provide True Positives to the endpoint and see what your response is. Based on those findings, you could configure a tiered approach where you application may issue a second factor challenge, raise an alert or block it outright depending on the score. The answer to the second part of the question is "Yes, I think so", training the model with user-agents paired with an IP is actually pretty sketchy. Now for other less volatile entities (account number, user name, IAM user) it feels like the intended usage. 6. What threat intelligence feeds should I use? What happens if there are duplicates?In the solution I provide some example feeds that you should use, some are pretty obvious like the cybercrime domain feed, Emerging Threats and CI-badguys. In my real job I work with one of the most talented cyber threat intelligence specialists in the entire world (no joke she is awesome!), who also influenced the choices. Like machine learning models and anything else you will build, you should tailor your threat intel feeds and aggregation to match your current threat environment. Duplicates are identified in MISP and only a hash key is specified in the DynamoDB tables to enforce uniqueness, so even if there are 5 feeds reporting on the same IPv4 address, only one will make it to the table.

You can also bring your own commercial threat intel platforms and feeds such as InfoBlox or Recorded Future into this solution by pointing them at the DynamoDB tables with similar syntax. 7. I did a look up against the raw log sources in S3 and I am not seeing the entries in Elasticsearch; why is this?Most log delivery from AWS is "best effort," so there is not an official SLA published; however, I would assume it is around 99.5 - 99.9%, where anything in that last 0.5 - 0.1% will not be delivered. "Production" traffic is also first class in AWS; if there are network bandwidth constraints it will default to delivering connectivity back to clients versus sending out logs. The more likely event is that the raw log file was too large for Lambda to process the entire thing in time; you see this a lot when you are being hosed by a DOS or crawler from the same client IP. WAF and ALB bundle log files by the caller (from what I can tel[...]

___________________________
@hacking_Attack
@Hacking_Video

l), so if you absorb hundreds of requests, the log file can be very large. 8. I have an existing Elasticsearch Service domain in a VPC; will this solution work?Yes, however you will need to perform one of the following:

* Place the Lambda functions into a VPC and attach VPC Endpoints for S3, DynamoDB, and CloudWatch Logs.
* Alternatively, modify the solution to publish the final formatted logs into Kinesis Data Firehose and point them to you ES Domain in a VPC.

There are additional costs for this. Lambda in a VPC, especially for dozens of concurrent invocations, will likely lead to more problems from ENIs sticking around and eating your RFC1918 space. Unless you absolutely have to isolate all traffic within your VPC to meet compliance requirements, I would not go down that road. 9. Can I publish these log sources to Splunk instead?Yes, this is achievable by modifying the solution to publish the final formatted logs into Kinesis Data Firehose and point them to Splunk. 10. Will you support any other logging sources?I hope to have support for Route 53 DNS Logs, S3 Access Logs, CloudFront Access Logs and API Gateway Access Logs and maybe some other host-based logs in the future.
A 11. Why did you use the CloudWatch Agent instead of the Kinesis Data Agent?I honestly would have preferred to use to Kinesis Data Agent, but I found a lot of issues with it: It is not included by default in Amazon Linux 2 and now that Ubuntu 18.04 LTS AMIs come with Java 11 pre-installed, I was running into backwards compatability issues with the Agent as it fails the build unless you have OpenJDK 8 or 9. It was much easier to install the CloudWatch Agent as it is frequently updated with new features and there is Systems Manager Document support for configuration; it even has a wizard for installation. If AWS ever takes the Kinesis Data Agent support as serious as CloudWatch Agent I may switch to it as I'd much rather publish to Kinesis Data Firehose directly for certain host-based logs (Suricata, Squid, Nginx, Apache) versus using CloudWatch Logs as an intermediary. ContributingI am happy to accept PRs for items tagged as "Help Wanted" in Issues or the Project Board. I will review any other proposed PRs as well if it meets the spirit of the project. Early ContributorsSpecial thanks to David Dorsey and Ryan Nolette who provided valuable feedback, testing and contributions to help fine-tune SyntheticSun. LicenseThis library is licensed under the GNU General Public License v3.0 (GPL-3.0) License. See the LICENSE file. Download SyntheticSun

___________________________
@hacking_Attack
@Hacking_Video

Create own Burp Collaborator?
https://www.reddit.com/r/Pentesting/comments/rvuzer/create_own_burp_collaborator/

Hey there im currently doing the burpsuite academy. Im stuck at this module: https://portswigger.net/web-security/ssrf/blind/lab-shellshock-exploitation I don't want to pay for the burp suite professional version because im in the state of learning and 300+ bucks are a hell of a money for me... So i started to to dig a little bit into what Burp Collaborator really is and whats the use of it. And afaik its like a own server with some services running (HTTP/DNS/SMTP...) that shows the incoming requests. So i was thinking is it possible to run a pyhton http.server and start using it as the http selfmade collaborator? I worked with python http.server sometimes before for HTB or THM and i know that it puts the incoming requests to stdout. So someone already tried this? If there is another easier way or another programm already exiting, it would be nice to let me know. Hope i was clear with my question :) submitted by /u/Flexerinoh (https://www.reddit.com/user/Flexerinoh)
[link] (https://www.reddit.com/r/Pentesting/comments/rvuzer/create_own_burp_collaborator/) [comments] (https://www.reddit.com/r/Pentesting/comments/rvuzer/create_own_burp_collaborator/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Palo Alto Networks Appoints Helmut Reisinger to Leadership Team

Reisinger joins as CEO, EMEA and Latin America, to accelerate global growth strategy.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Log4j Remediation Rules Now Available for WhiteSource Renovate and Enterprise

The Software Composition Analysis leader now offers a remediation preset for WhiteSource Renovate and Enterprise, enabling users to identify and fix the Log4j vulnerability from hundreds of downstream dependent packages of Log4j.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Why CIOs Should Report to CISOs

If the CISO is responsible for the security of the organization, then that same person also should be responsible for both security and IT infrastructure.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Kube-Applier : Enables Automated Deployment And Declarative Configuration For Your Kubernetes Cluster

Kube-Applier is a service that enables continuous deployment of Kubernetes objects by applying declarative configuration files from a Git repository to a Kubernetes cluster.

kube-applier runs as a Pod in your cluster and watches the Git repo to ensure that the cluster objects are up-to-date with their associated spec files (JSON or YAML) in the repo.

At a specified interval, kube-applier performs a “full run”, issuing kubectl apply commands for all JSON and YAML files within the repo.

When a new commit to the repo occurs, kube-applier performs a “quick run”, issuing apply commands only for files that have changed since the last run.

Quick runs and full runs are handled separately and concurrently.

kube-applier serves a status page and provides metrics for monitoring. Requirements

* Go (1.7+)
* Docker (17.05+)
* Kubernetes cluster
* kube-applier generally supports any Kubernetes server release, assuming that you are installing a compatible kubectl client in your Dockerfile.
* The kubectl version specified in the Dockerfile must be either the same minor release as the cluster API server, or one release behind the server (e.g. client 1.3 and server 1.4 is fine, but client 1.4 and server 1.3 is not).
* There are several known problems with kubectl applythat may affect your use of kube-applier. Some examples:
* Releases prior to 1.6.0 are subject many known issues with using kubectl applyto apply ThirdPartyResource objects.
* 1.5 and 1.6 releases before 1.5.8 and 1.6.3 are not supported due to an issue with namespaces, fixed here. Setup

Download the source code and build the container image.

$ go get github.com/box/kube-applier
$ cd $GOPATH/src/github.com/box/kube-applier
$ make container

You will need to push the image to a registry in order to reference it in a Kubernetes container spec. Usage Container Spec

We suggest running kube-applier as a Deployment (see demo/ for example YAML files). We only support running one replica at a time at this point, so there may be a gap in application if the node serving the replica goes hard down until it is rescheduled onto another node.

IMPORTANT: The Pod containing the kube-applier container must be spawned in a namespace that has write permissions on all namespaces in the API Server (e.g. kube-system). Environment Variables

Required

* REPO_PATH– (string) Absolute path to the directory containing configuration files to be applied. It must be a Git repository or a path within one. All .json and .yaml files within this directory (and its subdirectories) will be applied, unless listed on the blacklist or excluded from the whitelist.
* LISTEN_PORT– (int) Port for the container. This should be the same port specified in the container spec.

Optional

* SERVER– (string) Address of the Kubernetes API server. By default, discovery of the API server is handled by kube-proxy. If kube-proxy is not set up, the API server address must be specified with this environment variable (which is then written into a kubeconfig file on the backend). Authentication to the API server is handled by service account tokens. See Accessing the Cluster for more info.
* BLACKLIST_PATH– (string) Path to a “blacklist” file which specifies files that should not be applied. This path should be absolute (e.g. /k8s/conf/kube_applier_blacklist), not relative to REPO_PATH(although you may want to check the blacklist file into the repo). The blacklist file itself should be a plaintext file, with a file path on each line. Each of these paths should be relative to REPO_PATH(for example, if REPO_PATHis set to /git/repo, and the file to be bl[...]

___________________________
@hacking_Attack
@Hacking_Video

acklisted is /git/repo/apps/app1.json, the line in the blacklist file should be apps/app1.json).
* WHITELIST_PATH– (string) Path to a “whitelist” file which is used to make the applier consider a specific subset of files from the repo. Only the files listed in the whitelist file will be considered for apply. Empty whitelist (or unset env var) means all files in repo are eligible to be applied. In case of a file is listed in both the whitelist and the blacklist, the file is not applied. The environment variable and file itself should formatted the same as for the blacklist above.

NOTE The blacklist and whitelist files support line comments. A single line gets ignored if the first non-blank character is # in that line.

* POLL_INTERVAL_SECONDS– (int) Number of seconds to wait between each check for new commits to the repo (default is 5). Set to 0 to disable the wait period.
* FULL_RUN_INTERVAL_SECONDS– (int) Number of seconds between automatic full runs (default is 300, or 5 minutes). Set to 0 to disable the wait period.
* DIFF_URL_FORMAT– (string) If specified, allows the status page to display a link to the source code referencing the diff for a specific commit. DIFF_URL_FORMATshould be a URL for a hosted remote repo that supports linking to a commit hash. Replace the commit hash portion with “%s” so it can be filled in by kube-applier (e.g. https://github.com/kubernetes/kubernetes/commit/%s).
* LOG_LEVEL– (int) Sets the -vflag on all kubectlcommands run. Use this option to configure more verbose logging. If not specified, the -vflag is not set on kubectlcommands defaulting to standard log verbosity. Mounting the Git Repository

There are two ways to mount the Git repository into the kube-applier container.

* Git-sync sidecar container

Git-sync keeps a local directory up to date with a remote repo. The local directory resides in a shared emptyDir volume that is mounted in both the git-sync and kube-applier containers.

Reference the git-sync repo for setup and usage.

* Host-mounted volume

Mount a Git repository from a host directory. This can be useful when you want kube-applier to apply changes to an object without checking the modified spec file into a remote repo.

“volumes”: [
{
“hostPath”: {
“path”:
},
“name”: “repo-volume”
}
…
]

What happens if the contents of the local Git repo change in the middle of a kube-applier run?

If there are changes to files in the $REPO_PATHdirectory during a kube-applier run, those changes may or may not be reflected in that run, depending on the timing of the changes.

Given that the $REPO_PATHdirectory is a Git repo or located within one, it is likely that the majority of changes will be associated with a Git commit. Thus, a change in the middle of a run will likely update the HEAD commit hash, which will immediately trigger another run upon completion of the current run (regardless of whether or not any of the changes were effective in the current run). However, changes that are not associated with a new Git commit will not trigger a run.

If I remove a configuration file, will kube-applier remove the associated Kubernetes object?

No. If a file is removed from the $REPO_PATHdirectory, kube-applier will no longer apply the file, but kube-applier WILL NOT delete the cluster object(s) described by the file. These objects must be manually cleaned up using kubectl delete. “Force Run” Feature

In rare cases, you may wish to trigger a kube-applier run without checking in a commit or waiting for the next scheduled run (e.g. some of your files failed to apply because of some background condition in the cluster, and you have fixed it since the last run). This can be accomplished with the “Force Run” button on the status pag[...]

___________________________
@hacking_Attack
@Hacking_Video

e, which starts a run immediately if no run is currently in progress, or queues a run to start upon completion of the current run. Only one run may sit in the queue at any given time. Monitoring Status UI
https://blogger.googleusercontent.com/img/a/AVvXsEiT0HSmw30M5dOnEdIVzCFPHFitj2jtI8hWuyStRpxDfQjgFUk3KMxNoPU89cSJ4XpE9lWV2cMcChakzcMxE6b-0A73L4EMQ1EXqXrU1HK7D4YENKZ9QN6nx5aFy66RcoM14y0aITGGGJkDp74QgUVLfsCirx2YgFxrlm2JjGBtr_UaXxhrhTKBCk9I=s2152
kube-applier hosts a status page on a webserver, served at the service endpoint URL. The status page displays information about the most recent apply run, including:

* Run Type
* Start and end times
* Latency
* Most recent commit
* Whitelisted files
* Blacklisted files
* Errors
* Files applied successfully

The HTML template for the status page lives in templates/status.html, and static/holds additional assets. Metrics

kube-applier uses Prometheus for metrics. Metrics are hosted on the webserver at /metrics (status UI is the index page). In addition to the Prometheus default metrics, the following custom metrics are included:

* run_latency_seconds – A Summary that keeps track of the durations of each apply run, tagged with the run type and a boolean for whether or not the run was a success (i.e. no failed apply attempts).
* file_apply_count – A Counter for each file that has had an apply attempt over the lifetime of the container, incremented with each apply attempt and tagged by the filepath and the result of the attempt.

The Prometheus HTTP API (also see the Go library) can be used for querying the metrics server. Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Web3 e o ataque ao Conecte SUS

https://cdn-images-1.medium.com/max/768/0*EcxPfXdtNzf48VWA.jpeg
Eu sei que geral não curte esse papo de Criptomoeadas, Entendo que é uma tecnologia hiper-capitalista, falam em “descentralização” mas na…

Continue reading on Medium »

Hacking on Medium
Qu’est-ce que Profit Hacking ?

Qu’est-ce que le Profit Hacking ? Le « Profit Hacking » est un terme qui désigne le processus consistant à trouver et à exploiter les…

Continue reading on Medium »

Hacking on Medium
What is cryptography?

https://cdn-images-1.medium.com/max/600/0*bXtsOi2N7fhou65H.jpg
Cryptography is a method of protecting information and communications through the use of codes so that only those for whom the information…

Continue reading on Medium »