res 16 GB RAM 500 nodes 8 cores 32 GB RAM 1000 nodes 16 cores 32 GB RAM 1400-1500 nodes
In order to support higher numbers of nodes (i.e. hosts as number of containers can be unlimited theoretically based on their life times) ThreatMapper needs to be deployed as a 3 node k8s cluster to scale up to 10000 nodes, instructions to follow. Installation of Deepfence Management ConsoleInstalling the Management Console is as easy as:

1. Download the file docker-compose.yml to the desired system.
2. Execute the following command docker-compose -f docker-compose.yml up -d3. Open management console ip address / domain in the browser (https://x.x.x.x) and register a new account. Steps: Register a User
4. Get Deepfence api key from UI: Goto Settings-> User Management, copy api key. In the following docker run command, replace C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0with api Key. Steps: Deepfence API Key docker run -dit --cpus=".2" --name=deepfence-agent --restart on-failure --pid=host --net=host --privileged=true -v /sys/kernel/debug:/sys/kernel/debug:rw -v /var/log/fenced -v /var/run/docker.sock:/var/run/docker.sock -v /:/fenced/mnt/host/:ro -e USER_DEFINED_TAGS="" -e DF_BACKEND_IP="127.0.0.1" -e DEEPFENCE_KEY="C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0" deepfenceio/deepfence_agent_ce:latestThis is the minimal installation required to quickly get started on scanning various container images. The necessary images may now be downloaded onto this Management Console and scanned for vulnerabilities. Terraform* Terraform module to provision Deepfence ThreatMapper on GCP Compute Engine Installation with custom TLS certificatesCustom TLS certificates are supported for the web application hosted on the console machine. On the console machine users have to place the certificate and private key on /etc/deepfence/certs folder. Deepfence looks for the file with .key and .crt extentions on the specified location on the host. Deepfence AgentIn order to check a host for vulnerabilities, or if docker images or containers that have to be checked for vulnerabilities are saved on different hosts, then the Deepfence agent needs to be installed on those hosts. Pre-Requisites for Deepfence AgentFeature Requirements CPU: No of cores 2 RAM 1 GB Disk space At-least 30 GB Connectivity The host on which the Deepfence Agent is to be installed, is able to communicate with the Management Console on port range 8000-8010. Linux kernel version >= 4.4 Docker binaries At-least version 18.03 Deepfence Management Console Installed on a host with IP Address x.x.x.xInstallation of Deepfence AgentInstallation procedure for the Deepfence agent depends on the environment that is being used. Instructions for installing Deepfence agent on some of the common platforms are given in detail below: Deepfence Agent on Standalone VM or HostInstalling the Deepfence Agent is now as easy as:

1. Get Deepfence api key from UI: Goto Settings-> User Management, copy api key
2. In the following docker run command, replace x.x.x.xwith the IP address of the Management Console and replace C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0with api Key docker run -dit --cpus=".2" --name=deepfence-agent --restart on-failure --pid=host --net=host --privileged=true -v /sys/kernel/debug:/sys/kernel/debug:rw -v /var/log/fenced -v /var/run/docker.sock:/var/run/docker.sock -v /:/fenced/mnt/host/:ro -e USER_DEFINED_TAGS="" -e DF_BACKEND_IP="x.x.x.x" -e DEEPFENCE_KEY="C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0" deepfenceio/deepfence_agent_ce:latest3. Optionally the agent node can be tagged using USER_DEFINED_TAGS=""in the above command. Tags should be comma separated. Example: "dev,front-end" Deepfence Agent on Amazon ECSFor detailed instructions to deploy agents on Amazon ECS, please [...]

refer to our Amazon ECS wiki page. Deepfence Agent Helm chart for Kubernetes* Start deepfence agent (replace x.x.x.xwith the IP address of the Management Console and C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0with api key) # helm v2
helm install --repo https://deepfence.github.io/ThreatMapper/files/helm-chart deepfence-agent \
--name=deepfence-agent \
--set managementConsoleIp=x.x.x.x \
--set deepfenceKey=C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0
# helm v3
helm install deepfence-agent --repo https://deepfence.github.io/ThreatMapper/files/helm-chart deepfence-agent \
--set managementConsoleIp=x.x.x.x \
--set deepfenceKey=C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0* Delete deepfence agent # helm v2
helm delete --purge deepfence-agent
# helm v3
helm delete deepfence-agentDeepfence Agent on Google GKEFor detailed instructions to deploy agents on Google GKE, please refer to our Google GKE wiki page. Deepfence Agent on Azure AKSFor detailed instructions to deploy agents on Azure Kubernetes Service, please refer to our Azure AKS wiki page. Deepfence Agent on self-managed / on-premise KubernetesFor detailed instructions to deploy agents on a Kubernetes cluster, please refer to our Self-managed/On-premise Kubernetes wiki page. Download ThreatMapper

hacking: security in practice
From web applications to games.

Are there any communities or forums specifically directed at game hacking that you recommend? My natural curiosity for hacking has lead me towards what seems to mainly be web related hacking and knowledge, but I'm more interested in deconstructing games. I should say that I'm a complete beginner and I'm curious what sort of base knowledge would be expected from somebody wishing to deconstruct modern games. Game development and coding seems to be such a vast sea, but I wish to have a clear goal and study something that might lay the ground floor for such a curiosity.

What would you consider invaluable to know before tinkering with games, and is there anything particularily transferable from web based hacking?

I should say that what sparked my curiosity for game hacking was hearing about buffer overflow, the practice of sending packets to the game client to break the games limits. I imagine that these things are tougher to do today, and I would like to know what steps are put in place to prevent such practices and how.

I know I'm a bit all over the place, but hopefully I made some sense. I'm entirely green on most of these things, I just need a nudge towards the right direction.

Let me add a hypothetical that might clarify what I mean. Say I download and set up a custom server in an open source mmorpg like Boundel, just as an example. If I wanted to deconstruct the game, by stripping it down and experimenting with the game. What sort of knowledge would most likely help me out in this task? Knowledge that would stand independent despite things like what engine the game runs on, etc.

Thanks in advance.

submitted by /u/seiferthanseifer
[link] [comments]

hacking: security in practice
Is it possible to do serious hacking on a low end machine?

How about learning serious hacking stuff using a low end machine? By 'serious' I mean enough to put you on the most wanted list.

submitted by /u/pleasehelpmesir1
[link] [comments]

hacking: security in practice
Use a Verifone terminal's printer

Hi, I have a Verifone VX690 terminal that should've been picked up when my contract ended but it didn't. So I have a useless brick and I figured the printer could be useful.

​

The terminal seems to run on a OS called "Verix", and tinkering around with some menus I found that it does have a "download" option, which I assume could be used to install firmware.

​

So, does anyone know if there is some kind of modded version of Verix that'll allow me to use the printer with a USB connection? I know it *might* be possible, because a local McDonald's uses the same terminal but with what seems to be a custom-made OS.

​

Also sorry if this doesn't fit the sub, feel free to delete the post.

submitted by /u/AxelMaumary
[link] [comments]

hacking: security in practice
Microsoft's Windows 10, Exchange, and Teams hacked at Pwn2Own

https://external-preview.redd.it/0Pt3cED2Fi26MF29n6cMBIKuIjN5oL6xu0wGIIN5KRo.jpg?width=640&crop=smart&auto=webp&s=c3a72d1dd3501d0d66ee1c41c61205a7c2ccdf0f submitted by /u/DrinkMoreCodeMore
[link] [comments]

Dark Reading: Attacks/Breaches
Cartoon Caption Winner: Something Seems Afoul

And the winner of Dark Readings's March cartoon caption contest is ...

Kali Linux Tutorials
BadOutlook : Malicious Outlook Reader

BadOutlook is a simple PoC which leverages the Outlook Application Interface (COM Interface) to execute shellcode on a system based on a specific trigger subject line. By utilizing the Microsoft.Office.Interop.Outlook namespace, developers can represent the entire Outlook Application (or at least according to Microsoft). This means that the new application should be able to do […]

The post BadOutlook : Malicious Outlook Reader appeared first on Kali Linux Tutorials.

Hacking on Medium
Dependency Confusion — A New Attack Technique

https://cdn-images-1.medium.com/max/1800/0*Be96cGn8Msa0-lHJ.jpg
Tech giants Microsoft, Apple, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber have recently fallen victim to a new supply chain exploit…

Continue reading on Medium »

Hacking on Medium
I’ve Been Pwned

https://cdn-images-1.medium.com/max/2360/1*yjTH_5UDOt3VXRO6vOOKUA.jpeg
The Facebook breach is a stark reminder of the sorry state of our data

Continue reading on Medium »

Hacking on Medium
Mapas sobre ataques de Ransomware.

https://cdn-images-1.medium.com/max/964/0*fDeZ0h7gqQSrSprC
PUBLICADO EN 7 ABRIL, 2021 POR EHACKING

Continue reading on Medium »

Hacking on Medium
DoS Windows 7 e 10 — CVE-2021–24086

https://cdn-images-1.medium.com/max/1434/1*lkwyuMbfhLF1b16tBcAubQ.jpeg
Nesse artigo será explorado a falha recente do Windows 10 que ataca os endereços locais de link IPv6 causando a tela azul da morte:

Continue reading on Medium »

Android Image to PenTest.
https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/

<!-- SC_OFF -->Hello all. Im new to the whole PenTest world. Im currently setting up my lab. Im following the Penetration Testing book by Georgia Weidman. I'm at the point of setting up Android targets, and I see that the images listed in the book are deprecated in Android SDK / AVD. Makes sense, those are old phones / images. What are some images that are worth emulating and targeting. I'm not too hip on the new phones and OS flavors. ​ Thanks <!-- SC_ON --> submitted by /u/BU5HMA5T3R (https://www.reddit.com/user/BU5HMA5T3R)
[link] (https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/) [comments] (https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/)