PORTSWIGGER WEB SECURITY - BROKEN ACCESS CONTROL LAB ÇÖZÜMLERİ

Access Control (Erişim Kontrolü) veya Authorization (Yetkilendirme), talep edilen eylemlere veya erişim kaynaklarına, kimin veya neyin…Continue reading on Medium »
Read more...

PORTSWIGGER WEB SECURITY - BROKEN ACCESS CONTROL LAB ÇÖZÜMLERİ
https://ariarif.medium.com/portswigger-web-security-broken-access-control-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-68c91a753edd?source=rss------bug_bounty-5

Access Control (Erişim Kontrolü) veya Authorization (Yetkilendirme), talep edilen eylemlere veya erişim kaynaklarına, kimin veya neyin…Continue reading on Medium » (https://ariarif.medium.com/portswigger-web-security-broken-access-control-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-68c91a753edd?source=rss------bug_bounty-5)

KitPloit - PenTest Tools!
Cloudsploit - Cloud Security Posture Management (CSPM)

http://2.bp.blogspot.com/-iAqI0m9MFWM/Yd0cecbZ9pI/AAAAAAAA8e4/bvcB05hA1uEpxomTV2kut2LfRzh_kpmcQCK4BGAYYCw/w640-h392/cloudsploit_3_console-796451.png Quick StartGeneric$ git clone https://github.com/aquasecurity/cloudsploit.git
$ cd cloudsploit
$ npm install
$ ./index.js -h Docker$ git clone https://github.com/aquasecurity/cloudsploit.git
$ cd cloudsploit
$ docker build . -t cloudsploit:0.0.1
$ docker run cloudsploit:0.0.1 -h
$ docker run -e AWS_ACCESS_KEY_ID=XX -e AWS_SECRET_ACCESS_KEY=YY cloudsploit:0.0.1 --compliance=pci Documentation* Background
* Deployment Options
* Self-Hosted
* Hosted at Aqua Wave

* Installation
* Configuration
* Amazon Web Services
* Microsoft Azure
* Google Cloud Platform
* Oracle Cloud Infrastructure
* CloudSploit Config File
* Credential Files
* AWS
* Azure
* GCP
* Oracle OCI

* Environment Variables

* Running
* CLI Options
* Compliance
* HIPAA
* PCI
* CIS Benchmarks

* Output Formats
* Console Output
* Ignoring Passing Results
* CSV
* JSON
* JUnit XML
* Collection Output

* Suppressions
* Running a Single Plugin
* Architecture
* Writing a Plugin
* Other Notes BackgroundCloudSploit by Aqua is an open-source project designed to allow detection of security risks in cloud infrastructure accounts, including: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), and GitHub. These scripts are designed to return a series of potential misconfigurations and security risks. Deployment OptionsCloudSploit is available in two deployment options: Self-HostedFollow the instructions below to deploy the open-source version of CloudSploit on your machine in just a few simple steps. Hosted at Aqua WaveA commercial version of CloudSploit hosted at Aqua Wave. Try Aqua Wave today! InstallationEnsure that NodeJS is installed. If not, install it from here. $ git clone git@github.com:cloudsploit/scans.git
$ npm install ConfigurationCloudSploit requires read-only permission to your cloud account. Follow the guides below to provision this access:

* Amazon Web Services
* Microsoft Azure
* Google Cloud Platform
* Oracle Cloud Infrastructure

For AWS, you can run CloudSploit directly and it will detect credentials using the default AWS credential chain. CloudSploit Config FileThe CloudSploit config file allows you to pass cloud provider credentials by:

1. A JSON file on your file system
2. Environment variables
3. Hard-coding (not recommended)

Start by copying the example config file: $ cp config_example.js config.js Edit the config file by uncommenting the relevant sections for the cloud provider you are testing. Each cloud has both a credential_fileoption, as well as inline options. For example: azure: {
// OPTION 1: If using a credential JSON file, enter the path below
// credential_file: '/path/to/file.json',
// OPTION 2: If using hard-coded credentials, enter them below
// application_id: process.env.AZURE_APPLICATION_ID || '',
// key_value: process.env.AZURE_KEY_VALUE || '',
// directory_id: process.env.AZURE_DIRECTORY_ID || '',
// subscription_id: process.env.AZURE_SUBSCRIPTION_ID || ''
} Credential FilesIf you use the credential_fileoption, point to a file in your file system that follows the correct format for the cloud you are using. AWS{
"accessKeyId": "YOURACCESSKEY",
"secretAccessKey": "YOURSECRETKEY"
} Azure{
"ApplicationID": "YOURAZUREAPPLICATIONID",
"KeyValue": "YOURAZUREKEYVALUE",
"DirectoryID": "YOURAZUREDIRECTORYID",
"SubscriptionID": "YOURAZURESUBSCRIPTIONID"
} GCPNote:[...]

For GCP, you generate a JSON file directly from the GCP console, which you should not edit. {
"type": "service_account",
"project": "GCPPROJECTNAME",
"client_email": "GCPCLIENTEMAIL",
"private_key": "GCPPRIVATEKEY"
} Oracle OCI{
"tenancyId": "YOURORACLETENANCYID",
"compartmentId": "YOURORACLECOMPARTMENTID",
"userId": "YOURORACLEUSERID",
"keyFingerprint": "YOURORACLEKEYFINGERPRINT",
"keyValue": "YOURORACLEKEYVALUE",
} Environment VariablesCloudSploit supports passing environment variables, but you must first uncomment the section of your config.jsfile relevant to the cloud provider being scanned.

You can then pass the variables listed in each section. For example, for AWS: {
access_key: process.env.AWS_ACCESS_KEY_ID || '',
secret_access_key: process.env.AWS_SECRET_ACCESS_KEY || '',
session_token: process.env.AWS_SESSION_TOKEN || '',
} RunningTo run a standard scan, showing all outputs and results, simply run: $ ./index.js CLI OptionsCloudSploit supports many options to customize the run time. Some popular options include:

* AWS GovCloud support: --govcloud* AWS China support: --china* Save the raw cloud provider response data: --collection=file.json* Ignore passing (OK) results: --ignore-ok* Exit with a non-zero code if non-passing results are found: --exit-code* This is a good option for CI/CD systems

* Change the output from a table to raw text: --console=textSee Output Formats below for more output options.
Click for a full list of options $ ./index.js -h

_____ _ _ _____ _ _ _
/ ____| | | |/ ____| | | (_) |
| | | | ___ _ _ __| | (___ _ __ | | ___ _| |_
| | | |/ _ \| | | |/ _` |\___ \| '_ \| |/ _ \| | __|
| |____| | (_) | |_| | (_| |____) | |_) | | (_) | | |_
\_____|_|\___/ \__,_|\__,_|_____/| .__/|_|\___/|_|\__|
| |
|_|

CloudSploit by Aqua Security, Ltd.
Cloud security auditing for AWS, Azure, GCP, Oracle, and GitHub

usage: index.js [-h] --config CONFIG [--compliance {hipaa,cis,cis1,cis2,pci}] [--plugin PLUGIN] [--govcloud] [--china] [--csv CSV] [--json JSON] [--junit JUNIT]
[--table] [--console {none,text,table}] [--collection COLLECTION] [--ignore-ok] [--exit-code] [--skip-paginate] [-- suppress SUPPRESS]

optional arguments:
-h, --help show this help message and exit
--config CONFIG
The path to a cloud provider credentials file.
--compliance {hipaa,cis,cis1,cis2,pci}
Compliance mode. Only return results applicable to the selected program.
--plugin PLUGIN A specific plugin to run. If none provided, all plugins will be run. Obtain from the exports.js file. E.g. acmValidation
--govcloud AWS only. Enables GovCloud mode.
--china AWS only. Enables AWS China mode.
--csv CSV Output: CSV file
--json JSON Output: JSON file
--junit JUNIT Output: Junit file
--table Output: table
--console {none,text,table}
Console output format. Default: table
--collection COLLECTION
Output: full collection JSON as file
--ignore-ok Ignore passing (OK) results
--exit-code Exits with a non-zero status code if non-passing results are found
--skip-paginate AWS only. Skips pagination (for debugging).
--suppress SUPPRESS Suppress results matching the provided Regex. Format: pluginId:region:resourceId ComplianceCloudSploit supports mapping of its plugins to particular compliance policies. To run the compliance scan, use the --complianceflag. For example: $ ./index.js --compliance=hipaa
$ ./index.js --compliance=pci Multiple compliance modes can be run at the same time: $ ./index.js --compliance=cis1 --compliance=cis2 CloudSploit currently supports the following compliance mapping[...]

s: HIPAA$ ./index.js --compliance=hipaa HIPAA scans map CloudSploit plugins to the Health Insurance Portability and Accountability Act of 1996. PCI$ ./index.js --compliance=pci PCI scans map CloudSploit plugins to the Payment Card Industry Data Security Standard. CIS Benchmarks$ ./index.js --compliance=cis
$ ./index.js --compliance=cis1
$ ./index.js --compliance=cis2 CIS Benchmarks are supported, both for Level 1 and Level 2 controls. Passing --compliance=ciswill run both level 1 and level 2 controls. Output FormatsCloudSploit supports output in several formats for consumption by other tools. If you do not specify otherwise, CloudSploit writes output to standard output (the console) as a table.

Note: You can pass multiple output formats and combine options for further customization. For example: # Print a table to the console and save a CSV file
$ ./index.js --csv=file.csv --console=table

# Print text to the console and save a JSON and JUnit file while ignoring passing results
$ ./index.js --json=file.json --junit=file.xml --console=text --ignore-ok Console OutputBy default, CloudSploit results are printed to the console in a table format (with colors). You can override this and use plain text instead, by running: $ ./index.js --console=text Alternatively, you can suppress the console output entirely by running: $ ./index.js --console=none Ignoring Passing ResultsYou can ignore results from output that return an OK status by passing a --ignore-okcommandline argument. CSV$ ./index.js --csv=file.csv JSON$ ./index.js --json=file.json JUnit XML$ ./index.js --junit=file.xml Collection OutputCloudSploit saves the data queried from the cloud provider APIs in JSON format, which can be saved alongside other files for debugging or historical purposes. $ ./index.js --collection=file.json SuppressionsResults can be suppressed by passing the --suppressflag (multiple options are supported) with the following format: --suppress pluginId:region:resourceId For example: # Suppress all results for the acmValidation plugin
$ ./index.js --suppress acmValidation:*:*

# Suppress all us-east-1 region results
$ ./index.js --suppress *:us-east-1:*

# Suppress all results matching the regex "certificate/*" in all regions for all plugins
$ ./index.js --suppress *:*:certificate/* Running a Single PluginThe --pluginflag can be used if you only wish to run one plugin. $ ./index.js --plugin acmValidation ArchitectureCloudSploit works in two phases. First, it queries the cloud infrastructure APIs for various metadata about your account, namely the "collection" phase. Once all the necessary data is collected, the result is passed to the "scanning" phase. The scan uses the collected data to search for potential misconfigurations, risks, and other security issues, which are the resulting output. Writing a PluginPlease see our contribution guidelines and complete guide to writing CloudSploit plugins. Writing a remediationThe --remediateflag can be used if you want to run remediation for the plugins mentioned as part of this argument. This takes a list of plugin names. Please see our developing remediation guide for more details. Other NotesFor other details about the Aqua Wave SaaS product, AWS security policies, and more, click here. Download Cloudsploit

Cloudsploit - Cloud Security Posture Management (CSPM)
http://www.kitploit.com/2022/02/cloudsploit-cloud-security-posture.html

$ cd cloudsploit
$ docker build . -t cloudsploit:0.0.1
$ docker run cloudsploit:0.0.1 -h
$ docker run -e AWS_ACCESS_KEY_ID=XX -e AWS_SECRET_ACCESS_KEY=YY cloudsploit:0.0.1 --compliance=pci
Documentation Background (https://github.com/aquasecurity/cloudsploit#background) Deployment Options (https://github.com/aquasecurity/cloudsploit#deployment-options) Self-Hosted (https://github.com/aquasecurity/cloudsploit#self-hosted) Hosted at Aqua Wave (https://github.com/aquasecurity/cloudsploit#hosted-at-aqua-wave) Installation (https://github.com/aquasecurity/cloudsploit#installation) Configuration (https://github.com/aquasecurity/cloudsploit#configuration) Amazon Web Services (https://github.com/aquasecurity/cloudsploit/blob/master/docs/aws.md#cloud-provider-configuration) Microsoft Azure (https://github.com/aquasecurity/cloudsploit/blob/master/docs/azure.md#cloud-provider-configuration) Google Cloud Platform (https://github.com/aquasecurity/cloudsploit/blob/master/docs/gcp.md#cloud-provider-configuration) Oracle Cloud Infrastructure (https://github.com/aquasecurity/cloudsploit/blob/master/docs/oracle.md#cloud-provider-configuration) CloudSploit Config File (https://github.com/aquasecurity/cloudsploit#cloudsploit-config-file) Credential Files (https://github.com/aquasecurity/cloudsploit#credential-files) AWS (https://github.com/aquasecurity/cloudsploit#aws) Azure (https://github.com/aquasecurity/cloudsploit#azur) GCP (https://github.com/aquasecurity/cloudsploit#gcp) Oracle OCI (https://github.com/aquasecurity/cloudsploit#oracle-oci) Environment Variables (https://github.com/aquasecurity/cloudsploit#environment-variables) Running (https://github.com/aquasecurity/cloudsploit#running) CLI Options (https://github.com/aquasecurity/cloudsploit#cli-options) Compliance (https://github.com/aquasecurity/cloudsploit#compliance) HIPAA (https://github.com/aquasecurity/cloudsploit#hipaa) PCI (https://github.com/aquasecurity/cloudsploit#pci) CIS Benchmarks (https://github.com/aquasecurity/cloudsploit#cis-benchmarks) Output Formats (https://github.com/aquasecurity/cloudsploit#output-formats) Console Output (https://github.com/aquasecurity/cloudsploit#console-output) Ignoring Passing Results (https://github.com/aquasecurity/cloudsploit#ignoring-passing-results) CSV (https://github.com/aquasecurity/cloudsploit#csv) JSON (https://github.com/aquasecurity/cloudsploit#json) JUnit XML (https://github.com/aquasecurity/cloudsploit#junit-xml) Collection Output (https://github.com/aquasecurity/cloudsploit#collection-output) Suppressions (https://github.com/aquasecurity/cloudsploit#suppressions) Running a Single Plugin (https://github.com/aquasecurity/cloudsploit#running-a-single-plugin) Architecture (https://github.com/aquasecurity/cloudsploit#architecture) Writing a Plugin (https://github.com/aquasecurity/cloudsploit#writing-a-plugin) Other Notes (https://github.com/aquasecurity/cloudsploit#other-notes)
Background CloudSploit by Aqua is an open-source project designed to allow detection of security risks in cloud infrastructure accounts, including: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (https://www.kitploit.com/search/label/Infrastructure) (OCI), and GitHub. These scripts are designed to return a series of potential misconfigurations (https://www.kitploit.com/search/label/Misconfigurations) and security risks. Deployment Options CloudSploit is available in two deployment options: Self-Hosted Follow the instructions below to deploy the open-source version of CloudSploit on your machine in just a few simple steps. Hosted at Aqua Wave A commercial version of CloudSploit hosted at Aqua Wave. Try Aqua Wave (https://cloud.aquasec.com/signup) today! Installation Ensure that NodeJS is installed. If not, install it from here (https://nodejs.org/download/). $ git clone git@github.com:cloudsploit/scans.git
$ npm install

Configuration CloudSploit requires read-only permission to your cloud account. Follow the guides below to provision this access: Amazon Web Services (https://github.com/aquasecurity/cloudsploit/blob/master/docs/aws.md#cloud-provider-configuration) Microsoft Azure (https://github.com/aquasecurity/cloudsploit/blob/master/docs/azure.md#cloud-provider-configuration) Google Cloud Platform (https://github.com/aquasecurity/cloudsploit/blob/master/docs/gcp.md#cloud-provider-configuration) Oracle Cloud Infrastructure (https://github.com/aquasecurity/cloudsploit/blob/master/docs/oracle.md#cloud-provider-configuration) For AWS, you can run CloudSploit directly and it will detect credentials (https://www.kitploit.com/search/label/Credentials) using the default AWS credential chain (https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CredentialProviderChain.html). CloudSploit Config File The CloudSploit config file allows you to pass cloud provider credentials by: A JSON file on your file system Environment variables Hard-coding (not recommended) Start by copying the example config file: $ cp config_example.js config.js
Edit the config file by uncommenting the relevant sections for the cloud provider you are testing. Each cloud has both a credential_file option, as well as inline options. For example: azure: {
// OPTION 1: If using a credential JSON file, enter the path below
// credential_file: '/path/to/file.json',
// OPTION 2: If using hard-coded credentials, enter them below
// application_id: process.env.AZURE_APPLICATION_ID || '',
// key_value: process.env.AZURE_KEY_VALUE || '',
// directory_id: process.env.AZURE_DIRECTORY_ID || '',
// subscription_id: process.env.AZURE_SUBSCRIPTION_ID || ''
}
Credential Files If you use the credential_file option, point to a file in your file system that follows the correct format for the cloud you are using. AWS {
"accessKeyId": "YOURACCESSKEY",
"secretAccessKey": "YOURSECRETKEY"
}
Azure {
"ApplicationID": "YOURAZUREAPPLICATIONID",
"KeyValue": "YOURAZUREKEYVALUE",
"DirectoryID": "YOURAZUREDIRECTORYID",
"SubscriptionID": "YOURAZURESUBSCRIPTIONID"
}
GCP Note: For GCP, you generate a JSON file (https://github.com/aquasecurity/cloudsploit/blob/master/docs/gcp.md) directly from the GCP console, which you should not edit. {
"type": "service_account",
"project": "GCPPROJECTNAME",
"client_email": "GCPCLIENTEMAIL",
"private_key": "GCPPRIVATEKEY"
}
Oracle OCI {
"tenancyId": "YOURORACLETENANCYID",
"compartmentId": "YOURORACLECOMPARTMENTID",
"userId": "YOURORACLEUSERID",
"keyFingerprint": "YOURORACLEKEYFINGERPRINT",
"keyValue": "YOURORACLEKEYVALUE",
}
Environment Variables CloudSploit supports passing environment variables, but you must first uncomment the section of your config.js file relevant to the cloud provider being scanned. You can then pass the variables listed in each section. For example, for AWS: {
access_key: process.env.AWS_ACCESS_KEY_ID || '',
secret_access_key: process.env.AWS_SECRET_ACCESS_KEY || '',
session_token: process.env.AWS_SESSION_TOKEN || '',
}
Running To run a standard scan, showing all outputs and results, simply run: $ ./index.js
CLI Options CloudSploit supports many options to customize the run time. Some popular options include: AWS GovCloud support: --govcloud AWS China support: --china Save the raw cloud provider response data: --collection=file.json Ignore passing (OK) results: --ignore-ok Exit with a non-zero code if non-passing results are found: --exit-code This is a good option for CI/CD systems Change the output from a table to raw text: --console=text See Output Formats (https://github.com/aquasecurity/cloudsploit#output-formates) below for more output options. Click for a full list of options $ ./index.js -h

_____ _ _ _____ _ _ _
/ ____| | | |/ ____| | | (_) |

| | | | ___ _ _ __| | (___ _ __ | | ___ _| |_
| | | |/ _ \| | | |/ _` |\___ \| '_ \| |/ _ \| | __|
| |____| | (_) | |_| | (_| |____) | |_) | | (_) | | |_
\_____|_|\___/ \__,_|\__,_|_____/| .__/|_|\___/|_|\__|
| |
|_|

CloudSploit by Aqua Security, Ltd.
Cloud security auditing for AWS, Azure, GCP, Oracle, and GitHub

usage: index.js [-h] --config CONFIG [--compliance {hipaa,cis,cis1,cis2,pci}] [--plugin PLUGIN] [--govcloud] [--china] [--csv CSV] [--json JSON] [--junit JUNIT]
[--table] [--console {none,text,table}] [--collection COLLECTION] [--ignore-ok] [--exit-code] [--skip-paginate] [-- suppress SUPPRESS]

optional arguments:
-h, --help show this help message and exit
--config CONFIG
The path to a cloud provider credentials file.
--compliance {hipaa,cis,cis1,cis2,pci}
Compliance mode. Only return results applicable to the selected program.
--plugin PLUGIN A specific plugin to run. If none provided, all plugins will be run. Obtain from the exports.js file. E.g. acmValidation
--govcloud AWS only. Enables GovCloud mode.
--china AWS only. Enables AWS China mode.
--csv CSV Output: CSV file
--json JSON Output: JSON file
--junit JUNIT Output: Junit file
--table Output: table
--console {none,text,table}
Console output format. Default: table
--collection COLLECTION
Output: full collection JSON as file
--ignore-ok Ignore passing (OK) results
--exit-code Exits with a non-zero status code if non-passing results are found
--skip-paginate AWS only. Skips pagination (for debugging).
--suppress SUPPRESS Suppress results matching the provided Regex. Format: pluginId:region:resourceId
Compliance CloudSploit supports mapping of its plugins to particular compliance policies. To run the compliance scan, use the --compliance flag. For example: $ ./index.js --compliance=hipaa
$ ./index.js --compliance=pci
Multiple compliance modes can be run at the same time: $ ./index.js --compliance=cis1 --compliance=cis2
CloudSploit currently supports the following compliance mappings: HIPAA $ ./index.js --compliance=hipaa
HIPAA scans map CloudSploit plugins to the Health Insurance Portability and Accountability Act of 1996. PCI $ ./index.js --compliance=pci
PCI scans map CloudSploit plugins to the Payment Card Industry Data Security Standard. CIS Benchmarks $ ./index.js --compliance=cis
$ ./index.js --compliance=cis1
$ ./index.js --compliance=cis2
CIS Benchmarks are supported, both for Level 1 and Level 2 controls. Passing --compliance=cis will run both level 1 and level 2 controls. Output Formats CloudSploit supports output in several formats for consumption by other tools. If you do not specify otherwise, CloudSploit writes output to standard output (the console) as a table. Note: You can pass multiple output formats and combine options for further customization. For example: # Print a table to the console and save a CSV file
$ ./index.js --csv=file.csv --console=table

# Print text to the console and save a JSON and JUnit file while ignoring passing results
$ ./index.js --json=file.json --junit=file.xml --console=text --ignore-ok
Console Output By default, CloudSploit results are printed to the console in a table format (with colors). You can override this and use plain text instead, by running: $ ./index.js --console=text
Alternatively, you can suppress the console output entirely by running: $ ./index.js --console=none
Ignoring Passing Results You can ignore results from output that return an OK status by passing a --ignore-ok commandline (https://www.kitploit.com/search/label/Commandline) argument. CSV $ ./index.js --csv=file.csv
JSON $ ./index.js --json=file.json

JUnit XML $ ./index.js --junit=file.xml
Collection Output CloudSploit saves the data queried from the cloud provider APIs in JSON format, which can be saved alongside other files for debugging or historical purposes. $ ./index.js --collection=file.json
Suppressions Results can be suppressed by passing the --suppress flag (multiple options are supported) with the following format: --suppress pluginId:region:resourceId
For example: # Suppress all results for the acmValidation plugin
$ ./index.js --suppress acmValidation:*:*

# Suppress all us-east-1 region results
$ ./index.js --suppress *:us-east-1:*

# Suppress all results matching the regex "certificate/*" in all regions for all plugins
$ ./index.js --suppress *:*:certificate/*
Running a Single Plugin The --plugin flag can be used if you only wish to run one plugin. $ ./index.js --plugin acmValidation
Architecture CloudSploit works in two phases. First, it queries the cloud infrastructure APIs for various metadata about your account, namely the "collection" phase. Once all the necessary data is collected, the result is passed to the "scanning" phase. The scan uses the collected data to search for potential misconfigurations, risks, and other security issues, which are the resulting output. Writing a Plugin Please see our contribution guidelines (https://github.com/aquasecurity/cloudsploit/blob/master/.github/CONTRIBUTING.md) and complete guide (https://github.com/aquasecurity/cloudsploit/blob/master/docs/writing-plugins.md) to writing CloudSploit plugins. Writing a remediation The --remediate flag can be used if you want to run remediation for the plugins mentioned as part of this argument. This takes a list of plugin names. Please see our developing remediation guide (https://github.com/aquasecurity/cloudsploit/blob/master/docs/writing-remediation.md) for more details. Other Notes For other details about the Aqua Wave SaaS product, AWS security policies, and more, click here (https://github.com/aquasecurity/cloudsploit/blob/master/docs/notes.md).

Download Cloudsploit (https://github.com/aquasecurity/cloudsploit)

Hacking My ISP For FREE Internet

Note: This article is only for educational purpose.Continue reading on Medium »
Read more...

Hacking My ISP For FREE Internet
https://faiyazhacks.medium.com/hacking-my-isp-for-free-internet-12d8ddad492?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Note: This article is only for educational purpose.Continue reading on Medium » (https://faiyazhacks.medium.com/hacking-my-isp-for-free-internet-12d8ddad492?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/jNXjxV7Xx0Zv1q3QxzdCze-qf17fgEs7Ut3avtGLuhY.jpg So my email was hacked and has since been secured(changed about a month ago) but automatic emails are continually sent out even though I require authentication to access my email. Is there any way to stop the emails from being sent(the account is a hotmail account)?

​

​

edit: added pic

submitted by /u/dashdtp
[link] [comments]

hacking: security in practice
is it possible to decompile a .dll file?

im trying to decompile a .dll file for a really old Tech
but No matter how i tried i failed
I tried searching in google but no luck
This is the dll file btw
is it possible to decompile it?

submitted by /u/HotTheory8792
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way in Python to create a full HTTP request without sending it?

I want to create full HTTP requests with the method, URL, headers, and data for HTTP request smuggling. I've tried from requests import Requestbut that seems to only give me pieces and not a whole printable request string. Is there a way to get a full HTTP request in text?

submitted by /u/wholesome_hug_bot
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video