| | | | ___ _ _ __| | (___ _ __ | | ___ _| |_
| | | |/ _ \| | | |/ _` |\___ \| '_ \| |/ _ \| | __|
| |____| | (_) | |_| | (_| |____) | |_) | | (_) | | |_
\_____|_|\___/ \__,_|\__,_|_____/| .__/|_|\___/|_|\__|
| |
|_|

CloudSploit by Aqua Security, Ltd.
Cloud security auditing for AWS, Azure, GCP, Oracle, and GitHub

usage: index.js [-h] --config CONFIG [--compliance {hipaa,cis,cis1,cis2,pci}] [--plugin PLUGIN] [--govcloud] [--china] [--csv CSV] [--json JSON] [--junit JUNIT]
[--table] [--console {none,text,table}] [--collection COLLECTION] [--ignore-ok] [--exit-code] [--skip-paginate] [-- suppress SUPPRESS]

optional arguments:
-h, --help show this help message and exit
--config CONFIG
The path to a cloud provider credentials file.
--compliance {hipaa,cis,cis1,cis2,pci}
Compliance mode. Only return results applicable to the selected program.
--plugin PLUGIN A specific plugin to run. If none provided, all plugins will be run. Obtain from the exports.js file. E.g. acmValidation
--govcloud AWS only. Enables GovCloud mode.
--china AWS only. Enables AWS China mode.
--csv CSV Output: CSV file
--json JSON Output: JSON file
--junit JUNIT Output: Junit file
--table Output: table
--console {none,text,table}
Console output format. Default: table
--collection COLLECTION
Output: full collection JSON as file
--ignore-ok Ignore passing (OK) results
--exit-code Exits with a non-zero status code if non-passing results are found
--skip-paginate AWS only. Skips pagination (for debugging).
--suppress SUPPRESS Suppress results matching the provided Regex. Format: pluginId:region:resourceId
Compliance CloudSploit supports mapping of its plugins to particular compliance policies. To run the compliance scan, use the --compliance flag. For example: $ ./index.js --compliance=hipaa
$ ./index.js --compliance=pci
Multiple compliance modes can be run at the same time: $ ./index.js --compliance=cis1 --compliance=cis2
CloudSploit currently supports the following compliance mappings: HIPAA $ ./index.js --compliance=hipaa
HIPAA scans map CloudSploit plugins to the Health Insurance Portability and Accountability Act of 1996. PCI $ ./index.js --compliance=pci
PCI scans map CloudSploit plugins to the Payment Card Industry Data Security Standard. CIS Benchmarks $ ./index.js --compliance=cis
$ ./index.js --compliance=cis1
$ ./index.js --compliance=cis2
CIS Benchmarks are supported, both for Level 1 and Level 2 controls. Passing --compliance=cis will run both level 1 and level 2 controls. Output Formats CloudSploit supports output in several formats for consumption by other tools. If you do not specify otherwise, CloudSploit writes output to standard output (the console) as a table. Note: You can pass multiple output formats and combine options for further customization. For example: # Print a table to the console and save a CSV file
$ ./index.js --csv=file.csv --console=table

# Print text to the console and save a JSON and JUnit file while ignoring passing results
$ ./index.js --json=file.json --junit=file.xml --console=text --ignore-ok
Console Output By default, CloudSploit results are printed to the console in a table format (with colors). You can override this and use plain text instead, by running: $ ./index.js --console=text
Alternatively, you can suppress the console output entirely by running: $ ./index.js --console=none
Ignoring Passing Results You can ignore results from output that return an OK status by passing a --ignore-ok commandline (https://www.kitploit.com/search/label/Commandline) argument. CSV $ ./index.js --csv=file.csv
JSON $ ./index.js --json=file.json

JUnit XML $ ./index.js --junit=file.xml
Collection Output CloudSploit saves the data queried from the cloud provider APIs in JSON format, which can be saved alongside other files for debugging or historical purposes. $ ./index.js --collection=file.json
Suppressions Results can be suppressed by passing the --suppress flag (multiple options are supported) with the following format: --suppress pluginId:region:resourceId
For example: # Suppress all results for the acmValidation plugin
$ ./index.js --suppress acmValidation:*:*

# Suppress all us-east-1 region results
$ ./index.js --suppress *:us-east-1:*

# Suppress all results matching the regex "certificate/*" in all regions for all plugins
$ ./index.js --suppress *:*:certificate/*
Running a Single Plugin The --plugin flag can be used if you only wish to run one plugin. $ ./index.js --plugin acmValidation
Architecture CloudSploit works in two phases. First, it queries the cloud infrastructure APIs for various metadata about your account, namely the "collection" phase. Once all the necessary data is collected, the result is passed to the "scanning" phase. The scan uses the collected data to search for potential misconfigurations, risks, and other security issues, which are the resulting output. Writing a Plugin Please see our contribution guidelines (https://github.com/aquasecurity/cloudsploit/blob/master/.github/CONTRIBUTING.md) and complete guide (https://github.com/aquasecurity/cloudsploit/blob/master/docs/writing-plugins.md) to writing CloudSploit plugins. Writing a remediation The --remediate flag can be used if you want to run remediation for the plugins mentioned as part of this argument. This takes a list of plugin names. Please see our developing remediation guide (https://github.com/aquasecurity/cloudsploit/blob/master/docs/writing-remediation.md) for more details. Other Notes For other details about the Aqua Wave SaaS product, AWS security policies, and more, click here (https://github.com/aquasecurity/cloudsploit/blob/master/docs/notes.md).

Download Cloudsploit (https://github.com/aquasecurity/cloudsploit)

Hacking My ISP For FREE Internet

Note: This article is only for educational purpose.Continue reading on Medium »
Read more...

Hacking My ISP For FREE Internet
https://faiyazhacks.medium.com/hacking-my-isp-for-free-internet-12d8ddad492?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Note: This article is only for educational purpose.Continue reading on Medium » (https://faiyazhacks.medium.com/hacking-my-isp-for-free-internet-12d8ddad492?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/jNXjxV7Xx0Zv1q3QxzdCze-qf17fgEs7Ut3avtGLuhY.jpg So my email was hacked and has since been secured(changed about a month ago) but automatic emails are continually sent out even though I require authentication to access my email. Is there any way to stop the emails from being sent(the account is a hotmail account)?

​

​

edit: added pic

submitted by /u/dashdtp
[link] [comments]

hacking: security in practice
is it possible to decompile a .dll file?

im trying to decompile a .dll file for a really old Tech
but No matter how i tried i failed
I tried searching in google but no luck
This is the dll file btw
is it possible to decompile it?

submitted by /u/HotTheory8792
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way in Python to create a full HTTP request without sending it?

I want to create full HTTP requests with the method, URL, headers, and data for HTTP request smuggling. I've tried from requests import Requestbut that seems to only give me pieces and not a whole printable request string. Is there a way to get a full HTTP request in text?

submitted by /u/wholesome_hug_bot
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

A tale of 0-Click Account Takeover and 2FA Bypass.
https://medium.com/@fatnassifiras45/a-tale-of-0-click-account-takeover-and-2fa-bypass-b369cd70e42f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey, it’s been a long time since I published a bug bounty write-up. I was in an internship period. So, I had a lot of free time. Anyways…Continue reading on Medium » (https://medium.com/@fatnassifiras45/a-tale-of-0-click-account-takeover-and-2fa-bypass-b369cd70e42f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Penetration Testing: A Hands-On Introduction to Hacking eBook
https://www.reddit.com/r/Pentesting/comments/sqx219/penetration_testing_a_handson_introduction_to/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Futureisnotsecure (https://www.reddit.com/user/Futureisnotsecure)
[link] (https://www.ebooks-courses-downloader.com/2022/02/penetration-testing-pdf.html) [comments] (https://www.reddit.com/r/Pentesting/comments/sqx219/penetration_testing_a_handson_introduction_to/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is changing email password enough after email was hacker by launching an .exe file ?

Hi

A Friend launched a .exe file (adobe pluging downloaded from a youtube video)

Two of his email were hacked (one from outlook on google chrome and the other in the email app on windows 10)

We changed both email password

His epic game account was stolen (email and password changed by the "hacker"), We sent a mail to epic game support

His steam account password was changed but we changed it back.

​

Windows defender doesn't detect anything on the pc (complete scan)

​

Is it enough ?

​

How did he get his email password, because if it's because of the .exe
file, can't the guy just do it again ? The virus may be still on his pc
even if windows defender doesn't detect it.

submitted by /u/Kiwiny
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HackTheBox | EarlyAccess 🎮(Linux | Hard) Detailed Walkthough

⭐️ I just released my detailed writeup of EarlyAccess, a Hard Linux, HackTheBox machine!

➡️XSS

➡️Python reverse engineering

➡️SQL injection

➡️LFI

➡️PHP reverse engineering -> RCE

➡️NodeJS reverse engineering -> RCE

➡️Docker escape

submitted by /u/SecAura
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Basic Web Technologies Knowledge required for starting with the web Exploitation Part-3
https://medium.com/@mananaggarwal2001/basic-web-technologies-knowledge-required-for-starting-with-the-web-exploitation-part-3-cfb662224f4c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hackers hope so You are doing well. I myself Manan Aggarwal a Btech Student is Here to Present you the blog in the continuation of…Continue reading on Medium » (https://medium.com/@mananaggarwal2001/basic-web-technologies-knowledge-required-for-starting-with-the-web-exploitation-part-3-cfb662224f4c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video