Kali Linux Tutorials
Http-Desync-Guardian – Analyze HTTP Requests To Minimize Risks Of HTTP Desync Attacks

Http-Desync-Guardian is to Analyze HTTP Requests To Minimize Risks Of HTTP Desync Attacks. HTTP/1.1went through a long evolution since 1991 to 2014:

* HTTP/0.9 – 1991
* HTTP/1.0 – 1996
* HTTP/1.1
* RFC 2068 – 1997
* RFC 2616 – 1999
* RFC 7230 – 2014
This means there is a variety of servers and clients, which might have different views on request boundaries, creating opportunities for desynchronization attacks (a.k.a. HTTP Desync).

It might seem simple to follow the latest RFC recommendations. However, for large scale systems that have been there for a while, it may come with unacceptable availability impact. http_desync_guardianlibrary is designed to analyze HTTP requests to prevent HTTP Desync attacks, balancing security and availability. It classifies requests into different categories and provides recommendations on how each tier should be handled.

It can be used either for raw HTTP request headers or already parsed by an HTTP engine. Consumers may configure logging and metrics collection. Logging is rate limited and all user data is obfuscated.

If you think you might have found a security impacting issue, please follow our Security Notification Process. Priorities

* Uniformity across services is key. This means request classification, logging, and metrics must happen under the hood and with minimally available settings (e.g., such as log file destination).
* Focus on reviewability. The test suite must require no knowledge about the library/programming languages but only about HTTP protocol. So it’s easy to review, contribute, and re-use.
* Security is efficient when it’s easy for users. Our goal is to make integration of the library as simple as possible.
* Ultralight. The overhead must be minimal and impose no tangible tax on request handling (see benchmarks). Supported HTTP versions

The main focus of this library is HTTP/1.1. See tests for all covered cases. Predecessors of HTTP/1.1don’t support connection re-use which limits opportunities for HTTP Desync, however some proxies may upgrade such requests to HTTP/1.1and re-use backend connections, which may allow to craft malicious HTTP/1.0requests. That’s why they are analyzed using the same criteria as HTTP/1.1. For other protocol versions have the following exceptions:

* HTTP/0.9requests are never considered Compliant, but are classified as Acceptable. If any of Content-Length/Transfer-Encoding is present then it’s Ambiguous.
* HTTP/1.0– the presence of Transfer-Encodingmakes a request Ambiguous.
* HTTP/2+is out of scope. But if your proxy downgrades HTTP/2to HTTP/1.1, make sure the outgoing request is analyzed.

See documentation to learn more.

Overview

This page contains request classification tiers and reasons as well as mitigations, with explanations for some non-trivial cases. Request classification http_desync_guardianis a library for analyzing and classifying HTTP/1.x requests to provide customers security balanced with necessity to serve traffic for legacy or proprietary systems (not always RFC compliant).

* Compliant– RFC compliant requests (*)
* Acceptable– non RFC compliant requests, but which do not represent security risks
* Ambiguous– requests that might be treated differently by different HTTP servers and therefore may lead to HTTP Desync issues (and request splitting/smuggling as a possible consequence)
* Severe– either malformed or highly likely crafted to trick HTTP parsers and cause HTTP de-synchr[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Dep-Scan : Fully Open-Source Security Audit For Project Dependencies

dep-scan is a fully open-source security audit tool for project dependencies based on known vulnerabilities, advisories and license limitations. Both local repositories and container images are supported as input. The tool is ideal for CI environments with built-in build breaker logic.

If you have just come across this repo, probably the best place to start is to checkout the parent project slscan which include depscan along with a number of other tools. Features

* Local repos and container image based scanning with CVE insights [1]
* Package vulnerability scanning is performed locally and is quite fast. No server is used!
* Suggest optimal fix version by package group (See suggest mode)
* Perform deep packages risk audit for dependency confusion attacks and maintenance risks (See risk audit)

NOTE

* [1] Only application related packages in container images are included in scanning. OS packages are not included yet. https://github.com/AppThreat/dep-scan/raw/master/docs/depscan-latest.png Vulnerability Data sources

* OSV
* NVD
* GitHub
* NPM Usage

dep-scan is ideal for use during continuous integration (CI) and also as a tool for local development. Use with ShiftLeft Scan

dep-scan is integrated with scan, a free and open-source SAST tool. To enable this feature simply pass depscanto the --typeargument. Refer to the scan documentation for more information.

–type python,depscan,credscan

This approach should work for all CI environments supported by scan. Scanning projects locally (Python version)

sudo npm install -g @appthreat/cdxgen
pip install appthreat-depscan

This would install two commands called cdxgenand scan.

You can invoke the scan command directly with the various options.

cd
depscan –src $PWD –report_file $PWD/reports/depscan.json

Full list of options are below:

usage: depscan [-h] [–no-banner] [–cache] [–sync] [–suggest] [–risk-audit] [–private-ns PRIVATE_NS] [-t PROJECT_TYPE] [–bom BOM] -i SRC_DIR [-o REPORT_FILE]
[–no-error]
-h, –help show this help message and exit
–no-banner Do not display banner
–cache Cache vulnerability information in platform specific user_data_dir
–sync Sync to receive the latest vulnerability data. Should have invoked cache first.
–suggest Suggest appropriate fix version for each identified vulnerability.
–risk-audit Perform package risk audit (slow operation). Npm only.
–private-ns PRIVATE_NS
Private namespace to use while performing oss risk audit. Private packages should not be available in public registries by default. Comma
separated values accepted.
-t PROJECT_TYPE, –type PROJECT_TYPE
Override project type if auto-detection is incorrect
–bom BOM Examine using the given Software Bill-of-Materials (SBoM) file in CycloneDX format. Use cdxgen command to produce one.
-i SRC_DIR, –src SRC_DIR
Source directory
-o REPORT_FILE, –report_file REPORT_FILE
Report filename with directory
–no-error Continue on error to prevent build from breaking

Scanning containers locally (Python version)

Scan latesttag of the container shiftleft/scan-slimdepscan –no-error –cache –src shiftleft/scan-slim -o containertests/depscan-scan.json -t docker

Include licenseto the type to perform license audit.

depscan –no-error –-cache –src shiftleft/scan-slim -o containertests/depscan-scan.json -t docker,license

You can also save container images using docker or podman save command and pass the archive to depscan for scanning.

docker save -o /tmp/scanslim.tar shiftleft/scan-slim:latest
podman save –format oci-archive -o /tmp/scanslim.tar shiftleft/scan-slim:latest
depscan –no-error –src /tmp/scanslim.tar -o reports/depscan-scan.json -t docker

Supported languages and package forma[...]

___________________________
@hacking_Attack
@Hacking_Video

onization. Recommended http_desync_guardianModes
ClassificationDefensive modeStrictest modeCompliantAllowedAllowedAcceptableAllowedBlockedAmbiguousAllowed¹BlockedSevereBlockedBlocked
¹ Route the requests but closes the client and target connections.

For Blockedrequests the client connection must be closed.

If you are concerned about potential impact, Monitoring mode offers a metrics-only approach to assess prior to switching. Classification Reasons* Compliant* Compliant– a compliant request

* Acceptable* NonCompliantHeader– non-essential header containing a non-ASCII or control characters (CTL) – i.e. special invisible characters.
* SpaceInUri– unescaped space in the URI
* NonCompliantVersion– version which contains extra spaces, missing (i.e. HTTP/0.9) or matches HTTP/1.[2-9]
* GetHeadZeroContentLength– GET/HEAD request with a “Content-Length: 0” header

* Ambiguous* EmptyHeader– if there is an empty header or a line with whitespaces only in the request
* AmbiguousUri– an URI containing CTL characters
* UndefinedContentLengthSemantics– Content-Length for GET/HEAD requests
* UndefinedTransferEncodingSemantics– Transfer-Encoding for GET/HEAD requests
* DuplicateContentLength– duplicated Content-Length header (same value)
* BothTeClPresent– both Transfer-Encoding and Content-Length are present in the request
* SuspiciousHeader– a header that can be normalized to Transfer-Encodingor Content-Lengthusing common text normalization techniques (sanitation, case normalization, delimiters normalization).

* Severe* BadHeader– header containing null-character or CR
* BadUri– URI containing null-character or CR
* BadVersion– malformed version
* MultipleContentLength– different Content-Length headers
* BadContentLength– a non-parseable value or an invalid number
* MultipleTransferEncodingChunked– multiple Transfer-Encoding: chunked headers
* BadTransferEncoding– unknown Transfer-Encoding value
* BadMethod– malformed method

* Parsingraw-requests
* NonCrLfLineTermination(Acceptable) – allowing “\n” line termination (similar to Nginx).
* MultilineHeader(Ambiguous) – multi-line headers are non RFC compliant (except Content-Type)
* PartialHeaderLine(Ambiguous) – if a header line was not terminated
* MissingLastEmptyLine(Ambiguous) – there is no empty line at the end of request
* MissingHeaderColon(Ambiguous) – header line doesn’t have colon separator
* MissingUri(Ambiguous) – there is no URI in the request line Details on certain classifications Undefined Content-Length/Transfer-Encoding Semantics (UndefinedTransferEncodingSemantics, UndefinedContentLengthSemantics)A payload within a GET/HEAD request message has no defined semantics. https://tools.ietf.org/html/rfc7231#section-4.3

https://medium.com/@knownsec404team/protocol-layer-attack-http-request-smuggling-cc654535b6f 3.1 GET Request with CL != 0

https://portswigger.net/web-security/request-smuggling/exploiting See “Capturing other users’ requests” https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf see “EXAMPLE #3” Both Content-Length and Transfer-Encoding are present (BothTeClPresent)

If a request containing both Content-Length and Transfer-Encoding was received, it means that the sender didn’t follow RFC, and thus there is a chance that request boundaries might be out of sync with the sender.

If a message is received with both a Transfer-Encoding and a Content-Length header field, the Transfer-Encoding overrides the Content-Length. Such a message might indica[...]

___________________________
@hacking_Attack
@Hacking_Video

t

dep-scan uses cdxgen command internally to create Software Bill-of-Materials (SBoM) file for the project. This is then used for performing the scans.

The following projects and package-dependency format is supported by cdxgen.
LanguagePackage formatnode.jspackage-lock.json, pnpm-lock.yaml, yarn.lock, rush.jsjavamaven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt)phpcomposer.lockpythonsetup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whlgobinary, go.mod, go.sum, Gopkg.lockrubyGemfile.lock, gemspecrustCargo.toml, Cargo.lock.Net.csproj, packages.config, project.assets.json, packages.lock.jsondocker / oci imageAll supported languages excluding OS packages
NOTE

The docker image for dep-scan currently doesn’t bundle suitable java and maven commands required for bom generation. To workaround this limitation, you can –

* Use python-based execution from a VM containing the correct versions for java, maven and gradle.
* Generate the bom file by invoking cdxgencommand locally and subsequently passing this to dep-scanvia the --bomargument. Integration with CI environments Integration with Azure DevOps

Refer to this example yaml configuration for integrating dep-scan with Azure Pipelines. The build step would perform the scan and display the report inline as shown below:
https://blogger.googleusercontent.com/img/a/AVvXsEh-pjxjO4AFRU5NvapTl_mcVXj_I6Q51VvE8R0OXsZpe0k9msVD1sIPfujKeS_xT-X7HHc_nsertaq93ujnlmJq250kYjzNN4mUPBLcNw6L2f_ZXTQqLG7ml7wUbc6uHwDFYlFJlDrQfPs_JAF-DfFUol4nJCZAZxkYyhR5jQ9N4P6HzqFsttHnqHtO=s2826
Integration with GitHub Actions

This tool can be used with GitHub Actions using this action.

This repo self-tests itself with both sast-scan and dep-scan! Check the GitHub workflow file of this repo.

* name: Self dep-scan
uses: AppThreat/dep-scan-action@master
env:
VDB_HOME: ${{ github.workspace }}/db
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
* Customisation through environment variablesThe following environment variables can be used to customise the behaviour.

* VDB_HOME – Directory to use for caching database. For docker based execution, this directory should get mounted as a volume from the host
* NVD_START_YEAR – Default: 2018. Supports upto 2002
* GITHUB_PAGE_COUNT – Default: 2. Supports upto 20 GitHub Security Advisory

To download security advisories from GitHub, a personal access token with the following scope is necessary.

* read:packages

export GITHUB_TOKEN=””

Package Risk Audit --risk-auditargument enables package risk audit. Currently, only npm and pypi packages are supported in this mode. A number of risk factors are identified and assigned weights to compute a final risk score. Packages that then exceed a maximum risk score (config.pkg_max_risk_score) are presented in a table.

Use --private-nsto specify the private package namespace that should be checked for dependency confusion type issues where a private package is available on public npm/pypi registry.

Example to check if private packages with namespaces @appthreat and @shiftleft are not accidentally made public use the below argument. --private-ns appthreat,shiftleft Risk categoryDefault WeightReasonpkg_private_on_public_registry4Private package is available on a public registrypkg_min_versions2Packages with less than 3 versions represent an extreme where they could be either super stable or quite recent. Special heuristics are applied to ignore older stable packagesmod_create_min_seconds1Less than 12 hours difference between modified and creation time. This indicates that the upload had a defect that had to be rectified immediately. Sometimes, such a rapid update could also be maliciouslatest_now_min_seconds0.5Less than 12 hours difference between the latest version and the current time. Depending on the package such a latest version may or may not be desirablelatest_n[...]

___________________________
@hacking_Attack
@Hacking_Video

te an attempt to perform request smuggling (Section 9.5) or response splitting (Section 9.4) and ought to be handled as an error. A sender MUST remove the received Content-Length field prior to forwarding such a message downstream.

https://tools.ietf.org/html/rfc7230#section-3.3.2 Multi-line headers (MultilineHeader)

Multi-line headers have been deprecated in RFC 7230, and different engines may either support it or not, which provides malicious actors a toolkit to trick parser to “see” headers that are not there or vice versa. That’s why we mark requests containing multi-line headers as Ambiguous (except the Content-Type header).

Historically, HTTP header field values could be extended over multiple lines by preceding each extra line with at least one space or horizontal tab (obs-fold). This specification deprecates such line folding except within the message/http media type (Section 8.3.1). A sender MUST NOT generate a message that includes line folding (i.e., that has any field-value that contains a match to the obs-fold rule) unless the message is intended for packaging within the message/http media type.

https://tools.ietf.org/html/rfc7230#section-3.2.4 Multiple Transfer-Encoding Chunked (MultipleTransferEncodingChunked)

A sender MUST NOT apply chunked more than once to a message body

https://tools.ietf.org/html/rfc7230#section-3.3.1 Multiple Content-Length Headers (MultipleContentLength, DuplicateContentLength)

If there are multiple different Content-Length headers (different values) the request is marked as Severe. In the case of multiple but same values, it falls into DuplicateContentLength category (marked as Ambiguous).

If a message is received that has multiple Content-Length header fields with field-values consisting of the same decimal value, or a single Content-Length header field with a field value containing a list of identical decimal values (e.g., “Content-Length: 42, 42”), indicating that duplicate Content-Length header fields have been generated or combined by an upstream message processor, then the recipient MUST either reject the message as invalid or replace the duplicated field-values with a single valid Content-Length field containing that decimal value prior to determining the message body length or forwarding the message.

https://tools.ietf.org/html/rfc7230#section-3.3.2 Suspicious headers (SuspiciousHeader)

There is a range of attacks to masquerade Transfer-Encoding and Content-Length headers, so some engines in the chain will see them while others won’t. For example:

Transfer-Encoding : chunked
Content-Length: 100

In this case, some engines may reject this request, as it’s not RFC compliant. Some may sanitize the space before the colon and treat as it has “Transfer-Encoding: chunked” while some may see “Transfer-Encoding[space]” and ignore it. It is the simplest case to illustrate this idea, but there are many others. For instance:

Transfer-Encodıng: chunked

Small Dotless I becomes ASCII “I” on upper-case transformation which may trick some engines. Or have a CTL character:

Transfer_Encoding: chunked
\x01Transfer-Encoding: chunked
Transfer-Encoding\b: chunked

Some engines may normalize delimiters or non-letters, e.g., using regular expressions, etc. (especially using standard string trimming routines that may have different behaviors in different platforms).

To mitigate these risks, we determine the similarity of headers to Transfer-Encodingand Content-Length and mark requests as Ambiguous if any of these deviations are detected. Mitigations

There are two types of mitigations:

* Reject request with 400 and close the connection
* Serve the request but disable connection re-use on both front-end and back-end.

Why connection is closed after a Severerequest

In this case, we cannot establish request boundaries and tell when the next request starts.

Why connections are both FE/BE connections closed af[...]

___________________________
@hacking_Attack
@Hacking_Video

ow_max_seconds0.5Package versions that are over 6 years old are in use. Such packages might have vulnerable dependencies that are known or yet to be foundpkg_min_maintainers2Package has less than 2 maintainers. Many opensource projects have only 1 or 2 maintainers so special heuristics are used to ignore older stable packagespkg_min_users0.25Package has less than 2 npm userspkg_install_scripts2Package runs a custom pre or post installation scripts. This is often malicious and a downside of npm.pkg_node_version0.5Package supports outdated version of node such as 0.8, 0.10, 4 or 6.x. Such projects might have prototype pollution or closure related vulnerabilitiespkg_scope4 or 0.5Packages that are used directly in the application (required scope) gets a score with a weight of 4. Optional packages get a score of 0.25deprecated1Latest version is deprecated
Refer to pkg_query.py::get_category_scoremethod for the risk formula. Automatic adjustment

A parameter called created_now_quarantine_secondsis used to identify packages that are safely past the quarantine period (1 year). Certain risks such as pkg_min_versionsand pkg_min_maintainersare suppressed for packages past the quarantine period. This adjustment helps reduce noise since it is unlikely that a malicious package can exist in a registry unnoticed for over a year. Configuring weights

All parameters can be customized by using environment variables. For eg:

export PKG_MIN_VERSIONS=4 to increase and set the minimum versions category to 4. Download

___________________________
@hacking_Attack
@Hacking_Video

ter an Ambiguous request?

Let’s start with not re-using a backend connection example:
https://blogger.googleusercontent.com/img/a/AVvXsEiOzGB4IJiglVMcDR2v-h7aafwSjQ49POoVbMuuL4MjjwKjobRQHpxKX9G_7209VUx-yXP2AuB318RS0kTiqJE3IL5OgBTtaXqAt4OocXDFQtG2anLEVrBBA3kob1A-QNg9nTMkei6F_1Ur4Q4B6Ad4pR_dozakVlJehrqWyzGjPTFE_7kdJT-IBx6F=s962
1. Attacker sends a request, such as Proxy only sees POST /foo while backend also sees GET /poison
2. However Proxy marks the request as Ambiguous
3. Proxy closes the connection after the response
4. The /poison response is dropped as the connection is not going to be re-used.

This seems to be efficient, but falls short if there is a layer in front of the proxy:
https://blogger.googleusercontent.com/img/a/AVvXsEiAuDln_IlMM_PtGdmi9aDIBIdUZxJStGXqabf_KKEnxH4Kt08s0Yatc2pPH6AyVZ8Df42rw6pNKPxAT6Tnh5jqhYOcZTSqBS3Xsx8_173XoQoeMgqLzkhoGq0qQTX8mSLGSjrbubTMy_VFvBhXuK2XaOcBkYExrh4Ldqfh_5Lxi7GkA5NCWVEhSn--=s1346
1. In this case let’s assume Desync happens between CDN and the Proxy and Proxy marks the request as Ambiguous
2. While Proxy closes the BE connection, it’s not helpful
3. The /poison response is still served via re-used front-end connection

But if both FE/BE connections are closed, then HTTP Desync is prevented:
https://blogger.googleusercontent.com/img/a/AVvXsEjoc293EV4nxod5LQcZ9zMWdw0_Rv9B45OhSJ_iLy0rszrCcjF2q8jbTHfOrljNK4oW_dIvfjCw-O470EciXgOS14wba20CApTDAI2Md1xPLzFRSNqhIFiYYNiPZsdWnLiLmuKBG75eLxEv61BfVOmbDfeh2M1ac1AMbwWNGcNcLmjf5Ho9_uFTlbCj=s1315
1. Same as in the previous example, let’s assume Desync happens between CDN and the Proxy and Proxy marks the request as Ambiguous
2. Now Proxy closes both FE/BE connections.
3. The /poison response is dropped. Usage from C

This library is designed to be primarily used from HTTP engines written in C/C++.

1. Install cbindgen: cargo install --force cbindgen2. Generate the header file:
* Run cbindgen --output http_desync_guardian.h --lang cfor C.
* Run cbindgen --output http_desync_guardian.h --lang c++for C++.

3. Run cargo build --release. The binaries are in ./target/release/libhttp_desync_guardian.*files.

Learn more: generic and Nginx examples.

include “http_desync_guardian.h”
http_engine_request_t – already parsed by the HTTP engine
*/
static int check_request(http_engine_request_t *req) {
http_desync_guardian_request_t guardian_request = construct_http_desync_guardian_from(req);
http_desync_guardian_verdict_t verdict = {0};
http_desync_guardian_analyze_request(&guardian_request, &verdict);
switch (verdict.tier) { case REQUEST_SAFETY_TIER_COMPLIANT:
// The request is good. green light
break;
case REQUEST_SAFETY_TIER_ACCEPTABLE:
// Reject, if mode == STRICTEST
// Otherwise, OK
break;
case REQUEST_SAFETY_TIER_AMBIGUOUS:
// The request is ambiguous.
// Reject, if mode == STRICTEST
// Otherwise send it, but don’t reuse both FE/BE connections.
break;
case REQUEST_SAFETY_TIER_SEVERE:
// Send 400 and close the FE connection.
break;
default:
// unreachable code
abort();
}
} Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Turning a web browser extension into a botnet

https://external-preview.redd.it/dmNDaQbix-b1JK_8hJOkoag8_FsIBJxjmcy9sm60hq8.jpg?width=640&crop=smart&auto=webp&s=fcf9059c8b082e8ee9f073e309e2c7a165609586 submitted by /u/z0mbie42_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
cyber security

i dont know if this is right place to ask about it but i have a big question . i am currently a student of 4 year cyber security degree. so my question after completing everything can i work from home in some kind of cyber security job

submitted by /u/UnkownWithUnkownprsn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The new CHERI-enabled Morello boards — entirely new hardware making it harder for bad actors to…

https://cdn-images-1.medium.com/max/2600/1*TNZKzQQBjTdz6LX7c0FEzw.jpeg
How SRI is helping transform cybersecurity

Continue reading on The Dish »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Russian hackers are coming after you, personally

https://cdn-images-1.medium.com/max/2600/0*BKzxps4UXVaScWSZ
The Russian state runs a skilled, persistent, large-scale hacking operation. There are numerous examples of operations which have been…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Attacking Kerberos Constrained Delegation

https://cdn-images-1.medium.com/max/2600/1*hqq8PJx9SS9fpgRfiACvHQ.jpeg
Trust this user/computer for delegation to specified services only

Continue reading on R3d Buck3T »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyber Security — An emerging computer domain

https://cdn-images-1.medium.com/max/1920/1*zNQwAzAYcCyCous6VGvawQ.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Complete Guide to Cyber Security and How You Can Protect Yourself From Hacks & Breaches.

https://cdn-images-1.medium.com/max/2600/1*oT1Uadw9D4wLJU5JJKPe5A.jpeg
Introduction: 
 In this article, we can learn The Complete Guide to Cyber Security and How You Can Protect Yourself From Hacks & Breaches,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Denial of Service Dog: A DIY Guide.

https://cdn-images-1.medium.com/max/1105/1*Ow46x_dQkHDjSwGYpIncew.png
chaotic walkies

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DAO Hack: Ideation Workshop [Video + Slides]

https://cdn-images-1.medium.com/max/1920/1*OkDbwKT-OttjZJoAG-HwdQ.jpeg
On Tuesday, 8th March, we were delighted to host the Ideation Event for our DAO Hack.

Continue reading on Encode Club »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Actualizaciones de Windows 10 KB5011487 y KB5011485 lanzadas

https://cdn-images-1.medium.com/max/1200/0*UhaNIQF-sAT9giLa
PUBLICADO EN 9 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video