Kubeclarity - Tool For Detection And Management Of Software Bill Of Materials (SBOM) And Vulnerabilities Of Container Images And Filesystems
http://www.kitploit.com/2022/05/kubeclarity-tool-for-detection-and.html

___________________________
@hacking_Attack
@Hacking_Video

KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) of container images and filesystems. It scans both runtime K8s clusters and CI/CD pipelines for enhanced software supply chain security.
SBOM & vulnerability detection (https://www.kitploit.com/search/label/Vulnerability%20Detection) challenges Effective vulnerability scanning (https://www.kitploit.com/search/label/Vulnerability%20Scanning) requires an accurate Software Bill Of Materials (SBOM) detection: Various programming languages and package managers Various OS distributions Package dependency information is usually stripped upon build Which one is the best scanner/SBOM analyzer? What should we scan: Git repos, builds, container images or runtime? Each scanner/analyzer has its own format - how to compare the results? How to manage the discovered SBOM and vulnerabilities? How are my applications affected by a newly discovered vulnerability? Solution Separate vulnerability scanning into 2 phases: Content analysis to generate SBOM Scan the SBOM for vulnerabilities Create a pluggable infrastructure to: Run several content analyzers in parallel Run several vulnerability scanners (https://www.kitploit.com/search/label/Vulnerability%20Scanners) in parallel Scan and merge results between different CI stages using KubeClarity CLI Runtime K8s scan to detect vulnerabilities discovered post-deployment Group scanned resources (images/directories) under defined applications to navigate the object tree dependencies (applications, resources, packages, vulnerabilities)

___________________________
@hacking_Attack
@Hacking_Video

Features Dashboard Fixable vulnerabilities per severity Top 5 vulnerable elements (applications, resources, packages) New vulnerabilities trends Package count per license type Package count per programming language General counters Applications Automatic application detection in K8s runtime Create/edit/delete applications Per application, navigation to related: Resources (images/directories) Packages Vulnerabilities Licenses in use by the resources Application Resources (images/directories) Per resource, navigation to related: Applications Packages Vulnerabilities Packages Per package, navigation to related: Applications Linkable list of resources and the detecting SBOM analyzers Vulnerabilities Vulnerabilities Per vulnerability, navigation to related: Applications Resources List of detecting scanners K8s Runtime scan Automatic detection of target namespaces Scan progress and result navigation per affected element (applications, resources, packages, vulnerabilities) CLI (CI/CD) SBOM generation using multiple integrated content analyzers (Syft, cyclonedx-gomod) SBOM/image/directory vulnerability scanning using multiple integrated scanners (Grype, Dependency-track) Merging of SBOM and vulnerabilities across different CI/CD stages Export results to KubeClarity backend API The API for KubeClarity can be found here (https://github.com/openclarity/kubeclarity/blob/master/api/swagger.yaml) High level architecture

___________________________
@hacking_Attack
@Hacking_Video

Getting started Integration with SBOM generators and vulnerability scanners KubeClarity content analyzer integrates with the following SBOM generators: Syft (https://github.com/anchore/syft) Cyclonedx-gomod (https://github.com/CycloneDX/cyclonedx-gomod) KubeClarity vulnerability scanner (https://www.kitploit.com/search/label/Vulnerability%20Scanner) integrates with the following scanners: Grype (https://github.com/anchore/grype) Dependency-Track (https://github.com/DependencyTrack/dependency-track) The integrations with the SBOM generators can be found here (https://github.com/openclarity/kubeclarity/tree/master/shared/pkg/analyzer), and the integrations with the vulnerability scanners can be found here here (https://github.com/openclarity/kubeclarity/tree/master/shared/pkg/scanner). To enable and configure the supported SBOM generators and vulnerability scanners, please check the "analyzer" and "scanner" config under the "vulnerability-scanner" section in Helm values. Contributions of integrations with additional tools are more than welcome! Install KubeClarity in a K8s cluster using Helm: Add Helm repo helm repo add kubeclarity https://openclarity.github.io/kubeclarity Save KubeClarity default chart values helm show values kubeclarity/kubeclarity > values.yaml Check the configuration in values.yaml and update the required values if needed Deploy KubeClarity with Helm helm install --values values.yaml --create-namespace kubeclarity kubeclarity/kubeclarity -n kubeclarity or for OpenShift Restricted SCC compatible install: helm install --values values.yaml --create-namespace kubeclarity kubeclarity/kubeclarity -n kubeclarity --set global.openShiftRestricted=true \
--set kubeclarity-postgresql.securityContext.enabled=false --set kubeclarity-postgresql.containerSecurityContext.enabled=false \
--set kubeclarity-postgresql.volumePermissions.enabled=true --set kubeclarity-postgresql.volumePermissions.securityContext.runAsUser="auto" \
--set kubeclarity-postgresql.shmVolume.chmod.enabled=false Port forward to KubeClarity UI: kubectl port-forward -n kubeclarity svc/kubeclarity-kubeclarity 9999:8080 Open KubeClarity UI in the browser: http://localhost:9999/ Required K8s permissions Read secrets in cluster scope. This is required for getting image pull secrets for scanning private image repositories. Read config maps in cluster scope. This is required for getting the configured template of the scanner job. List pods in cluster scope. This is required for calculating the target pods that need to be scanned. List namespaces. This is required for fetching the target namespaces to scan in K8s runtime scan UI. Create & delete jobs in cluster scope. This is required for managing the jobs that will scan the target pods in their namespaces. Build and run locally with demo data Build UI & backend and start the backend locally (2 options): Using docker: Build UI and backend (the image tag is set using VERSION): VERSION=test make docker-backend Run the backend using demo data: docker run -p 8080:8080 -e FAKE_RUNTIME_SCANNER=true -e FAKE_DATA=true -e ENABLE_DB_INFO_LOGS=true -e DATABASE_DRIVER=LOCAL ghcr.io/openclarity/kubeclarity:test run Local build: Build UI and backend make ui && make backend Copy the built site: cp -r ./ui/build ./site Run the backend locally using demo data: FAKE_RUNTIME_SCANNER=true DATABASE_DRIVER=LOCAL FAKE_DATA=true ENABLE_DB_INFO_LOGS=true ./backend/bin/backend run Open KubeClarity UI in the browser: http://localhost:8080/ CLI KubeClarity includes a CLI that can be run locally and especially useful for CI/CD pipelines. It allows to analyze images and directories to generate SBOM, and scan it for vulnerabilities. The results can be exported to KubeClarity backend. Binary Distribution Download the release distribution for your OS from the releases page

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Type of phishing attacks with examples

https://cdn-images-1.medium.com/max/1200/1*wBa_HTQI9-n8QVPfpxXftA.jpeg
Hello buddies, I’m here with another handy tutorial and in this tutorial you will learn the most common phishing attacks which hackers use…

Continue reading on Block Magnates »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Nedir? Hacker Türleri | Siber Suç

https://cdn-images-1.medium.com/max/1024/1*mnFH1K4c-5DZmTM26Jzytw.jpeg
Hack Nedir?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is a Riskware?

https://cdn-images-1.medium.com/max/2600/1*pRW8vDVeVurwIk-bT2sTOw.jpeg
Riskware is software that is both lawful and illegitimate and is vulnerable to cyber-attacks. Riskware is not always intended to be…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OpenVAS docker container setup (Working 2022, all NVTs)

https://cdn-images-1.medium.com/max/886/1*4SRXO3sovj8oJX7HzlQtOg.png
I needed to scan a lot of IPs with OpenVAS for an assignment and it proved to be a very painful experience.

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
the real hardest part of hacking: getting a phishing link through the fucking gmail spam filters

i use link shorteners, html, carefully edit and dissect the email so it looks real, yet the google spam filters catch it every time

The mass mailer attack for SET is useless to me for this exact reason also. Am i supposed to use proxies with that thing or something?

Please teach me your ways, phishing masters.

submitted by /u/osint_god
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a specific website where script kiddies get their code from?

I am studying Cybersecurity and I know a big part of it is how to find things on the internet

submitted by /u/BasisPrimary4028
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Kubeclarity - Tool For Detection And Management Of Software Bill Of Materials (SBOM) And Vulnerabilities Of Container Images And Filesystems

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
SysWhispers3 : AV/EDR Evasion Via Direct System Calls

SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. Why on earth didn’t I create a PR to SysWhispers2?The reason for SysWhispers3 to be a standalone version are many, but the most important are:

* SysWhispers3 is the de-facto “fork” used by Inceptor, and implements some utils class which are not relevant to the original version of the tool.
* SysWhispers2 is moving towards supporting NASM compilation (for gcc/mingw), while this version is specifically designed and tested to support MSVC (because Inceptor will stay a Windows-only framework for the near future).
* SysWhispers3 contains partially implemented features (such as egg-hunting) which would not be sensible to include in the original version of the tool. Differences with SysWhispers2The usage is pretty similar to SysWhispers2, with the following exceptions:

* It also supports x86/WoW64
* It supports syscalls instruction replacement with an EGG (to be dynamically replaced)
* It supports direct jumps to syscalls in x86/x64 mode (in WOW64 it’s almost standard)
* It supports direct jumps to random syscalls (borrowing @ElephantSeal’s idea)

A better explanation of these features are better outlined i the blog post SysWhispers is dead, long live SysWhispers! IntroductionSecurity products, such as AVs and EDRs, usually place hooks in user-mode API functions to analyse a program execution flow, in order to detect potentially malicious activities.

SysWhispers2 is a tool designed to generate header/ASM pairs for any system call in the core kernel image (ntoskrnl.exe), which can then be integrated and called directly from C/C++ code, evading user-lands hooks.

The tool, however, generates some patters which can be included in signatures, or behaviour which can be detected at runtime.

SysWhispers3 is built on top of SysWhispers2, and integrates some helpful features to bypass these forms of detection. InstallationC:> git clone https://github.com/klezVirus/SysWhispers3.git
C:> cd SysWhispers3
C:> python .\syswhispers.py –help Usage and ExamplesThe help shows all the available commands and features of the tool:

C:>python syswhispers.py -h
usage: syswhispers.py [-h] [-p PRESET] [-a {x86,x64}] [-m {embedded,egg_hunter,jumper,jumper_randomized}] [-f FUNCTIONS] -o OUT_FILE [–int2eh] [–wow64] [-v] [-d]
SysWhispers3 – SysWhispers on steroids
optional arguments:
-h, –help show this help message and exit
-p PRESET, –preset PRESET
Preset (“all”, “common”)
-a {x86,x64}, –arch {x86,x64}
Architecture
-c {msvc,mingw,all}, –compiler {msvc,mingw,all}
Compiler
-m {embedded,egg_hunter,jumper,jumper_randomized}, –method {embedded,egg_hunter,jumper,jumper_randomized}
Syscall recovery method
-f FUNCTIONS, –functions FUNCTIONS
Comma-separated functions
-o OUT_FILE, –out-file OUT_FILE
Output basename (w/o extension)
–int2eh Use the old int 2ehinstruction in place of syscall–wow64 Use Wow64 to run x86 on x64 (only usable with x86 architecture)
-v, –verbose Enable debug output
-d, –debug Enable syscall debug (insert software breakpoint) Command LinesStandard SysWhispers, embedded system calls (x64)Export all functions with compatibility for all supported Windows versions (see example-output/).
py .\syswhispers.py –preset all -o syscalls_all
Export just the common functions (see below for list).
py .\syswhispers.py –preset common -o syscalls_common
Export NtProtectVirtualMemory and NtWriteVirtualMemory with compatibility for all versions.
py .\syswhispers.py –functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem SysWhispers3-only samplesNormal SysWhispers, 32-bits mode
py .\syswhispers.py –preset all -o syscalls_all -m jumper –arch x86
Normal SysWhispers, using WOW64 in 32-bits mode (only specific fun[...]

___________________________
@hacking_Attack
@Hacking_Video