Hacking on Medium
Build a DNS Zone Transfer Software Security Testing Toolkit With Python

https://cdn-images-1.medium.com/max/2000/0*VI_Xpp37IK7aGSi4
Python and DNS Zone Transfers

Continue reading on Better Programming »

LambdaGuard - AWS Serverless Security
http://www.kitploit.com/2022/06/lambdaguard-aws-serverless-security.html

 
AWS Lambda is an event-driven, serverless (https://www.kitploit.com/search/label/Serverless) computing platform provided by Amazon (https://www.kitploit.com/search/label/Amazon) Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code. LambdaGuard is an AWS Lambda auditing (https://www.kitploit.com/search/label/Auditing) tool designed to create asset visibility (https://www.kitploit.com/search/label/Visibility) and provide actionable results. It provides a meaningful overview in terms of statistical analysis, AWS service dependencies and configuration checks from the security perspective.
Requirements Python 3.6+ Java 11 (optional for SonarQube) Install From PyPI pip3 install lambdaguard
From Github git clone https://github.com/Skyscanner/lambdaguard
cd lambdaguard
sudo make install
AWS Access You will need a set of AWS access (https://www.kitploit.com/search/label/Access) keys and permissions to run LambdaGuard. make aws
Create a profile in ~/.aws/credentials with the newly created keys. [LambdaGuardProfile]
aws_access_key_id = ...
aws_secret_access_key = ...
Alternatively, you can use the keys directly as CLI arguments (not recommended). Run lambdaguard --help lambdaguard --function arn:aws:lambda:function lambdaguard --input function-arns.txt lambdaguard --output /tmp/lambdaguard lambdaguard --profile LambdaGuardProfile lambdaguard --keys ACCESS_KEY_ID SECRET_ACCESS_KEY lambdaguard --region eu-west-1 lambdaguard --verbose SonarQube: Static Code Analysis Download sonar-scanner-cli https://github.com/SonarSource/sonar-scanner-cli Build SonarQube make sonarqube Use SonarQube lambdaguard --sonarqube config.json Config should have the following format: {
"command": "sonar-scanner -X",
"url": "http://localhost:9000",
"login": "admin",
"password": "admin"
} Development make -B clean
make dev
. dev/bin/activate
make install-dev
make test


Download LambdaGuard (https://github.com/Skyscanner/LambdaGuard)

KitPloit - PenTest Tools!
LambdaGuard - AWS Serverless Security

https://blogger.googleusercontent.com/img/a/AVvXsEivJEVrS2dhDjNMnyp8j9yqwQ_Lzat1288-6PctnOURF_xsSjDxpWy10FqVo8Fmo0u3SNMXrVT1gvRT4hs8ceG6cnqFTSHlf_cD4qwOwWuYrAqKQE7WX76lj1VR11KhSlzVhsswt0sh2aGHlg-f2eOaQCvPsfoR64y2f6iSzqjNbnhnMNOLIMWIzpO2=s16000
AWS Lambda is an event-driven, serverless computing platform provided by Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code.

LambdaGuard is an AWS Lambda auditing tool designed to create asset visibility and provide actionable results. It provides a meaningful overview in terms of statistical analysis, AWS service dependencies and configuration checks from the security perspective.
Requirements

* Python 3.6+
* Java 11 (optional for SonarQube)

Install

From PyPI

pip3 install lambdaguard


From Github

git clone https://github.com/Skyscanner/lambdaguard
cd lambdaguard
sudo make install


AWS Access

You will need a set of AWS access keys and permissions to run LambdaGuard.

make aws


Create a profile in ~/.aws/credentialswith the newly created keys.

[LambdaGuardProfile]
aws_access_key_id = ...
aws_secret_access_key = ...


Alternatively, you can use the keys directly as CLI arguments (not recommended).

Run

* lambdaguard --help
* lambdaguard --function arn:aws:lambda:function
* lambdaguard --input function-arns.txt
* lambdaguard --output /tmp/lambdaguard
* lambdaguard --profile LambdaGuardProfile
* lambdaguard --keys ACCESS_KEY_ID SECRET_ACCESS_KEY
* lambdaguard --region eu-west-1
* lambdaguard --verbose

SonarQube: Static Code Analysis

Download sonar-scanner-cli

* https://github.com/SonarSource/sonar-scanner-cli

Build SonarQube

* make sonarqube

Use SonarQube

* lambdaguard --sonarqube config.json

Config should have the following format:

{
"command": "sonar-scanner -X",
"url": "http://localhost:9000",
"login": "admin",
"password": "admin"
}

Development

make -B clean
make dev
. dev/bin/activate
make install-dev
make test

Download LambdaGuard

NO RATE LIMIT IN JUST 5 MIN
https://medium.com/@milanjain7906/no-rate-limit-in-just-5-min-222abde54004?source=rss------bug_bounty-5

Hii all my name is Milan jain and i am a bug bounty hunter !! recently i got 250$ bounty .but before 1 month ago i got my first Hall of…Continue reading on Medium » (https://medium.com/@milanjain7906/no-rate-limit-in-just-5-min-222abde54004?source=rss------bug_bounty-5)

Fuzzing With Custom Wordlists
https://medium.com/@vamshivaran110/fuzzing-with-custom-wordlists-bb7a808d943f?source=rss------bug_bounty-5

Hello HackersContinue reading on Medium » (https://medium.com/@vamshivaran110/fuzzing-with-custom-wordlists-bb7a808d943f?source=rss------bug_bounty-5)

NO RATE LIMIT IN JUST 5 MIN

Hii all my name is Milan jain and i am a bug bounty hunter !! recently i got 250$ bounty .but before 1 month ago i got my first Hall of…Continue reading on Medium »
Read more...

Fuzzing With Custom Wordlists

Hello HackersContinue reading on Medium »
Read more...

hacking: security in practice
I have a question Is there a way to scan a website Using AWS or any other services using nmap.

submitted by /u/Beginning-Ad5714
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

hacking: security in practice
I have a question Is there a way to scan a website Using AWS or any other services using nmap.

submitted by /u/Beginning-Ad5714
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

https://b.thumbs.redditmedia.com/VugPvPOwqnRo0C88NbFP629XRLyE9pNBeQsXawhaFnw.jpg submitted by /u/Cu_fola
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

hacking: security in practice
My Instagram is Getting Hacked by Pakistani Propaganda

Since March, my Instagram will post images like this.

No 3rd party app is connected.

My 2-factor authentication is never triggered.

I once got a notification that there was a log-in in Pakistan.

This has happened like 5 times now. What the hell do I do?

submitted by /u/Travelpickleball
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

hacking: security in practice
F*cking money

I need to start earning >= 1000$/month(It's pretty good money in my country) within a year and a half(doesn't matter why)

Before discovering bug bounty programs I already had a little experience in hacking(and relatively a lot of experience in programming). When I started learning hacking I was very interested and didn't even think about money.

When I found out about bug bounty programs(on hackerone) I thought that It's a good opportunity to earn that amount of money(I know that It's almost impossible to become a millionaire, but 1000$ is a realistic goal, I think)

Money has become a very big part of my motivation. I lost my curiousity and everything I loved about hacking.

I believe that if I hadn't thought about money and just learnt hacking, it would probably come much faster. But I also doubt if I could make that amount of money within a year and a half and what's better: learning hacking now and trying to earn money or focusing on studying at school/university and then getting a job and thinking of hacking only as a hobby.

Is it a realistic goal to start earning 1000$/month within a year and a half if I spend about 2-3 hours(I can more, but I think I'll burn out) on hacking every day and how to get my love of hacking back???

submitted by /u/neirufiyu
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

Kali Linux Tutorials
Dora : Find Exposed API Keys Based On RegEx And Get Exploitation Methods

Dora, a tool to Find Exposed API Keys Based On RegEx And Get Exploitation Methods For Some Of Keys That Are Found

Features

* Blazing fast as we are using ripgrepin backend
* Exploit/PoC steps for many of the API key, allowing to write a good report for bug bounty hunting
* Unlike many other API key finders, doraalso shows the path to the file and the line with context for easier analysis
* Can easily be implemented into scripts. See Example Use Cases

Installation

Make sure to install ripgrep

clone the repo
git clone https://github.com/sdushantha/dora.git
change the working directory to sherlock
cd dora
install dora
python3 setup.py install –user

Usage

$ dora –help
usage: dora [options]
positional arguments:
PATH Path to directory or file to scan
optional arguments:
-h, –help show this help message and exit
–rg-path RG_PATH Specify path to ripgrep
–rg-arguments RG_ARGUMENTS
Arguments you want to provide to ripgrep
–json JSON Load regex data from a valid JSON file (default: db/data.json)
–verbose, -v, –debug, -d
Display extra debugging information
–no-color Don’t show color in terminal output

Example Use Cases

* Decompile an APK using apktooland run dorato find exposed API keys
* Scan GitHub repos by cloning it and allowing dorato scan it
* While scraping sites, run dorato scan for API keys
Download