PyConUS'22 talk (https://www.youtube.com/watch?v=Rcuqn56uCDk) and slides (https://speakerdeck.com/ashishbijlani/pyconus22-slides). BlackHAT Asia'22 Arsenal presentation (https://www.blackhat.com/asia-22/arsenal/schedule/#mitigating-open-source-software-supply-chain-attacks-26241) PackagingCon'21 talk (https://www.youtube.com/watch?v=PHfN-NrUCoo) and slides (https://speakerdeck.com/ashishbijlani/mitigating-open-source-software-supply-chain-attacks) Academic dissertation (https://cyfi.ece.gatech.edu/publications/DUAN-DISSERTATION-2019.pdf) on open-source software security and the paper (https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1B-1_23055_paper.pdf) from our group at Georgia Tech that started this research. Upcoming talks BlackHat USA'22 Arsenal talk Detecting typo-squatting, backdoored, abandoned, and other "risky" open-source packages using Packj (https://www.blackhat.com/us-22/arsenal/schedule/#detecting-typo-squatting-backdoored-abandoned-and-other-risky-open-source-packages-using-packj-28075) Open Source Summit, Europe'22 talk Scoring dependencies to detect “weak links” in your open-source software supply chain (https://osseu2022.sched.com/overview/type/SupplyChainSecurityCon) Feature roadmap Add support for other language ecosystems. Rust is a work in progress, and will be available in July '22 (last week). Add functionality to detect several other "risky" code as well as metadata attributes. Packj currently only performs static code analysis, we are working on adding support for dynamic analysis (https://www.kitploit.com/search/label/Dynamic%20Analysis) (WIP, ETA: end of summer) Team Packj has been developed by Cybersecurity researchers at Ossillate Inc. (https://ossillate.com/team) and external collaborators to help developers mitigate risks of supply chain attacks when sourcing untrusted third-party open-source software dependencies. We thank our developers and collaborators. We welcome code contributions. Join our discord community (https://discord.gg/8hx3yEtF) for discussion and feature requests. FAQ What Package Managers (Registries) are supported? Packj can currently vet NPM, PyPI, and RubyGems packages for "risky" attributes. We are adding support for Rust. Does it work on obfuscated calls? For example, a base 64 encrypted string that gets decrypted and then passed to a shell? This is a very common malicious behavior. Packj detects code obfuscation as well as spawning of shell commands (exec system call). For example, Packj can flag use of getattr() and eval() API as they indicate "runtime code generation"; a developer can go and take a deeper look then. See main.py (https://github.com/ossillate-inc/packj/blob/main/main.py#L486) for details. Does this work at the system call level, where it would detect e.g. any attempt to open ~/.aws/credentials, or does it rely on heuristic analysis of the code itself, which will always be able to be "coded around" by the malware authors? Packj currently uses static code analysis to derive permissions (e.g., file/network accesses). Therefore, it can detect open() calls if used by the malware directly (e.g., not obfuscated in a base64 encoded string). But, Packj can also point out such base64 decode calls. Fortunately, malware has to use these APIs (read, open, decode, eval, etc.) for their functionality -- there's no getting around. Having said that, a sophisticated malware can hide itself better, so dynamic analysis must be performed for completeness. We are incorporating strace-based dynamic analysis (containerized) to collect system calls. See roadmap (https://github.com/ossillate-inc/packj#feature-roadmap) for details.

Download Packj (https://github.com/ossillate-inc/packj)

___________________________
@hacking_Attack
@Hacking_Video

How do attackers leverage routers ?
https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/

If an attacker compromises your router with lots of devices connected and has ssh access to your router. How can he benefit from this ? submitted by /u/Due-Mycologist1279 (https://www.reddit.com/user/Due-Mycologist1279)
[link] (https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/) [comments] (https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/)

___________________________
@hacking_Attack
@Hacking_Video

Enhancing Subdomain Enumeration — ENTs and NOERROR
https://medium.com/sse-blog/enhancing-subdomain-enumeration-ents-and-noerror-69a0479b7a3d?source=rss------bug_bounty-5

Identifying subdomains more reliably by checking DNS status codes and empty nodesContinue reading on SSE Blog » (https://medium.com/sse-blog/enhancing-subdomain-enumeration-ents-and-noerror-69a0479b7a3d?source=rss------bug_bounty-5)

sql injection
https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/

<!-- SC_OFF -->Hello, someone can explain to me how a prepared statement prevent on sql injection i dont really understand well <!-- SC_ON --> submitted by /u/Objective_Fruit_5995 (https://www.reddit.com/user/Objective_Fruit_5995)
[link] (https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/) [comments] (https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/)

403 Forbidden Bypass Leading to Admin Endpoint Access.
https://medium.com/@engrdrayc/403-forbidden-bypass-leading-to-admin-endpoint-access-b696a36665ed?source=rss------bug_bounty-5

Hi everyone! This is my first write-up, pardon me for any mistakes. I’ll share my tip with everyone how I was able to bypass a 403…Continue reading on Medium » (https://medium.com/@engrdrayc/403-forbidden-bypass-leading-to-admin-endpoint-access-b696a36665ed?source=rss------bug_bounty-5)

403 Forbidden Bypass Leading to Admin Endpoint Access.

Hi everyone! This is my first write-up, pardon me for any mistakes. I’ll share my tip with everyone how I was able to bypass a 403…Continue reading on Medium »
Read more...

Exchange/Azure AD pen testing resources. Any tips or good articles about this?
https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/

submitted by /u/One_Appeal_4080 (https://www.reddit.com/user/One_Appeal_4080)
[link] (https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/) [comments] (https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/)

___________________________
@hacking_Attack
@Hacking_Video

Email Confirmation bypass at Instagram

This story is all about a logical vulnerability which helped me in Bypassing the email confirmation process and adding any arbitrary…Continue reading on Medium »
Read more...

Email Confirmation bypass at Instagram
https://medium.com/@avinash_/email-confirmation-bypass-at-instagram-cc968f9a126?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This story is all about a logical vulnerability which helped me in Bypassing the email confirmation process and adding any arbitrary…Continue reading on Medium » (https://medium.com/@avinash_/email-confirmation-bypass-at-instagram-cc968f9a126?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pentesting Course recommendation
https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/

Looking for recommendations on formal Pentesting courses, either instructor led in person or online. I am completing my development plan for the next 12 months and looking at the best courses for beginners. I have done the EC-Council Ethical Hacker course which I enjoyed and see they do a Pentesting one also. submitted by /u/cb24nz (https://www.reddit.com/user/cb24nz)
[link] (https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/) [comments] (https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/)

___________________________
@hacking_Attack
@Hacking_Video

Defeat the HttpOnly flag to achieve Account Takeover | RXSS

Hello folks, I’m Mohamed Tarek aka Timooon at Bugcrowd and HackerOne, In this write up I will explain how I get the victim’s session when…Continue reading on Medium »
Read more...

Defeat the HttpOnly flag to achieve Account Takeover | RXSS
https://medium.com/@mohamedtarekq/defeat-the-httponly-flag-to-achieve-account-takeover-rxss-c16849d3d192?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello folks, I’m Mohamed Tarek aka Timooon at Bugcrowd and HackerOne, In this write up I will explain how I get the victim’s session when…Continue reading on Medium » (https://medium.com/@mohamedtarekq/defeat-the-httponly-flag-to-achieve-account-takeover-rxss-c16849d3d192?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video