Kali Linux Tutorials
SaaS security: Achieving a clean IAM System Audit

Identity and access management (IAM) is a set of regulations, which make it easier to oversee electronic or digital identities. It is essentially the basis of Cloud Identity Governance for SaaS and IaaS environments

To ensure that these online identities are effectively managed, modern automated Cloud Identity Governance solutions exist as part of Cloud Infrastructure Entitlements Management solutions.

These solutions monitor IAM identities in real-time and report their existence as well as rights and access metrics to the organization. Risks are highlighted and reported to the organization on a central dashboard, granting the organization’s security specialists comprehensive insights into the health and safety of their IAM identities.

The auditability of SaaS environments greatly relies on the development and meticulous execution of policies and procedures relating to the organization’s SaaS environment. We have compiled a generic concise list of best practices that can be followed to improve an organization’s ability to achieve a clean SaaS IAM audit. Developing a Comprehensive Security PolicyAll roles must be properly defined in the approved policy for complex SaaS implementations. The organization will derive benefit from defining roles for each type of employee and service that requires involvement with the organization’s SaaS environment.

Employees and their roles and duties should be explicitly listed in procedure and policy documentation. It should additionally prescribe estimated timeframes for conducting predefined SaaS tasks utilizing IAM. Finally, policies must quantify cyber threats while also finding dependencies and any remedial processes involved. Real-Time Account RegulationStaff turnover is an unavoidable aspect of any organization. This employee movement poses a problem in terms of IAM user permissions. If this movement is not addressed promptly, updating roles and rights on IAM will become problematic.

Monitoring user access in real-time is an excellent way to guarantee that staff has the proper rights. The goal of these audits would be to decide who still requires access to SaaS services and which accounts need to be truncated. Applying Least Privilege ParadigmThis may seem clear but giving users only the rights, they need is the core of IAM. The Least Privilege concept is characteristic of IAM because the cloud environment is started as a “deny all” environment. Users should be granted explicit access to just particular resources. The temptation to grant users access to everything should be avoided at all costs, suggesting that users should only be allowed to conduct their tasks.

When users are granted temporary special permissions that are not removed, problems arise. As a result, multiple individuals on the network may have unique rights that the stakeholders are unaware of, expanding the overall SaaS attack surface. Administrative SegregationAn organization may need more IAM accounts on occasion. These accounts are often used by a new member or service that is added to the cloud environment. When it comes to rights and roles, these accounts should never be granted any unnecessary administrative rights. Strong passwords should be always used to protect these new accounts until they are used by the intended employee or service. Administrative segregation should be a standard across all SaaS online Identities. Generic and Unused accountsIt is best practice to keep the IAM system uncluttered by removing old user accounts that are no longer in use. These inactive, guest, or template accounts, pose a significant cyber security risk to the organization. Threat actors may compromise one of these inactive accounts and use it to gain access to a SaaS platform. Documentation and Policy upkeepWithout concise direction provided b[...]

y policies, Cloud Identity Governance, especially in larger IaaS and SaaS ecosystems, would be static and possibly become outdated. An important part of Cloud Identity Governance is to update and evolve the governing policies as the cloud environments they govern, evolve. The governing policy should always address the current state of the SaaS environment. In ConclusionWhile IAM identities may have many factors that impact the overall security risk, following the steps mentioned in this article will greatly aid an organization, not only reducing its attack surface but also meeting regulatory compliance standards. Additionally, having a trusted monitoring partner in the industry will allow an organization to effectively manage their IAM footprint, in real-time, and by extension their SaaS attack surface.

The 10th Anniversary Edition - Cobalt Strike Research and Development
https://www.reddit.com/r/redteamsec/comments/wrr8v0/the_10th_anniversary_edition_cobalt_strike/

submitted by /u/billymeter (https://www.reddit.com/user/billymeter)
[link] (https://www.cobaltstrike.com/blog/cobalt-strike-4-7-the-10th-anniversary-edition/) [comments] (https://www.reddit.com/r/redteamsec/comments/wrr8v0/the_10th_anniversary_edition_cobalt_strike/)

KitPloit - PenTest Tools!
Ropr - A Blazing Fast Multithreaded ROP Gadget Finder. Ropper / Ropgadget Alternative

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEji6YzaI3MnIZRNHTeyYNa54o5oIC3kbtO29ov1px5pSfQg8mgEwqK-3aB2bqVQlBr3dGGCa69dblJpjFQ9LJQBfIVM_w4NfLhKv_PhpOaJIYGwaDkQhErX8LBVZg8Zp30R0VFD2w7-j0AAMIP4zksEtRCMTCiVSS6IPK32cA4caq1psmfKOEloYC64/w640-h452/ropr.png ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget?ROP (Return Oriented Programming) Gadgets are small snippets of a few assembly instructions typically ending in a retinstruction which already exist as executable code within each binary or library. These gadgets may be used for binary exploitation and to subvert vulnerable executables.

When the addresses of many ROP Gadgets are written into a buffer we have formed a ROP Chain. If an attacker can move the stack pointer into this ROP Chain then control can be completely transferred to the attacker.

Most executables contain enough gadgets to write a turing-complete ROP Chain. For those that don't, one can always use dynamic libraries contained in the same address-space such as libc once we know their addresses.

The beauty of using ROP Gadgets is that no new executable code needs to be written anywhere - an attacker may achieve their objective using only the code that already exists in the program. How do I use a ROP Gadget?Typically the first requirement to use ROP Gadgets is to have a place to write your ROP Chain - this can be any readable buffer. Simply write the addresses of each gadget you would like to use into this buffer. If the buffer is too small there may not be enough room to write a long ROP Chain into and so an attacker should be careful to craft their ROP Chain to be efficient enough to fit into the space available.

The next requirement is to be able to control the stack - This can take the form of a stack overflow - which allows the ROP Chain to be written directly under the stack pointer, or a "stack pivot" - which is usually a single gadget which moves the stack pointer to the rest of the ROP Chain.

Once the stack pointer is at the start of your ROP Chain, the next retinstruction will trigger the gadgets to be excuted in sequence - each using the next as its return address on its own stack frame.

It is also possible to add function poitners into a ROP Chain - taking care that function arguments be supplied after the next element of the ROP Chain. This is typically combined with a "pop gadget", which pops the arguments off the stack in order to smoothly transition to the next gadget after the function arguments. How do I install ropr?* Requires cargo (the rust build system)

Easy install: cargo install ropr the application will install to ~/.cargo/binFrom source: git clone https://github.com/Ben-Lichtman/ropr
cd ropr
cargo build --release the resulting binary will be located in target/release/roprAlternatively: git clone https://github.com/Ben-Lichtman/ropr
cd ropr
cargo install --path . the application will install to ~/.cargo/binHow do I use ropr?For example if I was looking for a way to fill raxwith a value from another register I may choose to filter by the regex ^mov eax, ...;:
Now I can add some filters to the command line for the highest quality results:
Now I have a good movgadget candidate at address 0x00052252Download Ropr➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Polar Flow Android 5.7.1 Secret Disclosure

https://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png
Polar Flow for Android version 5.7.1 stores the username and password in clear text in a file on mobile devices.

SHA-256 | 534a0fb256871c4890c13c7c9eff7a99819ffd05819971ead460bbca15cc9fb0

Download
# Trovent Security Advisory 2110-01 #
#####################################
Insecure data storage in Polar Flow Android application
#######################################################
Overview
########

Advisory ID: TRSA-2110-01
Advisory version: 1.0
Advisory status: Public
Advisory URL: https://trovent.io/security-advisory-2110-01
Affected product: Polar Flow Android mobile application (fi.polar.polarflow)
Affected version: 5.7.1
Vendor: Polar Electro, https://flow.polar.com
Credits: Trovent Security GmbH, Karima Hebbal
Detailed description
####################

The Polar Flow app is a sports, fitness and activity analyzer which allows to plan
and monitor training, daily activity and sleep.
Trovent Security GmbH discovered that the application stores the username and
password in clear text in a file on the mobile device.

Severity: Medium
CVSS Score: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVE ID: N/A
CWE ID: CWE-312
Proof of concept
################

Content of the file /data/data/fi.polar.polarflow/shared_prefs/UserData3.xml:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
FreeBSD 13.0 aio_aqueue Kernel Refcount Local Privilege Escalation

___________________________
@hacking_Attack
@Hacking_Video

inAppBrowser.com
https://www.reddit.com/r/Pentesting/comments/ws1u2m/inappbrowsercom/

submitted by /u/KwaiChangCain (https://www.reddit.com/user/KwaiChangCain)
[link] (https://inappbrowser.com/) [comments] (https://www.reddit.com/r/Pentesting/comments/ws1u2m/inappbrowsercom/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Researchers Hacked SpaceX Operated Starlink Satellite Using $25 Modchip

https://external-preview.redd.it/tIcdh7rJveIgW4uTnPYWALoNi8hV_pluv1fi12V2doU.jpg?width=640&crop=smart&auto=webp&s=6e1d66da4c412a2c4f9c31f3f09f0bfa170ad632 submitted by /u/TheNextLemaitre
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/TimeDescription2641
[link] [comments]

hacking: security in practice
How do people make coupon generators?

Just wondering, came across few people who literally made coupon/voucher/giftcode generators for different websites and gotta say, I’m so much interested in knowing how they figured out the algorithm for a valid code 😳

submitted by /u/UK363
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I’m a noob/retard. Can someone recommend the best RFID reader?

I’m in UK. Not sure where is the best place to shop, Amazon (look quite shit) or DW?

submitted by /u/coolaszerokelvin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Any recent data leaks?

Got logged out of my google account and once i logged back in and changed my password, it emailed me saying my account has been in a non-google data leak (yes it's real not a phising site)

They didn't even tell me what site, how am i supposed to tell what password im supposed to change, if im not allowed to know, so any data leaks like a few minutes ago?

submitted by /u/BullWorst
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Which Security Bugs Will Be Exploited? Researchers Create an ML Model to Find Out

How critical is that vulnerability? University researchers are improving predictions of which software flaws will end up with an exploit, a boon for prioritizing patches and estimating risk.

Dark Reading: Attacks/Breaches
5 Russia-Linked Groups Target Ukraine in Cyberwar

Information on the attributed cyberattacks conducted since the beginning of the Russia-Ukraine war shows that a handful of groups conducted more than two dozen attacks.

Dark Reading: Attacks/Breaches
Mac Attack: North Korea's Lazarus APT Targets Apple's M1 Chip

Lazarus continues to expand an aggressive, ongoing spy campaign, using fake Coinbase job openings to lure in victims.

Hacking on Medium
Steel Mountain TryHackMe

https://cdn-images-1.medium.com/max/600/0*Xk9_ex7KNUferZeT.jpeg
TryHackMe Room:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video