Kali Linux Tutorials
Monkey365 – Tool For Security Consultants Microsoft 365

Monkey365 is an Open Source security tool that can be used to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews without the significant overhead of learning tool APIs or complex admin panels from the start. To help with this effort, Monkey365 also provides several ways to identify security gaps in the desired tenant setup and configuration. Monkey365 provides valuable recommendations on how to best configure those settings to get the most out of your Microsoft 365 tenant or Azure subscription. IntroductionMonkey365 is a plugin-based PowerShell module that can be used to review the security posture of your cloud environment. With Monkey365 you can scan for potential misconfigurations and security issues in public cloud accounts according to security best practices and compliance standards, across Azure, Azure AD, and Microsoft365 core applications. InstallationYou can either download the latest zip by clicking this link or download Monkey365 by cloning the repository:

Once downloaded, you must extract the file and extract the files to a suitable directory. Once you have unzipped the zip file, you can use the PowerShell V3 Unblock-File cmdlet to unblock files:
Get-ChildItem -Recurse c:\monkey365 | Unblock-File
Once you have installed the monkey365 module on your system, you will likely want to import the module with the Import-Module cmdlet. Assuming that Monkey365 is located in the PSModulePath, PowerShell would load monkey365 into active memory:
Import-Module monkey365
If Monkey365 is not located on a PSModulePathpath, you can use an explicit path to import:
Import-Module C:\temp\monkey365
You can also use the Forceparameter in case you want to reimport the Monkey365 module into the same session
Import-Module C:\temp\monkey365 -Force Basic UsageThe following command will provide the list of available command line options:
Get-Help Invoke-Monkey365
To get a list of examples use:
Get-Help Invoke-Monkey365 -Examples
To get a list of all options and examples with detailed info use:
Get-Help Invoke-Monkey365 -Detailed
The following example will retrieve data and metadata from Azure AD and SharePoint Online and then print results. If credentials are not supplied, Monkey365 will prompt for credentials.
$param = @{
Instance = 'Microsoft365';
Analysis = 'SharePointOnline';
PromptBehavior = 'SelectAccount';
IncludeAzureActiveDirectory = $true;
ExportTo = 'PRINT';
}
$assets = Invoke-Monkey365 @param Regulatory Compliance ChecksMonkey365 helps streamline the process of performing not only Microsoft 365, but also Azure subscriptions and Azure Active Directory Security Reviews.

160+ checks covering industry defined security best practices for Microsoft 365, Azure and Azure Active Directory.

Monkey365 will help consultants to assess cloud environment and to analyze the risk factors according to controls and best practices. The report will contain structured data for quick checking and verification of the results.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjq8Ik1Wy3qXRDAswya_jkoFltxsXt8hdJ9kt-NaUJZwysKPfLXCMB3GaKkUjZOgE-niLBLyH0ptaYHJrtaykgZfDm3Qd3jWgXlgZAPWlURNuU3LWt3aKdkIkn8EeXBoE3pPt1OJVZtHkfVEp6Z6cRiK1Qlk_p5ol355cQZc1k4L0wtwC3bLf0Xat8r/s2521/Monkey365(1).png Supported StandardsBy default, the HTML report shows you the CIS (Center for Internet Security) Benchmark. The CIS Benchmarks for Azure and Microsoft 365 are guidelines for security and compliance best practices.

The following standards are supported by Monkey365:

* CIS Microsoft Azure Foundations Benchmark v1.4.0
* CIS Microsoft 365 Foundations Benchmark v1.4.0

More standards will be added in next releases (NIST, HIPAA, GDPR, PCI-DSS, etc..) as they are available.

Additional information such as Installation or advanced usage can be found in the following link Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Pool on the roof - October 17, 2022

Have a no0b question? New to hacking? Looking for a script? Need help with your github project? Something wrong with your payload? Stuck on a CTF or bug bounty?

This is a weekly recurring post to make friends with other hackers, ask questions, and get any type of help you may need.

Make sure to read our wiki as it's full of resources for you.

Keep all beginner questions in this weekly stickied post.

submitted by /u/AutoModerator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How difficult it is to penetrate ethical hacking jobs without college degree?

Do you really really have to be good if you don't have one?

submitted by /u/Peasant_hacking
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Compiling pyinstaller bootloader with C/C++

I am working on a project and I was told that I should compile pyinstaller with C/C++. I am not sure how it can be done, hence I’m here. Any tips or recommendations would be appreciated. ✌️

submitted by /u/dilshodakim
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
JSubFinder - Searches Webpages For Javascript And Analyzes Them For Hidden Subdomains And Secrets

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
PicoCTF picoGym Practice Challenges | Crackme-py

https://cdn-images-1.medium.com/max/1200/1*9hD93kEUkJu_jcAl6TNs1g.jpeg
WHAT

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Reverse Engineering Function Call in C and Exploiting it

https://cdn-images-1.medium.com/max/717/1*cIS2KWpDmG0LOeI1Qe5n2w.png
Binary Exploitation

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Zimbra lanza parche para vulnerabilidad explotada activamente en su suite de colaboración

https://cdn-images-1.medium.com/max/1700/0*6Tm8wqQxMwueMfTs
Zimbra ha lanzado parches para contener una falla de seguridad explotada activamente en su suite de colaboración empresarial que podría…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Android Save Game Reverse Engineering : ถอดรหัส save game ใน Android ภาค 2

https://cdn-images-1.medium.com/max/911/1*DT3IBfO9tRKsF6HUOi_tDA.png
เดี๋ยว ๆ ๆ หลงเข้ามาใช่ไหมมมม ไปอ่านภาค 1 กันก่อนได้ ที่ Android Save Game Reverse Engineering [ถอดรหัส Save เกมใน Android] | by Comdet…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OverTheWire Wargames: Bandit L01

https://cdn-images-1.medium.com/max/2600/1*dfT4JSiPjdi62GuLax75eQ.jpeg
Bandit Level 1 write-up

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking the GNOME Shell — Create Extensions

https://cdn-images-1.medium.com/max/1920/1*vgvdF6ASvQutBMobFjFtww.png
Creating your own GNOME Shell extension (GSE) is straight forward. Simply follow the official guide and you’ll have a working GSE with…

Continue reading on ITNEXT »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I Hacked my Crush’s school !

https://cdn-images-1.medium.com/max/600/1*KpWjj8JnCAwvNhqkOvnlGA.gif
How I got access of my Crush’s School’s Website’s Admin panel

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Web pentesting help
https://www.reddit.com/r/Pentesting/comments/y6irm1/web_pentesting_help/

I am new to web and I have a situation and unsure of what I can do with it. I have a web iis 7.5 server with default config running. It allows me to get and post data with x encoded url format. Unsure of how I can leverage this to grab data from the server itself and the internet hasn't been helpful. submitted by /u/Upstairs_Lie_9379 (https://www.reddit.com/user/Upstairs_Lie_9379)
[link] (https://www.reddit.com/r/Pentesting/comments/y6irm1/web_pentesting_help/) [comments] (https://www.reddit.com/r/Pentesting/comments/y6irm1/web_pentesting_help/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The Risk of Stateful Anti-Patterns in Enterprise Internet Architecture

Excessive statefulness hurts the ability to scale networks, applications, and ancillary supporting infrastructure, thus affecting an entire service delivery chain's ability to withstand a DDoS attack.

Dark Reading: Attacks/Breaches
Signal to Ditch SMS/MMS Messaging on Android

Main driver for the change: "Plaintext SMS messages are inherently insecure."