r
* Conan
* Conda
* CRAN
* RPM
* Swift InstallationMacYou can use Homebrew to install bomberusing the following: brew tap devops-kung-fu/homebrew-tap
brew install devops-kung-fu/homebrew-tap/bomberIf you do not have Homebrew, you can still download the latest release (ex: bomber_0.1.0_darwin_all.tar.gz), extract the files from the archive, and use the bomberbinary.

If you wish, you can move the bomberbinary to your /usr/local/bindirectory or anywhere on your path. LinuxTo install bomber, download the latest release for your platform and install locally. For example, install bomberon Ubuntu: dpkg -i bomber_0.1.0_linux_arm64.debUsing bomberYou can scan either an entire folder of SBOMs or an individual SBOM with bomber. bomberdoesn't care if you have multiple formats in a single folder. It'll sort everything out for you.

Note that the default output for bomberis to STDOUT. Options to output in HTML or JSON are described later in this document. Single SBOM scancredentials (ossindex) bomber scan --provider=xxx --username=xxx --token=xxx spdx-sbom.json" dir="auto"># Using OSV (the default provider) which does not require any credentials
bomber scan spdx.sbom.json

# Using a provider that requires credentials (ossindex)
bomber scan --provider=xxx --username=xxx --token=xxx spdx-sbom.json

If the provider finds vulnerabilities you'll see an output similar to the following: https://blogger.googleusercontent.com/img/a/AVvXsEjT7ztXZSYs87NN0kL0HHGyTOa4x95tGxFmi9j8qKBStD1VIgQw94tPJqVXTW81ozT52CIXp01RiRDj0iuPinhgtpA8NChFTxIA2CbDCt0yC8Q9zrUBrxLK1BjZg_cmBPewie3_ji2MnaM7XWao6adqHcC7MlHuereviiZ383WTlj05ZhVHplSrmAnE-A=w494-h640 If the provider doesn't return any vulnerabilities you'll see something like the following: https://blogger.googleusercontent.com/img/a/AVvXsEiG0mO8BoqHLILGOFHb-32kinGd6mLx9Zvx2lOTReClXEeKxAXtwDcM-Aojw-Q6fu3tYfIjfoYoQmob6hWSGoBinx4QDJGJrTanRJiQEI5kW_8WI90Ju38eBS7VpcjItn69307LEHXLo4LSiA_Y1NvINs0XmR5v9D0Cu7uOCY118HXtNVUgp5JyOzkjeA=w640-h252 Entire folder scanThis is good for when you receive multiple SBOMs from a vendor for the same product. Or, maybe you want to find out what vulnerabilities you have in your entire organization. A folder scan will find all components, de-duplicate them, and then scan them for vulnerabilities. # scan a folder of SBOMs (the following command will scan a folder in your current folder named "sboms")
bomber scan --username=xxx --token=xxx ./sbomsYou'll see a similar result to what a Single SBOM scan will provide. Output to HTMLIf you would like a readable report generated with detailed vulnerability information, you can utilized the --outputflag to save a report to an HTML file.

Example command: bomber scan bad-bom.json --output=htmlThis will save a file in your current folder in the format "YYYY-MM-DD-HH-MM-SS-bomber-results.html". If you open this file in a web browser, you'll see output like the following: https://blogger.googleusercontent.com/img/a/AVvXsEgHyOA1b0YOQFen6BlMaPCFKBkuzukcl4S0feeKnoO8kSl3LTnLpgjNoq3wDwe8wFOYVROxK-ti3wscM2NhdMHkU6zNna9iIBGVOIZ_eOyjIZfrRJ5xFd9NNjLc-HOOE0SeTr5HRgLdCqOWofmCeFmF5LR1OXdhpQ2p4_jMdqFjiFal3Gs8JY5GWFgFcg=w638-h640 Output to JSONbombercan output vulnerability data in JSON format using the --outputflag. The default output is to STDOUT. There is a ton of more information in the JSON output than what gets displayed in the terminal. You'll be able to see a package description and what it's purpose is, what the vulnerability name is, a summary of the vulnerability, and more. https://blogger.googleusercontent.com/img/a/AVvXsEi7GZ4LaKKimslN9IKYeJ9lZkiZPxKZXL6Os-_aQ4XZ7YQ4gOj3zcWFKCENBlPMy3mYYZfzk_gk3JVTqu7MhV95FacnGTGFkLqlVoVn3qfEMHxUjYCtD3QNl5liUeL2qoy2jDlWlXKZrcW1-lBI0_eGz0wG0WzJoV-aYDSJ1HfdA3h-FktrFzng[...]

___________________________
@hacking_Attack
@Hacking_Video

s1JwGg=w640-h224 Example command: bomber scan bad-bom.json --output=jsonAdvanced stuffIf you wish, you can set two environment variables to store your credentials, and not have to type them on the command line. Check out the Environment Variables information later in this README. Environment VariablesIf you don't want to enter credentials all the time, you can add the following to your .bashrcor .bash_profileexport BOMBER_PROVIDER_USERNAME={{your OSS Index user name}}
export BOMBER_PROVIDER_TOKEN={{your OSS Index API Token}}Messing aroundIf you want to kick the tires on bomberyou'll find a selection of test SBOMs in the test folder. Notes* It's pretty rare to see SBOMs with license information. Most of the time, the generators like Syft need a flag like --license. If you need license info, make sure you ask for it with the SBOM.
* Hate to say it, but SPDX is wonky. If you don't get any results on an SPDX file, try using a CycloneDX file. In general you should always try to get CycloneDX SBOMs from your vendors.
* OSV. It's great, but the API is also wonky. They have a batch endpoint that would make it a ton quicker to get information back, but it doesn't work. bomberneeds to send one PURL at a time to get vulnerabilities back, so in a big SBOM it will take some time. We'll keep an eye on that.
* OSV has another issue where the ecosystem doesn't always return vulnerabilities when you pass it to their API. We had to remove passing this to the API to get anything to return. They also don't echo back the ecosystem so we can't check to ensure that if we pass one ecosystem to it, that we are getting a vulnerability for the same one back. ContributingIf you would like to contribute to the development of bomberplease refer to the CONTRIBUTING.md file in this repository. Please read the CODE_OF_CONDUCT.md file before contributing. Software Bill of Materialsbomberuses Syft to generate a Software Bill of Materials every time a developer commits code to this repository (as long as Hookzis being used and is has been initialized in the working directory). More information for CycloneDX is available here.

The current CycloneDX SBOM for bomberis available here. CreditsA big thank-you to our friends at Smashicons for the bomberlogo.

Big kudos to our OSS homies at Sonatype for providing a wicked tool like the Sonatype OSS Index. Download Bomber

hacking: security in practice
IT Disaster Recovery Assessment

Hi all! I’m currently trying to design an baseline assessment for IT Disaster Recovery.

I want the most important things in this baseline assessment.

Do you guys have any sources about models, tools, books, literature regarding IT Disaster Recovery?

Thanks in regards!

submitted by /u/overigegebruiker12
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What is AVX2?

Is it a machine level language like assembly to program processors? Go in technical detail if you know more I'm a CS student and would love to expand my knowledge base.

submitted by /u/Chrex_007
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

5000$ for Apple Stored Xss And Another Blind Xss Still under review

How I found two Xss At Apple that Lead for high/crirical impactContinue reading on Medium »
Read more...

External SSRF to Initial Access ?
https://www.reddit.com/r/Pentesting/comments/ycgyhx/external_ssrf_to_initial_access/

Looking for ideas on how to leverage an external SSRF in order to get initial access. Background - I have a reliable SSRF on an externally facing web app, using mod_proxy vuln I have mapped internal IP space, approx 200 machines / devices. Mostly Windows env, maybe 15% misc iot devices I can access any machine inside via SSRF, but can only talk HTTP. I can port scan using http://ip:port, but not 100% reliable. Does work for ssh banner grabs though. There are a lot of printers, mostly older. brother, HP, Canon. Most with default admin passwords. I've logged in and harvested as much Intel as I can. Mostly ip space, host names, usernames from print jobs. I can't use any PRET because I only have http access. Question ... Looking for ideas on how to get code execution. Can you think of other services I should look for internally? Any techniques that might work well? submitted by /u/_actualme (https://www.reddit.com/user/_actualme)
[link] (https://www.reddit.com/r/Pentesting/comments/ycgyhx/external_ssrf_to_initial_access/) [comments] (https://www.reddit.com/r/Pentesting/comments/ycgyhx/external_ssrf_to_initial_access/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Ransomware Barrage Aimed at US Healthcare Sector, Feds Warn

A CISA advisory warns that the Daixin Team ransomware group has put the US healthcare system in its crosshairs for data extortion, and provides tools to fight back.

Dark Reading: Attacks/Breaches
Godspeed Capital-Backed SilverEdge Partners with Counter Threat Solutions

Affiliation adds new all-source and counterintelligence, cyber, software development, and identity intelligence capabilities to SilverEdge's growing suite of technology solutions focused on the US intelligence community.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Uptycs Introduces Detections that Correlate Threat Activity from the Kubernetes Control Plane and Container Runtime

Comprehensive CNAPP coverage for Kubernetes and containers in a single solution.

___________________________
@hacking_Attack
@Hacking_Video

Legitimate RATs: a comprehensive forensic analysis of the usual suspects
https://www.reddit.com/r/redteamsec/comments/yciphw/legitimate_rats_a_comprehensive_forensic_analysis/

submitted by /u/warm_kitchenette (https://www.reddit.com/user/warm_kitchenette)
[link] (https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html) [comments] (https://www.reddit.com/r/redteamsec/comments/yciphw/legitimate_rats_a_comprehensive_forensic_analysis/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers leak 37GB of Microsoft source code.

https://cdn-images-1.medium.com/max/1024/0*KPqoMMWE8CbL77Gl.jpg
Hackers leak 37GB of Microsoft source code

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OverTheWire Wargames: Bandit L04

https://cdn-images-1.medium.com/max/2600/1*0sMNoLVUxEU_qolwzigITg.jpeg
Bandit Level 4 write-up

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
JACK

https://cdn-images-1.medium.com/max/1920/1*F_TTUyoBHAOLqtjthYpCdQ.png
Compromise a web server running Wordpress, obtain a low privileged user and escalate your privileges to root using a Python module.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Incredible World of Crypto Lending

https://cdn-images-1.medium.com/max/1920/1*GkuHwISFDAiXZjkZ5ie0rw.jpeg
Gambler Analogy

Continue reading on CARRE4 »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CISA advierte sobre piratas informáticos de Daixin dirigidos a organizaciones de salud con…

https://cdn-images-1.medium.com/max/1627/0*GB34inoRm_h_uQkG
Las agencias de ciberseguridad e inteligencia de EE.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can I fool a keylogger like this?

I've adopted a habit of attempting to fool any possible keylogger on my pc. Not that I believe I have a keylogger, but just in case.

My password for a service is a random set of characters and numbers; in this example I'll use abc123xyz. What I do: I type 123 first, use the mouse to set the cursor to the beginning of the password and then type abc, then i click to the end of the password and type xyz. This way the keylogger would log a wrong password: 123abcxyz. That is if it only logs keystrokes.

I'm assuming this would fool the vast majority of keyloggers, so I'm definitely reducing my risk by a heck of a lot. Would it fool all keyloggers? Perhaps not, if there are more advanced ones.

submitted by /u/Tiikuri
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video