Cicd-Goat - A Deliberately Vulnerable CI/CD Environment
http://www.kitploit.com/2022/11/cicd-goat-deliberately-vulnerable-cicd.html

___________________________
@hacking_Attack
@Hacking_Video

Deliberately vulnerable (https://www.kitploit.com/search/label/Vulnerable) CI/CD environment. Hack CI/CD pipelines, capture the flags. Created by Cider Security (https://www.cidersecurity.io/?utm_source=github&utm_medium=github_page&utm_campaign=ci%2Fcd%20goat%20_060422). Description The CI/CD Goat project allows engineers and security practitioners to learn and practice CI/CD security through a set of 10 challenges, enacted against a real, full blown CI/CD environment. The scenarios are of varying difficulty levels, with each scenario focusing on one primary attack vector. The challenges cover the Top 10 CI/CD Security Risks (https://www.cidersecurity.io/top-10-cicd-security-risks/?utm_source=github&utm_medium=github_page&utm_campaign=ci%2Fcd%20goat_060422), including Insufficient Flow Control Mechanisms, PPE (Poisoned Pipeline (https://www.kitploit.com/search/label/Pipeline) Execution), Dependency Chain Abuse, PBAC (Pipeline-Based Access Controls), and more.
The different challenges are inspired by Alice in Wonderland, each one is themed as a different character.
The project’s environment is based on Docker images and can be run locally. These images are: Gitea (minimal git server) Jenkins Jenkins agent LocalStack (cloud service emulator (https://www.kitploit.com/search/label/Emulator) that runs in a single container) Lighttpd CTFd (Capture The Flag framework). The images are configured to interconnect in a way that creates fully functional pipelines.

___________________________
@hacking_Attack
@Hacking_Video

cd cicd-goat && docker-compose up -d Windows (Powershell) mkdir cicd-goat; cd cicd-goat
curl -o docker-compose.yaml https://raw.githubusercontent.com/cider-security-research/cicd-goat/main/docker-compose.yaml
get-content docker-compose.yaml | %{$_ -replace "bridge","nat"}
docker-compose up -d Usage Instructions Spoiler alert! Avoid browsing the repository files as they contain spoilers. To configure your git client for accessing private repositories (https://www.kitploit.com/search/label/Repositories) we suggest cloning using the http url. In each challenge, find the flag - in the format of flag# (e.g flag2), or another format if mentioned specifically. Each challenge stands on its own. Do not use access gained in one challenge to solve another challenge. If needed, use the hints on CTFd. There is no need to exploit CVEs. No need to hijack admin accounts of Gitea or Jenkins (named "admin" or "red-queen"). Take the challenge After starting the containers, it might take up to 5 minutes until the containers (https://www.kitploit.com/search/label/Containers) configuration process is complete. Login to CTFd at http://localhost:8000 (http://localhost:8000/) to view the challenges: Username: alice Password: alice Hack: Jenkins http://localhost:8080 (http://localhost:8080/) Username: alice Password: alice Gitea http://localhost:3000 (http://localhost:3000/) Username: thealice Password: thealice Insert the flags on CTFd and find out if you got it right. Troubleshooting If Gitea shows a blank page, refresh the page. When forking a repository, don't change the name of the forked repository. Solutions Warning: Spoilers!  See Solutions (https://github.com/cider-security-research/cicd-goat/blob/main/solutions). Contributing Development Clone the repository. Rename .git folders to make them usable:
python3 rename.py git Install testing dependencies: pip3 install pipenv==2022.8.30
pipenv install --deploy Run the development environment to experiment with new changes: rm -rf tmp tmp-ctfd/
cp -R ctfd/data/ tmp-ctfd/
docker-compose -f docker-compose-dev.yaml up -d Make the desired changes: All services except CTFd are completely configured as code so desired changes should be made to the files in the appropriate folders. To make changes in CTFd, use the admin credentials (https://github.com/cider-security-research/cicd-goat/blob/main/break-glass.md). Shutdown the environment, move changes made in CTFd and rebuild it: docker-compose -f docker-compose-dev.yaml down
./apply.sh # save CTFd changes
docker-compose -f docker-compose-dev.yaml up -d --build Run tests: pytest tests/ Rename .git folders to allow push: python3 rename.py notgit Commit and push! Checklist Follow the checklist below to add a challenge: CTFd: Write challenge description. Choose category according to difficulty level. Make sure the challenge is visible and has value according to difficulty. Write hints in order of usage. Add a flag. Make sure to select if it's case-insensitive. Gitea: Configure a new repository in gitea.yaml. Create the repository under gitea/repositories (https://github.com/cider-security-research/cicd-goat/blob/main/gitea/repositories). Use an open-source repository that use the MIT license as a template for the challenge repository. Jenkins: Configure Jenkins and add new jobdsl files in the casc.yaml file. Make sure jobs don't run periodically. Jobs should be triggered by events / polling. Validate that the new challenge doesn't interfere with other challenges. Make sure the flag is not accessible when solving other challenges. Write tests. Write the solution. Update README.md if needed. In order to run the CI, make sure you have a CircleCI account and that you’ve clicked “Set Up Project” on your fork of the project.

___________________________
@hacking_Attack
@Hacking_Video

Download Cicd-Goat (https://github.com/cider-security-research/cicd-goat)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to reset root password of any GRUB based linux system.

https://cdn-images-1.medium.com/max/1920/0*l6mtoyxKVcm4HxX6.jpg
So this hit me hard when Nitesh Singh aka “Technical Navigator” visited our campus and gave a small demo about this. So I researched a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Hack a Facebook Account

https://cdn-images-1.medium.com/max/1280/0*33nDmAcuOBeSrdlg
In this article, we will show you 10 ways to hack a Facebook account.

Continue reading on Ask Brothers »

___________________________
@hacking_Attack
@Hacking_Video

Nighthawk 0.2.1 - Haunting Blue - @MDSecLabs
https://www.reddit.com/r/redteamsec/comments/yjajac/nighthawk_021_haunting_blue_mdseclabs/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mdsec.co.uk/2022/11/nighthawk-0-2-1-haunting-blue/) [comments] (https://www.reddit.com/r/redteamsec/comments/yjajac/nighthawk_021_haunting_blue_mdseclabs/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Cicd-Goat - A Deliberately Vulnerable CI/CD Environment

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
APT10: Tracking down LODEINFO 2022, part II

https://external-preview.redd.it/q7l3I22vrrlPf0oW-thU0M2A2BGsRNa4Yqk0CNm19ZI.jpg?width=640&crop=smart&auto=webp&s=adbaf330aecd34cb259e1d4b25add83f5b7d7630 submitted by /u/EspoJ
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
APT trends report Q3 2022 [Kaspersky]

https://external-preview.redd.it/zlPM5f_1GrK51BTihobtVWZgkx5WbO1uCPZ1ebBcTD8.jpg?width=640&crop=smart&auto=webp&s=a525c7b2092077e93e57f0652efb3b46eb9301e7 submitted by /u/EspoJ
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://external-preview.redd.it/WdmRIi0_7JgEN1V9GdV8Rzr09NNTiRpvD0yl1yi4VjI.jpg?width=108&crop=smart&auto=webp&s=e2bf1aefa356b11d4042ca71b7d85bb08ee7678a They fled Ukraine together. She documented everything on Instagram She posted this photo 2 days prior to his arrest

source

tl;dr if you're an internationally wanted cyber criminal, avoiding a mandatory draft, and illegally immigrating into NATO territory, do not document everything on social media.

https://preview.redd.it/c944ig142cx91.png?width=768&format=png&auto=webp&s=fb84556db843abdae9368d4b647db65f51135c14

submitted by /u/DrinkMoreCodeMore
[link] [comments]

hacking: security in practice
why people hate ceh cert?

i just saw their syllabus and there is so much content , maybe its not 100% practical like oscp but still it will make your theoretical knowledge really wide , thats only my opinion

so please someone can tell me why iam wrong and that ceh actually bad?

thanks!

submitted by /u/General_Roof9555
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
02 Binary Exploitation: Format String Vulnerability

https://cdn-images-1.medium.com/max/1490/1*TZisE_z92hwvRiwmKZNwng.png
Format String is a type of software vulnerability discovered around 1989 that could be used in security exploits. Originally thought to be…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video