-h Display command-line options
-i Input filepath
-ita Input filepath - MITRE report for top techniques
-o Output folder path
-ft Type of file to submit
-name Name to use with output
-sb_name Identifier (https://www.kitploit.com/search/label/Identifier) of sandbox to use (default: ha)
-api_key API key to use with submission to sandbox
-env_id Environment ID to use with submission to sandbox
-inc_sub Include sub-techniques in graphical output (default is to not include)
-mitre_data Filepath for mitre cti data to parse (to populate att&ck techniques)
-cmd Command
Options:
parse Process report file from prior sandbox submission
Uses -i, -ita, - o, -name, -inc_sub, -sig_data parameters
col Collates report data from prior sandbox submissions
Uses -i (treated as folder path), -ita, -o, -name, -inc_sub, -mitre_data parameters
Once the Navigator layer file is produced, it may be loaded into the Navigator for viewing via https://mitre-attack.github.io/attack-navigator/ Within the Navigator, techniques noted in the sandbox report summaries are highlighted and shown with increased heat based on a combined scoring of the technique ranking and the count of hits on the technique in the sandbox report summaries. Howevering of techniques will show select metadata.

Download Sandbox_Scryer (https://github.com/PayloadSecurity/Sandbox_Scryer)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Nuvola : Tool To Dump & Perform Automatic And Manual Security Analysis On AWS

nuvola (with the lowercase n) is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax.

The general idea behind this project is to create an abstracted digital twin of a cloud platform. For a more concrete example: nuvola reflects the BloodHound traits used for Active Directory analysis but on cloud environments (at the moment only AWS).

The usage of a graph database also increases the possibility of finding different and innovative attack paths and can be used as an offline, centralised and lightweight digital twin.

Quick Start

Requirements

* docker-composeinstalled
* an AWS account configured to be used with awscliwith full access to the cloud resources, better if in ReadOnly mode (the policy arn:aws:iam::aws:policy/ReadOnlyAccessis fine)

Setup

1. Clone the repository
git clone --depth=1 https://github.com/primait/nuvola.git; cd nuvola
1. Create and edit, if required, the .envfile to set your DB username/password/URL
cp .env_example .env;
Start the Neo4j docker instance
make start
Build the tool
make build
Usage

1. Firstly you need to dump all the supported AWS services configurations and load the data into the Neo4j database:
./nuvola dump -profile default_RO -outputdir ~/DumpDumpFolder -format zip
1. To import a previously executed dump operation into the Neo4j database:
./nuvola assess -import ~/DumpDumpFolder/nuvola-default_RO_20220901.zip
1. To only perform static assessments on the data loaded into the Neo4j database using the predefined ruleset:
./nuvola assess
1. Or use Neo4j Browser to manually explore the digital twin.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhulCufeI3v3wnfw2b4kZYQiZtm21Efl2pPHYnfKdf4q_c4xAMDNeu6MGGDSqNniqL674ivedZGEIfHYLGezbbccGGUb8Wo8QL2nJK0shkVotbn3s1HfjgUj4MHt2yCOQpd9QBK2-y3Vi4KVcAROfoJm8FWbbOYUL-fiNIu9JqDSQZ_PM7ooGq_olAQ/s1580/188325663-d713d2bc-d522-4e9c-bc02-fc766f010374.png

Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

P1 Bug Hunting: A Step by Step Guide to SQL Injection
https://medium.com/the-gray-area/p1-bug-hunting-a-step-by-step-guide-to-sql-injection-76f95c8986b0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

TL;DR- A beginners guide to SQL Injection in bug hunting, and obtaining access to the inner databases of targets.Continue reading on The Gray Area » (https://medium.com/the-gray-area/p1-bug-hunting-a-step-by-step-guide-to-sql-injection-76f95c8986b0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A Collection Of Awesome API Security Tools And Resources

Hi guys! I want to share with you a collection of awesome API Security tools and resources. The focus goes exactly to open-source tools and resources.

I have discovered them recently here https://go.wlrm.tl/github and now I use them very often.

You can find here API Keys, Cheatsheets, Checklists, Firewalls, Mind maps, Newsletters and more here. By the way, there is also a fast and light-weight API proxy firewall for request and response validation by OpenAPI specs.

Has anybody tested it? I need your feedback.

submitted by /u/Unused_Imagination
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
P1 Bug Hunting: A Step by Step Guide to SQL Injection

https://cdn-images-1.medium.com/max/781/1*vfsYAW8iKQ8Ji0wNyee4Sg.png
TL;DR- A beginners guide to SQL Injection in bug hunting, and obtaining access to the inner databases of targets.

Continue reading on The Gray Area »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OSI Model

https://cdn-images-1.medium.com/max/600/1*FIMSfWEPyahjhFqYT5dWww.png
OSI MODEL
The OSI model (Open Systems Interconnection Model) is a conceptual framework used to describe the functions of a networking…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to find the password of Wi-Fi network’s in your pc.

https://cdn-images-1.medium.com/max/2600/0*QA7c-oGWP9cJNJgH
In this blog we will be learning how to extract the password of Wi-Fi network’s in your computer using command prompt.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
ChewataCTF2022 — Agelgel

https://cdn-images-1.medium.com/max/1280/1*6rwip2N8CbssYMD0GXZGWg.jpeg
Welcome, this challenge looks confusing but when you enumerate it well it gives you a clear view about it.
Hint : python-agelgel

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe writeup: AttackerKB

https://cdn-images-1.medium.com/max/696/1*MZZ3mE4V15WMzCz80juevQ.png
This article discusses the AttackerKB project and a greater phenomena that it is based off of: the wisdom of the crowds.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
BlueVoyant Research Reveals Private Equity Portfolio Company Cybersecurity Challenges

New study identifies critical focus areas for portfolio companies to reduce cyber risks and costs associated with breaches.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
#BeCyberSmart All Year Round With Educational Resources From Microsoft

Improved cyber hygiene keeps users and their identities, devices, and data more secure and reduces the organization’s risk exposure.

Dark Reading: Attacks/Breaches
Better Together: Why It's Time for Ops and Security to Converge

Threat actors are becoming only more sophisticated and determined.

Dark Reading: Attacks/Breaches
A Third of Global Organizations Were Breached Over Seven Times in the Past Year

Cyber Risk Index report highlights elevated risk as organizations struggle with visibility.

___________________________
@hacking_Attack
@Hacking_Video