GUAC - Aggregates Software Security Metadata Into A High Fidelity Graph Database
http://www.kitploit.com/2023/01/guac-aggregates-software-security.html

Note: GUAC is under active (https://www.kitploit.com/search/label/Active) development - if you are interested in contributing, please look at contributor guide (https://github.com/guacsec/guac/blob/main/CONTRIBUTING.md) and the "express interest" issue (https://github.com/guacsec/guac/issues/1) Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata (https://www.kitploit.com/search/label/Metadata) into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance.
Conceptually, GUAC occupies the “aggregation and synthesis” layer of the software supply chain (https://www.kitploit.com/search/label/Supply%20Chain) transparency (https://www.kitploit.com/search/label/Transparency) logical model:

A few examples of questions answered by GUAC include:

Quickstart Refer to the Setup + Demo (https://github.com/guacsec/guac/blob/main/SETUP.md) document to learn how to prepare your environment and try GUAC out! Architecture Here is an overview of the architecture of GUAC:

Supported input formats CycloneDX (https://github.com/CycloneDX/specification) Dead Simple Signing Envelope (https://github.com/secure-systems-lab/dsse) In-toto ITE6 (https://github.com/in-toto/attestation) OpenSSF Scorecard (https://github.com/ossf/scorecard) SLSA (https://github.com/slsa-framework/slsa) SPDX (https://spdx.dev/specifications/) Additional References GUAC Intro Slides (https://docs.google.com/presentation/d/1WF4dsJiwR6URWPgn1aiHAE3iLVl-oGP4SJRWFpcOlao/edit#slide=id.p) GUAC Design Doc (https://docs.google.com/document/d/1N5x0HErb-kmCPgG9M8TwBEOGIVU54clqp_X4KhtNJI8/edit) Communication We encourage discussions to be done on github issues. We also have a public slack channel (https://openssf.slack.com/archives/C03U677QD46) on the OpenSSF slack. For security issues or code of conduct concerns, an e-mail should be sent to guac-maintainers@googlegroups.com (mailto:guac-maintainers@googlegroups.com). Governance Information about governance can be found here (https://github.com/guacsec/guac/blob/main/GOVERNANCE.md).

Download Guac (https://github.com/guacsec/guac)

KitPloit - PenTest Tools!
GUAC - Aggregates Software Security Metadata Into A High Fidelity Graph Database

https://blogger.googleusercontent.com/img/a/AVvXsEgEtOzw7jZvX6v0V6NjRX0XDPlWLyEvEHCLiQ5pR6V3WSoZHaec8CDnDQFqUA7YcHWHxPFaEmRBI_qIEyg417P5P2u5Br4e3rVTlj8SzoVZV5cju1uCi1UecMMmRMgv0f9O2NOXYhnt-PmfFStnSt9XeEFS6yslL8fCBUBPGgkf9PCKjBL4yMUemG6d5w=w258-h400 Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide and the "express interest" issue

Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance.
Conceptually, GUAC occupies the “aggregation and synthesis” layer of the software supply chain transparency logical model: https://blogger.googleusercontent.com/img/a/AVvXsEjCOXt8ov6H6LlHg1Im-TtNFlplAFlpYR88jEg4XfgjrsbBEvtvjQDly-fb-6cJi-h9IMIdMqpy42MF-b2VWTkLj6bYjT6vK1dXJUvu91u3pLSdKh4n4R-fI4_qb1gmexfzz1lNUUpxIRCe--C-GO5WCaNJTwJogdXYa9sILVz1k-JOQ__qT_jk0ZmHaw=w640-h500 A few examples of questions answered by GUAC include: https://blogger.googleusercontent.com/img/a/AVvXsEiJJotPbN2MSCa1bnXRrEWVJm_tPJ9TruIYiTK6yvhmotDWdfkXsVfOVmsbG8PpOXB93OLJDJrtSH0WhhSPs0pfOTBOzSNMNLgXfvCmEbFnzm8bFy0x-4C33IYH4MUq5NCVKv0hIuB8vKvBsIToHtbj36Z3F258SMn6MtDsBUB1y6eowcKoOb4cZxXBcw=w640-h290 QuickstartRefer to the Setup + Demo document to learn how to prepare your environment and try GUAC out! ArchitectureHere is an overview of the architecture of GUAC: https://blogger.googleusercontent.com/img/a/AVvXsEi5DEW3s8Fs02PYifWaxCs5NZ4morOKYKY96VPr985dzhAEj7hrGkVFKMJFA7ipFjAthiyP5FH1-NRGyF2mIj2roQBe0xLXArZKq4_j1oegbW25a2g4LCsrCsCBE_BLEWzf0ceU8DSXqDQKpJcEIPH7xSmqFqJn0DQNiKX6LF-Ud7jpHTM0n-WeVRQ_Zw=w640-h338 Supported input formats* CycloneDX
* Dead Simple Signing Envelope
* In-toto ITE6
* OpenSSF Scorecard
* SLSA
* SPDX Additional References* GUAC Intro Slides
* GUAC Design Doc CommunicationWe encourage discussions to be done on github issues. We also have a public slack channel on the OpenSSF slack.

For security issues or code of conduct concerns, an e-mail should be sent to guac-maintainers@googlegroups.com. GovernanceInformation about governance can be found here. Download Guac

hacking: security in practice
Just started learning what is the better OS?

So I’ve been learning python and I’ve been experimenting with different types of Linux os I’ve used Ubuntu and kali but I’ve used both on different types of machine like for example I used the Ubuntu on a vm but I put kali on a usb but it seems to me like little differences between all the os are frustrating to filter out

submitted by /u/amon619
[link] [comments]

hacking: security in practice
How to clone a website?

I need to clone my school website, long story short a proffesor got mad at us and wants to shut down a website that is very usefull to us students, it has YEARS of lectures and work on it and i want to clone it and save all that work with PDF,PFT files photoes etc... So i hope if someone here can show me how to do it?

submitted by /u/Bujadin
[link] [comments]

hacking: security in practice
How to run an Apache server from a Docker container using EC-2?

I'm taking an online course about AWS as it relates to cybersecurity, and it's a bit unclear to me. For a certain task, the instructor told us to run an Apache server from a Docker container using EC-2, and then create a “Hello World” webpage accessible via port 11111 and provide its URL, and to then provide a screenshot of the "docker ps" command output.

Can anyone here help me out a bit by pointing me in the way of some good resources? I'm fairly lost.

submitted by /u/dvnci1452
[link] [comments]

hacking: security in practice
Anywhere I can advertise a bounty for my site?

Long story short, I have a business and before launching I’d like it to be as secure as possible so I’d like people to attempt to hack it.

I’d provide proof that I own the site ect and there would be a bounty prize for anybody who got in and amended the flaw

submitted by /u/Immediate_Iron3293
[link] [comments]

What is website Bug ?

A website bug is an error or malfunction that occurs on a website, which can cause it to behave in unexpected ways or prevent it from…Continue reading on Medium »
Read more...

XSS vulnerability
https://medium.com/@kosanamharish232242/xss-vulnerability-3c1fd09b58c1?source=rss------bug_bounty-5

Hii amigos today we are going to discuss about XSS vulnerability listed also known as Cross-site-Scripting vulnerability which is regarded…Continue reading on Medium » (https://medium.com/@kosanamharish232242/xss-vulnerability-3c1fd09b58c1?source=rss------bug_bounty-5)

What is website Bug ?
https://medium.com/@malamin/what-is-website-bug-4d4bfb9de0b3?source=rss------bug_bounty-5