BugBase Apollo is a community of highly skilled security experts and hackers passionate about making the digital world safer. These elite…Continue reading on Medium » (https://bugbaseindia.medium.com/be-part-of-our-apollo-community-3423a05bd52e?source=rss------bug_bounty-5)

Web 3.0 : The Future of Web and CyberSecurity

Hello my infosec and tech mates, I hope you all are doing great at your lives even am doing great right now, (can’t say not really). So…Continue reading on Medium »
Read more...

BE PART OF OUR APOLLO COMMUNITY!

BugBase Apollo is a community of highly skilled security experts and hackers passionate about making the digital world safer. These elite…Continue reading on Medium »
Read more...

“How to succeed in bug bounty” a framework.
https://medium.com/@ReidAJ/how-to-succeed-in-bug-bounty-a-framework-b1e25f273d3a?source=rss------bug_bounty-5

Hey there reader, are you hoping to make millions with bug bounty? That’s quite the ambition you’ve got there, and while I’m not going to…Continue reading on Medium » (https://medium.com/@ReidAJ/how-to-succeed-in-bug-bounty-a-framework-b1e25f273d3a?source=rss------bug_bounty-5)

“How to succeed in bug bounty” a framework.

Hey there reader, are you hoping to make millions with bug bounty? That’s quite the ambition you’ve got there, and while I’m not going to…Continue reading on Medium »
Read more...

hacking: security in practice
Friend being blackmailed.

Context : My friend(girl) used to text this guy long ago and had sent some suggestive pics(disappearing photo option in instagram). she quit talking with him after a while due to him being a psycho.
Anyway, a few days ago, that guy is claiming he has all the disappearing pics cause he got help from "dark web techie friend" which already sounds dubious. he hasn;t showed proof, but my friend is scared.

i just want to know does such software exist? i just want to know if it exists or not. i dont need to know anything further.

submitted by /u/union4nature
[link] [comments]

Hacking on Medium
“How to succeed in bug bounty” a framework.

https://cdn-images-1.medium.com/max/900/1*0F7nkVeMy09FSdkSwehkjg.jpeg
Hey there reader, are you hoping to make millions with bug bounty? That’s quite the ambition you’ve got there, and while I’m not going to…

Continue reading on Medium »

EAST - Extensible Azure Security Tool - Documentation
http://www.kitploit.com/2023/02/east-extensible-azure-security-tool.html

Extensible Azure Security Tool (Later referred as E.A.S.T) is tool for assessing Azure and to some extent Azure AD security controls. Primary use case of EAST is Security data collection for evaluation in Azure Assessments. This information (JSON content) can then be used in various reporting tools, which we use to further correlate and investigate the data.
This tool is licensed under MIT license (https://github.com/jsa2/EAST/blob/public/LICENSE).

Collaborators Yours truly (https://www.linkedin.com/in/joosua-santasalo-00552922/) Nixu (https://www.nixu.com/) Cloud Security Team Release notes Preview branch introduced Changes: Installation now accounts for use of Azure Cloud Shell's updated version in regards to depedencies (Cloud Shell has now Node.JS v 16 version installed) Checking of Databricks cluster types as per advisory (https://www.databricks.com/blog/2022/10/10/admin-isolation-shared-clusters.html)
Audits Databricks clusters for potential privilege elevation - This control requires typically permissions on the databricks cluster" Content.json is has now key and content based sorting. This enables doing delta checks with git diff HEAD^1 ¹ as content.json has predetermined order of results

¹Word of caution, if want to check deltas of content.json, then content.json will need to be "unignored" from .gitignore exposing results to any upstream you might have configured. Use this feature with caution, and ensure you don't have public upstream set for the branch you are using this feature for Change of programming patterns to avoid possible race conditions with larger datasets. This is mostly changes of using var to let in for await -style loops Important Current status of the tool is beta Fixes, updates etc. are done on "Best effort" basis, with no guarantee of time, or quality of the possible fix applied We do some additional tuning before using EAST in our daily work, such as apply various run and environment restrictions, besides formalizing ourselves with the environment in question. Thus we currently recommend, that EAST is run in only in test environments, and with read-only permissions. All the calls in the service are largely to Azure Cloud IP's, so it should work well in hardened environments where outbound IP restrictions are applied. This reduces the risk of this tool containing malicious packages which could "phone home" without also having C2 in Azure. Essentially running it in read-only mode, reduces a lot of the risk associated with possibly compromised NPM packages (Google compromised NPM (https://www.google.com/search?q=compromised+npm+packages&oq=compromised+npm+p&aqs=edge.0.0i512j69i57j0i20i263i512.2812j0j1&sourceid=chrome&ie=UTF-8)) Bugs etc: You can protect your environment against certain mistakes in this code by running the tool with reader-only permissions Lot of the code is "AS IS": Meaning, it's been serving only the purpose of creating certain result; Lot of cleaning up and modularizing remains to be finished There are no tests at the moment, apart from certain manual checks, that are run after changes to main.js and various more advanced controls. The control descriptions at this stage are not the final product, so giving feedback on them, while appreciated, is not the focus of the tooling at this stage As the name implies, we use it as tool to evaluate environments. It is not meant to be run as unmonitored for the time being, and should not be run in any internet exposed service that accepts incoming connections. Documentation could be described as incomplete for the time being EAST is mostly focused on PaaS resource, as most of our Azure assessments focus on this resource type No Input sanitization is performed on launch params, as it is always assumed, that the input of these parameters are controlled. That being said, the tool uses extensively exec() - While I have not reviewed all paths, I believe that achieving shellcode execution is trivial. This tool does not assume hostile input, thus the recommendation is that you don't paste launch arguments into command line without reviewing them first. Tool operation Depedencies To reduce amount of code we use the following depedencies for operation and aesthetics are used (Kudos to the maintainers of these fantastic packages) package aesthetics operation license axios (https://www.npmjs.com/package/axios) ✅ MIT (https://github.com/axios/axios/blob/v1.x/LICENSE) yargs (https://www.npmjs.com/package/yargs) ✅ MIT (https://github.com/yargs/yargs/blob/main/LICENSE) jsonwebtoken (https://www.npmjs.com/package/jsonwebtoken) ✅ MIT (https://github.com/auth0/node-jsonwebtoken/blob/master/LICENSE) chalk (https://www.npmjs.com/package/chalk) ✅ MIT (https://github.com/chalk/chalk/blob/main/license) js-beautify (https://www.npmjs.com/package/js-beautify) ✅ MIT (https://github.com/beautify-web/js-beautify/blob/main/LICENSE) Other depedencies for running the tool: If you are planning to run this in Azure Cloud Shell you don't need to install Azure CLI: This tool does not include or distribute Microsoft Azure CLI, but rather uses it when it has

been installed on the source system (Such as Azure Cloud Shell, which is primary platform for running EAST) Azure Cloud Shell (BASH) or applicable Linux Distro / WSL Requirement description Install ✅ AZ CLI AZCLI USE (https://github.com/jsa2/EAST#azcli-use) curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash ✅ Node.js runtime 14 Node.js runtime for EAST install with NVM (https://github.com/nvm-sh/nvm#install--update-script) Controls EAST provides three categories of controls: Basic, Advanced, and Composite The machine readable control looks like this, regardless of the type (Basic/advanced/composite): {
"name": "fn-sql-2079",
"resource": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourcegroups/rg-fn-2079/providers/microsoft.web/sites/fn-sql-2079",
"controlId": "managedIdentity",
"isHealthy": true,
"id": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourcegroups/rg-fn-2079/providers/microsoft.web/sites/fn-sql-2079",
"Description": "\r\n Ensure The Service calls downstream resources with managed identity",
"metadata": {
"principalId": {
"type": "SystemAssigned",
"tenantId": "033794f5-7c9d-4e98-923d-7b49114b7ac3",
"principalId": "cb073f1e-03bc-440e-874d-5ed3ce6df7f8"
},
"roles": [{
"role": [{
"properties": {
"roleDefinitionId": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
"principalId": "cb073f1e-03b c-440e-874d-5ed3ce6df7f8",
"scope": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourceGroups/RG-FN-2079",
"createdOn": "2021-12-27T06:03:09.7052113Z",
"updatedOn": "2021-12-27T06:03:09.7052113Z",
"createdBy": "4257db31-3f22-4c0f-bd57-26cbbd4f5851",
"updatedBy": "4257db31-3f22-4c0f-bd57-26cbbd4f5851"
},
"id": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourceGroups/RG-FN-2079/providers/Microsoft.Authorization/roleAssignments/ada69f21-790e-4386-9f47-c9b8a8c15674",
"type": "Microsoft.Authorization/roleAssignments",
"name": "ada69f21-790e-4386-9f47-c9b8a8c15674",
"RoleName": "Contributor"
}]
}]
},
"category": "Access"
}, Basic Basic controls include checks on the initial ARM object for simple "toggle on/off"- boolean settings of said service. Example: Azure Container Registry adminUser acr_adminUser (https://github.com/jsa2/EAST/blob/public/providers/microsoft.containerregistry/functions/acr_adminUser.js)