🦑Encryption vs Hashing - What's the difference?

Imagine you have a secret recipe for a cake, and you want to share it with a friend.

🤵Encryption:

You lock the recipe in a box with a key and give the box to your friend.

Your friend can unlock the box (with the key you gave them) and read the recipe.

If someone else finds the box without the key, they can't read it.
Key Point: It can be reversed if you have the key (decrypt it).

🧛Hashing:

You put the recipe in a blender and blend it into a unique smoothie.

Now it’s impossible to get the original recipe back from the smoothie.

But if someone else blends the exact same recipe, they’ll get the exact same smoothie.

Key Point: One-way process. You can’t go back to the recipe, but you can check if two smoothies match.

In short:

Encryption is like locking something up—can be unlocked.

Hashing is like turning it into mush—you can’t un-mush it!

As both methods involve turning data into a scrambled form, one might consider these two the same. However, there is a distinction you must know about:

Data is encrypted twice while it’s only hashed once.

One can encrypt/decrypt a piece of data, meaning that the original text can be retrieved back. However, retrieval of plain text isn’t possible if data is hashed once.

Ref: Santosh Nandakumar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Cloud Pentesting Cheatsheet🛡

Cloud penetration testing is a crucial skill to identify vulnerabilities in cloud environments like AWS, Azure, and Google Cloud Platform (GCP). This cheatsheet simplifies complex concepts and helps you take your cloud security game to the next level!

📘What’s Inside?
1️⃣ Key Testing Steps:
• Reconnaissance: Identify misconfigured assets, open ports, and exposed services in the cloud.
• Enumeration: Gather details about cloud accounts, storage buckets, APIs, and permissions.
• Exploitation: Simulate attacks by exploiting misconfigurations, weak access controls, or privilege escalation opportunities.
• Post-Exploitation: Assess the impact by reviewing data leakage and persistence mechanisms.

2️⃣ Cloud-specific Vulnerabilities:
• Misconfigured IAM roles and policies leading to unauthorized access.
• Publicly accessible storage buckets exposing sensitive data.
• Weak or absent encryption protocols for data in transit or at rest.
• Exploitable serverless functions (e.g., AWS Lambda) due to insecure coding practices.
• Over-permissive security groups allowing unrestricted traffic.

3️⃣ Essential Tools for Cloud Pentesting:
• ScoutSuite: Multi-cloud security auditing.
• Pacu: AWS exploitation framework for testing security.
• Cloudsploit: Scan configurations for security issues.
• Burp Suite: Analyze APIs in cloud applications.
• Nmap: Detect open ports and vulnerable services in the cloud.
• AWS CLI and GCP CLI: Enumerate configurations directly from the command line.

4️⃣ Best Practices:
• Use least privilege policies for all IAM roles and accounts.
• Enable logging and monitoring through services like AWS CloudTrail or Azure Monitor.
• Apply encryption standards (TLS, AES-256) to protect sensitive data.
• Regularly perform compliance checks using CIS Benchmarks and OWASP Cloud Top 10.

✨ Key Areas to Focus On:

🔑 Authentication and Authorization Flaws:
• Check for mismanaged credentials (e.g., leaked keys or weak passwords).
• Review SSO configurations for potential bypass scenarios.

📂 Storage Misconfigurations:
• Detect open storage buckets or public file access.
• Ensure data is encrypted and access is controlled through proper permissions.

📡 Network Security Risks:
• Audit firewall rules and security groups to detect overly permissive settings.
• Identify exposed management ports (SSH, RDP, etc.).

🔄 Serverless Security Issues:
• Look for weak input validation and insecure API integrations in serverless applications.
• Check timeout and resource limits to mitigate DoS risks.

Ref: Santosh Nandakumar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 100 Free Security Tools – Protect Your Digital World for Free! 🚀

Looking to enhance your cybersecurity skills or secure your systems without breaking the bank? Explore this comprehensive list of 100 FREE Security Tools that cover every aspect of cybersecurity, from penetration testing to network security and data protection! 🌍

🔑 What’s Included?

✅ Network Security Tools

Wireshark: Analyze network packets in real-time.

Nmap: Scan networks for vulnerabilities.


✅ Web Security Tools

Burp Suite Community Edition: Test web application security.

ZAP (OWASP): Identify vulnerabilities in web applications.


✅ Endpoint Protection

Malwarebytes Free: Detect and remove malware effectively.

ClamAV: Open-source antivirus for Linux systems.


✅ Penetration Testing Tools

Metasploit Framework: Comprehensive pen-testing platform.

SQLmap: Automate SQL injection testing.


✅ Password Security

KeePass: Securely manage your passwords.

Hashcat: Advanced password recovery tool.


✅ Cloud Security Tools

ScoutSuite: Assess the security of your cloud infrastructure.

CloudSploit: Detect misconfigurations in cloud environments.


✅ Forensic Tools

Autopsy: Analyze digital media for forensic purposes.

FTK Imager: Quickly collect and analyze forensic data.


... and 85 more tools to strengthen your cybersecurity skills!

Ref: In pdf
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑💡𝐌𝐚𝐥𝐰𝐚𝐫𝐞 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬 𝐓𝐢𝐩: 𝐒𝐩𝐨𝐭𝐭𝐢𝐧𝐠 𝐀𝐧𝐭𝐢-𝐃𝐢𝐬𝐚𝐬𝐬𝐞𝐦𝐛𝐥𝐲 𝐓𝐫𝐢𝐜𝐤𝐬 💡

While analyzing malware, a common anti-disassembly technique to watch for is the use of a 𝐜𝐨𝐧𝐝𝐢𝐭𝐢𝐨𝐧𝐚𝐥 𝐣𝐮𝐦𝐩 𝐰𝐢𝐭𝐡 𝐚 𝐜𝐨𝐧𝐬𝐭𝐚𝐧𝐭 𝐜𝐨𝐧𝐝𝐢𝐭𝐢𝐨𝐧.

Take the snippet below as an example:

The code starts with 𝒙𝒐𝒓 𝒆𝒂𝒙, 𝒆𝒂𝒙, which clears the 𝑬𝑨𝑿 register and, as a result, sets the zero flag (𝒁𝑭).

Immediately after, a conditional jump (𝒋𝒛) checks the state of the zero flag.

Since 𝒙𝒐𝒓 𝒆𝒂𝒙, 𝒆𝒂𝒙 guarantees ZF will 𝒂𝒍𝒘𝒂𝒚𝒔 be set, the jump is effectively unconditional. However, to automated tools or disassemblers, it may appear as conditional, complicating static analysis.

🔐 𝑾𝒉𝒚 𝒅𝒐𝒆𝒔 𝒕𝒉𝒊𝒔 𝒎𝒂𝒕𝒕𝒆𝒓?

Malware authors use this technique to:

● Obfuscate control flow.
● Confuse disassembly tools.
● Make reverse engineering more time-consuming.

Ref: AIT ICHOU Mustapha
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 The Complete Shodan Guide – A Treasure Trove for Cybersecurity Professionals! 🔍🔐

Thrilled to share The Complete Shodan Guide, an essential resource for anyone interested in exploring the depths of the internet using Shodan, the search engine for connected devices.

This guide is packed with:
✅ Step-by-step instructions for using Shodan effectively.
✅ Techniques to uncover exposed devices and vulnerabilities.
✅ Practical use cases for penetration testing and threat analysis.

Ref: Dhikonda GopiDhikonda Gopi
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑105 Windows Event IDs For SIEM Monitoring

1.Failed Login Attempts - Event ID: 4625
2.Account Lockouts - Event ID: 4740
3.Successful Login Outside Business Hours - Event ID: 4624
4.New User Creation - Event ID: 4720
5.Privileged Account Usage - Event ID: 4672
6.User Account Changes - Event IDs: 4722, 4723, 4724, 4725, 4726
7.Logon from Unusual Locations - Event ID: 4624 (with geolocation analysis)
8.Password Changes - Event ID: 4723 (change attempt), 4724 (successful reset)
9.Group Membership Changes - Event IDs: 4727, 4731, 4735, 4737
10.Suspicious Logon Patterns - Event ID: 4624 (anomalous logons)
11.Excessive Logon Failures - Event ID: 4625
12.Disabled Account Activity - Event ID: 4725
13.Dormant Account Usage - Event ID: 4624 (rarely used accounts)
14.Service Account Activity - Event IDs: 4624, 4672
15.RDP Access Monitoring - Event ID: 4624 (with RDP-specific filtering)
16.Lateral Movement Detection - Event ID: 4648 (network logons)
17.File and Folder Access - Event ID: 4663
18.Unauthorised File Sharing - Event IDs: 5140, 5145
19.Registry Changes - Event IDs: 4657
20.Application Installation and Removal - Event IDs: 11707, 1033
21.USB Device Usage - Event IDs: 20001, 20003 (from Device Management logs)
22.Windows Firewall Changes - Event IDs: 4946, 4947, 4950, 4951
23.Scheduled Task Creation - Event ID: 4698
24.Process Execution Monitoring - Event ID: 4688
25.System Restart or Shutdown - Event IDs: 6005, 6006, 1074
26.Event Log Clearing - Event ID: 1102
27.Malware Execution or Indicators - Event IDs: 4688, 1116 (from Windows Defender)
28.Active Directory Changes - Event IDs: 5136, 5141
29.Shadow Copy Deletion - Event ID: 524 (with VSSAdmin logs)
30.Network Configuration Changes - Event IDs: 4254, 4255, 10400
31.Execution of Suspicious Scripts - Event ID: 4688 (process creation with script interpreter)
32.Service Installation or Modification - Event ID: 4697
33.Clearing of Audit Logs - Event ID: 1102
34.Software Restriction Policy Violation - Event ID: 865
35.Excessive Account Enumeration - Event IDs: 4625, 4776
36.Attempt to Access Sensitive Files - Event ID: 4663
37.Unusual Process Injection - Event ID: 4688 (with EDR or Sysmon data)
38.Driver Installation - Event IDs: 7045 (Service Control Manager)
39.Modification of Scheduled Tasks - Event ID: 4699
40.Unauthorised GPO Changes - Event ID: 5136
41.Suspicious PowerShell Activity - Event ID: 4104 (from PowerShell logs)
42.Unusual Network Connections - Event ID: 5156 (network filtering platform)
43.Unauthorised Access to Shared Files - Event ID: 5145
44.DNS Query for Malicious Domains - Event ID: 5158 (DNS logs required)
45.LDAP Search Abuse - Event ID: 4662
46.Process Termination Monitoring - Event ID: 4689
47.Failed Attempts to Start a Service - Event ID: 7041
48.Audit Policy Changes - Event IDs: 4719, 1102
49.Time Change Monitoring - Event IDs: 4616, 520
50.BitLocker Encryption Key Changes - Event ID: 5379

Ref: Izzmier Izzuddin ZulkepliIzzmier Izzuddin Zulkepli
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑🤺 Threat modeling GenAI Workloads: Don't Skip This ⚡️

Threat modeling is one of the oldest aspects of cybersecurity, as early as 1977 some form of threat models were leveraged to understand the risks against systems.

🤔 However, threat modeling is not commonly practiced because it is manual and time-intensive. But is it worth the time, effort & resources? Hell YES. The value of threat modeling continually increases as our systems become more complex.

Yes, your GenAI workloads aren't exempted ! 🙌

🎊 GOOD NEWS -> There are abundant resources that help streamline threat modeling by automating several steps.

The Threat Composer tool from Amazon Web Services (AWS) is one of such tools.

🌩 A recent AWS blog post, provides a recommended approach for threat modeling GenAI workloads using Threat Composer. Adam Shostack's four question framework is used as a guide.

👉 Check out the blog post here - https://lnkd.in/g6i4zSpN

Here is a quick summary:

1️⃣ What are we working on?
Aims to get a detailed understanding of your business context & application architecture. Example outcomes are Data Flow Diagrams, assumptions, and key design decisions.

2️⃣ What can go wrong?
Identify possible threats to your application using the context & information gathered from the previous question. Leverage info sources e.g. OWASP Top 10 For Large Language Model Applications & Generative AI, MITRE ATLAS

3️⃣ What are we going to do about it?
Consider which controls would be appropriate to mitigate the risks associated with the threats identified in the previous question. Some info sources (per previous question) have sections for mitigations which could be super useful.

4️⃣ Did we do a good enough job?
Contrary to popular opinions, threat modeling exercises do not end after the actual activity ! Its important to verify the effectiveness of the implemented mitigations to determine if the identified risks have been addressed. Use penetration testing, adversary emulation etc to proactively evaluate the effectiveness of implemented mitigations.

Ref: Kennedy T
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Understanding HTML Injection 💉

HTML injection is a type of attack where malicious HTML code is inserted into a website. This can lead to a variety of issues, from minor website defacement to serious data breaches. Unlike other web vulnerabilities, HTML injection targets the markup language that forms the backbone of most websites.
This attack differs from other web vulnerabilities that exploit server or database weaknesses because it focuses on manipulating the structure and content of a webpage

Ref: Mehedi Hasan Babu
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑IAM vs. PAM: Understanding the Key Differences 🔒

In today’s rapidly evolving cybersecurity landscape, managing access and securing sensitive data is more critical than ever. Two foundational tools in this effort are Identity and Access Management (IAM) and Privileged Access Management (PAM). While both are essential, they serve distinct purposes:

🔑 Identity and Access Management (IAM)

🔻 Focus: Managing identities and access rights for all users.
🔻 Scope: Broader, covering employees, contractors, partners, and even devices.
🔻 Key Functions: Authentication, Single Sign-On (SSO), user provisioning/de-provisioning, governance, and compliance reporting.
🔻 Goal: Streamlining access across the IT ecosystem while improving operational efficiency and ensuring compliance.

🔒 Privileged Access Management (PAM)

🔻 Focus: Securing and controlling access to privileged accounts with elevated permissions.
🔻 Scope: Narrower, targeting administrators, IT staff, service accounts, and third-party vendors.
🔻 Key Functions: Credential vaulting, session monitoring, least privilege enforcement, and just-in-time access.
🔻 Goal: Protecting critical systems and sensitive data from breaches or abuse of high-risk accounts.

Implementing both IAM and PAM creates a layered security approach. IAM ensures proper access for all users, while PAM locks down high-risk areas, minimizing vulnerabilities and adhering to the Zero Trust framework.

📊 This visual summary (attached) simplifies the key differences and highlights how these tools work together to strengthen cybersecurity.

Ref: Fadi Kazdar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Understanding Modern Cybersecurity Tools: EDR, XDR, SOAR, SIEM, and Integrated Solutions 🚨

Navigating the world of cybersecurity solutions can be complex. Each tool serves a unique purpose, but understanding their differences is crucial for building an effective security strategy. Here's a quick comparison:

✅ EDR (Endpoint Detection and Response): Focuses on endpoint security by detecting/responding to threats on devices like laptops and servers. Great for organizations with endpoint-centric threats.

✅ XDR (Extended Detection and Response): Expands visibility across endpoints, networks, and cloud environments, providing unified threat detection across domains.

✅ SOAR (Security Orchestration, Automation, and Response): Automates and streamlines incident response processes, saving time and improving efficiency.

✅ SIEM (Security Information and Event Management): Offers centralized log management and real-time monitoring for identifying and correlating security events.

✅ Integrated Solution (EDR + XDR + SOAR + SIEM): Combines the strengths of all these tools for holistic threat detection, response, and seamless integration.

Ref: Fadi Kazdar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑𝐃𝐎𝐌 𝐗𝐒𝐒 Testing Method

While "DOM Invader" is not a new feature of Burp, I feel that alot of people don't use it enough (or are not aware of it)

It works by submiting a random string generated by Burp (named "canary") in existing input fields or URL parameters

Then "DOM Invader" will check how your input is processed, providing you with necessary context and sanitization details.

1. Start Burp Browser
2. Turn on the DOM Invader
3. Copy and Paste the canary in the target input field or URL parameter
4. Check the DOM Invader tab for "Interesting sinks"
5. Craft the payload or use the "Exploit" option to automate

Ref: Andrei Agape
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁