Basic hacking tools cheat-sheet


#infosec #security #webapp #appsec #cybersecurity

Auditing Docker Security

https://youtu.be/mQkVB6KMHCg

#docker #autdit #security

#BurpHacksForBounties - Day 22/30

🤓🤓 Create your own Burp Extender Plugin in 3 tweets with Java.
Thank you Burp Suite for making it easy

#infosec #appsec #burp @BurpSuiteGuide #bugbountytips #bugbountytip #security

#BurpHacksForBounties - Day 23/30

❤️ Productivity Hacks ❤️

#infosec #security #burp

#BurpHacksForBounties - Day 24/30

This is an amazing writeup which talks about using plugin in Burp that ease the journey for catching IDORs.

Writeup link: https://infosecwriteups.com/leveraging-burp-suite-extension-for-finding-idor-insecure-direct-object-reference-2653f9b89fd4
By
@dhanush

#infosec #appsec #bugbountytips #bugbountytip #bugbounty #security

#BurpHacksForBounties - Day 25/30

Optimizing Burp Suite for better performance, these 4 simple steps and you would notice a big difference in performance.

#infosec #appsec #burp #security #bugbountytips #bugbounty

#BurpHacksForBounties - Day 26/30

Красное сердцеUnderstand the different intruder attack types in Burp Suite

With visualizations at code level for better understanding.

Code level understanding in follow up thread 👇

#infosec #appsec #security #cybersecurity #bugbounty #bugbountytips

#BurpHacksForBounties - Day 28/30 - Super CSRF POC Generator Hack.


CSRF POC generator is only available in Burp Suite pro, but not anymore.

Use this -> https://github.com/merttasci/csrf-poc-generator by @mertistaken


#infosec #burp #appsec #security #bugbountytips #bugbountytip #cybersecurity

Kubernetes Hardening Guidance

The NSA and CISA have published today a Kubernetes security-hardening guide

https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF

#kubernetes #hardening #security

AppSec Ezine

https://pathonproject.com/zb/?da0fdd7f7fd0d09c#bod4fYcp6Zbxi3iRKuTDAGQgWNFHbJ/JwPjWjd/Veaw=

#AppSec #Security

KubiScan

KubiScan helps cluster administrators identify permissions that attackers could potentially exploit to compromise the clusters. This can be especially helpful on large environments where there are lots of permissions that can be challenging to track. KubiScan gathers information about risky roles\clusterroles, rolebindings\clusterrolebindings, users and pods, automating traditional manual processes and giving administrators the visibility they need to reduce risk.

https://github.com/cyberark/KubiScan

#kubernetes #rbac #scan #security #tools

Hunting for Persistence in Linux

# https://pberba.github.io/security/2021/11/22/linux-threat-hunting-for-persistence-sysmon-auditd-webshell/

# https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/

#blueteam #redteam #DFIR #security

CloudSploit

CloudSploit's remediation guides are intended to be an open-source resource for improving cloud security. Many cloud IaaS providers like AWS, Azure, and Google Cloud have a shared responsibility model. They provide the physical and architectural security, along with tools to properly secure the services they offer, but it is up to the user to configure those settings properly.

https://github.com/aquasecurity/cloud-security-remediation-guides

#cloud #security #remediation #blueteam

Arsenal of AWS Security Tools

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

https://github.com/toniblyx/my-arsenal-of-aws-security-tools

#aws #security #benchmarks #blueteam

AD Security Assessment

Active Directory Security Assessment script pulls important security facts from Active Directory and generates nicely viewable reports in HTML format by highlighting the spots that require attention. The script manipulates user data using facts collected with benchmark values.

https://github.com/gkm-automation/AD-Security-Assessment

#ad #security #assessment #ps1

Windows Security Log Quick Reference Cheat Sheet

#windows #security #log #blueteam

Container Security Checklist

Checklist for container security devsecops practices

https://github.com/krol3/container-security-checklist

#kubernetes #docker #security #cheatsheet #blueteam

🔐 MULTIFACTOR — особенности 2FA

Существует неплохое решение для организации двухфакторной аутентификации в корпоративной среде под названием MULTIFACTOR. Входит в реестр российского ПО за номером 7046.

Это не реклама, поскольку сегодня буквально в двух словах мы расскажем про то как этот второй фактор можно обойти в некоторых очень частных случаях.

Бу-га-га.

#security #special

https://internet-lab.ru/multifactor_2fa_bug