Channel Public Channel

APT

@apt_notes

This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.me/APT_Notes/6

Chat Link:
t.me/APT_Notes_PublicChat

Open in Telegram

Subscribers: 17K
Photos: 565
Videos: 28
Links: 909

Showing posts older than #44 · Back to latest

Older Posts 20 shown

Post #41 343 Nov 18, 2020, 08:24 UTC

#tools #education A small example of breaking out from docker containers from our friends
https://github.com/Swordfish-Security/Pentest-In-Docker

GitHub GitHub - Swordfish-Security/Pentest-In-Docker: Docker image to exploit RCE, try for pentest methods and test container security… Docker image to exploit RCE, try for pentest methods and test container security solutions (trivy, falco and etc.) - Swordfish-Security/Pentest-In-Docker

Post #40 327 Nov 12, 2020, 12:10 UTC

#tools Find secrets with a rapid search engine from these guys:
https://grep.app

Post #39 331 Nov 10, 2020, 09:15 UTC

NAT bypass research
https://github.com/samyk/slipstream

GitHub GitHub - samyk/slipstream: NAT Slipstreaming allows an attacker to remotely access any TCP/UDP services bound to a victim machine… NAT Slipstreaming allows an attacker to remotely access any TCP/UDP services bound to a victim machine, bypassing the victim’s NAT/firewall, just by anyone on the victim's network visiting ...

Post #38 347 Oct 30, 2020, 08:04 UTC

#bugbounty
Few words about a private BugBounty
https://medium.com/finn-no/one-year-with-a-private-bug-bounty-program-f928a57ad026

Medium One Year With a Private Bug Bounty Program at FINN.no Over the years, FINN.no has been doing a lot of different security assessments: from the classical one test per release to regular on-site…

Post #37 336 Oct 27, 2020, 12:58 UTC

APT It's nevel too late to learn pod&network security policy. Here are k8s guidelines: https://github.com/cloudogu/k8s-security-demos

PS. some additional materials to play with for those who will like this format
https://github.com/whitespots/security-for-developers

GitHub GitHub - whitespots/security-for-developers: Some demo scripts for education purposes Some demo scripts for education purposes. Contribute to whitespots/security-for-developers development by creating an account on GitHub.

Post #36 326 Oct 27, 2020, 12:56 UTC

It's nevel too late to learn pod&network security policy.
Here are k8s guidelines:
https://github.com/cloudogu/k8s-security-demos

GitHub GitHub - cloudogu/k8s-security-demos: Demos for several kubernetes security features Demos for several kubernetes security features. Contribute to cloudogu/k8s-security-demos development by creating an account on GitHub.

Post #35 351 Oct 27, 2020, 10:18 UTC

#owasp #Tools
If you need any guidelines - sonar has a lot of examples
https://rules.sonarsource.com/python/RSPEC-2755

Post #34 364 Oct 21, 2020, 07:17 UTC

#tools
Yet another secrets finder. But with hooks and DB
https://github.com/ResultadosDigitais/x9

Post #33 360 Oct 20, 2020, 15:19 UTC

#bugbounty
EasyMoney
https://www.youtube.com/watch?v=LiGXPIWyBUQ

Post #32 417 Oct 15, 2020, 11:00 UTC

#Tools
DVWA is too old for you? Maybe you like some Crypto labs?
Here is something you will like 🙂
https://github.com/DamnVulnerableCryptoApp/DamnVulnerableCryptoApp/

GitHub GitHub - DamnVulnerableCryptoApp/DamnVulnerableCryptoApp: An app with really insecure crypto. To be used to see/test/exploit weak… An app with really insecure crypto. To be used to see/test/exploit weak cryptographic implementations as well as to learn a little bit more about crypto, without the need to dive deep into the math...

Post #31 962 Oct 15, 2020, 10:10 UTC

#bugbounty
Exposed docker.sock exploitation
https://dejandayoff.com/the-danger-of-exposing-docker.sock/

Dejandayoff The Danger of Exposing Docker.Sock Exposing /var/run/docker.sock could lead to full environment takeover.

Post #30 332 Oct 14, 2020, 05:19 UTC

#tools
Nerve - Free vulnerability scanner
https://github.com/PaytmLabs/nerve

Post #29 567 Oct 8, 2020, 12:48 UTC

#Risks
GitLab security trends report
https://about.gitlab.com/blog/2020/10/06/gitlab-latest-security-trends/

Post #28 370 Sep 29, 2020, 06:53 UTC

Someone stole $15m and returned $7m to the sleeping developer. The most interesting thing was that this network was not fully developed till the end.

https://twitter.com/AndreCronjeTech/status/1310763507890225152?s=19

Twitter Andre Cronje 👻🐸 2/x 3. These contracts, nor the ecosystem are final, yesterday alone you will notice I deployed 2 separate batches of the contracts, this is my usual "test in prod" process 4. We started releasing some of the art teasers to showcase all the different clans…

Post #27 670 Sep 28, 2020, 07:55 UTC

Simple about threats and clouds
https://notsosecure.com/security-architecture-review-of-a-cloud-native-environment/

Post #26 393 Sep 26, 2020, 12:02 UTC

#bugbounty
Interesting article about request smuggling
https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c

Post #25 363 Sep 26, 2020, 09:37 UTC

APT Finding CORS misconfigurations #scripts site="example.com"; gau "$site" | while read url;do target=$(curl -s -I -H "Origin: evil.com" -X GET $url) | if grep 'evil.com'; then [Potentional CORS Found]echo $url;else echo Nothing on "$url";fi;done

Without any additional installations

docker run --rm -it --name corsfinder -e VULN_ID=1 -e DOMAIN=site.com whitespots/corsfinder

Post #24 423 Sep 22, 2020, 17:02 UTC

#memes #bugbounty
H1 team as always :)
https://hackerone.com/reports/156098

HackerOne Uber disclosed on HackerOne: XSS At "pages.et.uber.com" Vulnerable Domain : ------------------- https://pages.et.uber.com/ Vulnerable Link : ----------------- https://pages.et.uber.com/icecream/?lang_id=5 Edited Link With Payload...

Post #23 409 Sep 20, 2020, 16:57 UTC

Automate your scans with scanner aggregator
https://github.com/secureCodeBox/secureCodeBox-v2

Post #22 714 Sep 18, 2020, 07:53 UTC

#BugBounty #Tools A cool checklist from whitespots.io for Android
https://docs.whitespots.io/mobile/android-checks

Older posts →