white2hack 📚

Attacked From Behind Application, Hadess, 2023 Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services. Some of the most significant and most dangerous vulnerabilities and the attacks they have enabled have involved using RCE for Exploit Public-Facing Application. #pentest

Certified Ethical Hacker v 12 Exam Preparation. Sample Questions with Answers, Compiled by Mohammad Alkhudari #useful

Around AI talks #fun

How HTTPS Works #web

Active Directory Security Assessment Microsoft provides Active Directory Security Assessments for their customers, which is great, but unfortunately not everyone has the money nor the people to do these kind of Security Assess-ment, and since AD is the backbone of identities for many organizations. Different examples from real world experience has been covered, where I have managed to see these misconfigurations in production environments. #windows

Top 5 Password Attack Types #useful

Неплохо о базе построения DevSecOps Обзор стадий базового workflow, ключевых инструментах анализа безопасности и некоторых контролях secure pipeline Источник #SecDevOps

DevSecOps Guides Our guides cover a wide range of topics related to DevSecOps, including: 🔹Secure coding practices: Learn how to write code that is resistant to common security threats such as SQL injection, cross-site scripting, and buffer overflow. 🔹Threat modeling: Learn how to identify potential security vulnerabilities in your applications and prioritize them based on their impact and likelihood of occurrence. 🔹Security testing: Learn about different types of security testing, such as penetration testing, vulnerability scanning, and code review, and how to incorporate them into your DevSecOps workflow. 🔹Infrastructure security: Learn about securing the infrastructure that supports your applications, including servers, networks, and databases. 🔹 Compliance and regulations: Learn about compliance requirements and regulations such as GDPR, HIPAA, and PCI-DSS

OWASP Web Application Penetration Checklist his comprehensive checklist, from the Open Web Application Security Project (OWASP), is a valuable tool for penetration testers and developers alike. It provides a systematic approach to identifying vulnerabilities, and can be used as a guide to help ensure that your web applications are as secure as possible. #docs #web

Wireshark Mindmap #useful

Announcing the OWASP Top 10 for Large Language Models (AI) Project arge Language Models (LLMs) are the underlying technology powering transformative AI technologies like OpenAI's ChatGPT and Google's Bard. These technologies have stormed onto the scene over the last few months. One thing that's become clear is that organizations developing using these technologies will have a new and dangerous set of security headaches to contend with. Official page GitHub #useful

Hacking a Windows Machine by Hiding a RAT Inside an Image. A Remote Access Trojan (RAT) is malware that creates a backdoor remote administration channel to allow a threat actor to access and control the infected host. Инструкция для молодежи что бы знали какие картинки открывать Источник

PentestGPT – A ChatGPT Powered Automated Penetration Testing Too PentestGPT has been released on GitHub under the operator “GreyDGL,” a Ph.D. student at Nanyang Technological University, Singapore. It is constructed on top of ChatGPT and works in an interactive way to direct penetration testers during general and particular procedures. To access the PentestGPT Tool, ChatGPT plus member is required as it relies on GPT-4 model for high-quality reasoning, also no public GPT-4 API yet. To support PentestGPT, a wrapper for ChatGPT sessions has been added.