white2hack 📚

][AKEP E-ZINE, special limited paper edition, 3th release, spring 2025 ❤️‍🔥Best materials 2019 - 2021❤️‍🔥 Issue 249, p.79 by Ivan Piskunov #info

// Заглушка #stub

Embold Static Code Analysis Platform Embold — статический анализатор кода, который необходим в любом процессе DevSecOps. Он позволяет управлять и контролировать качество проектов по разработке ПО. Embold предоставляется бесплатно для проектов с открытым исходным кодом и доступен как локальное решение или как SaaS; в последнем случае все данные надежно хранятся в облаке, а связь между браузерами и инструментом шифруется с помощью SSL для обеспечения безопасности. В рамках бесплатного пакета доступны 5 мест для пользователей и 5 сканирований кода объёмом до 50 тысяч строк. ❗️ Официальная страница #AppSec #SecDevOps

Attacking Pipeline DevOps pipelines, which integrate and automate the processes of software development and IT operations, have become critical for rapid and continuous software delivery. However, their extensive automation and integration capabilities make them attractive targets for cyberattacks. One significant threat is the insertion of malicious code through compromised repositories or Continuous Integration/Continuous Deployment (CI/CD) tools. Attackers can exploit vulnerabilities in pipeline tools or use social engineering to gain access, allowing them to insert backdoors or malware into the codebase. Furthermore, the reliance on third-party tools and libraries within these pipelines can introduce security risks if these dependencies are not adequately vetted or monitored. Once the pipeline is compromised, the malicious code can propagate quickly, leading to widespread and potentially catastrophic impacts on production environments. Security issues in DevOps pipelines also stem from misconfigurations and insufficient access controls. Often, credentials and sensitive data are inadvertently exposed through improper configuration management or poor secret handling practices, such as hardcoding credentials within scripts. Inadequate segmentation and over-privileged access can also exacerbate the problem, allowing attackers who gain a foothold in one part of the pipeline to move laterally and escalate their privileges. Abuse of the pipeline can result in unauthorized deployment of code, data breaches, and significant disruption to services. To mitigate these risks, organizations need to implement robust security practices, including regular security audits, continuous monitoring, strict access controls, and the use of security tools designed to detect and prevent threats within the DevOps lifecycle. • DevOps resources compromise; • Control of common registry; • Direct PPE (d-PPE); • Indirect PPE (i-PPE); • Public PPE; • Changes in repository; • Inject in Artifacts; • User/Services credentials; • Typosquatting docker registry image; • Resources. #SecDevOps

Attacking CI/CD by Reza (DevSecops Giudes), 2025 In CI/CD (Continuous Integration/Continuous Deployment) environments, several methods and attacks can compromise security. Code Injection involves injecting malicious code into the build pipeline, exploiting vulnerabilities in the build system or dependencies, potentially leading to the execution of unauthorized commands or access to sensitive data. Dependency Attacks target vulnerabilities in third-party libraries or dependencies used in the CI/CD pipeline, exploiting them to introduce malicious code or cause failures. Artifact Tampering manipulates the build artifacts (e.g., binaries, containers) to include malicious payloads or vulnerabilities, which can be deployed to production systems. Pipeline Hijacking involves gaining unauthorized access to the CI/CD environment to alter build configurations, steal secrets, or inject malicious code into the pipeline. Credential Exposure occurs when sensitive credentials or secrets (e.g., API keys, tokens) are hardcoded or improperly managed, making them accessible to attackers who can use them to gain unauthorized access. Phishing and Social Engineering tactics target developers or CI/CD administrators to trick them into revealing access credentials or executing malicious commands. Denial of Service (DoS) attacks can overwhelm CI/CD systems, disrupting the build and deployment processes. Misconfiguration of CI/CD tools and environments can inadvertently expose systems or data, leading to potential security breaches. Each of these methods requires vigilant security practices, including secure coding, regular dependency audits, and robust access controls, to mitigate risks in CI/CD workflows. • CI Debug Enabled; • Default permissions used on risky events; • Github Action from Unverified Creator used; • If condition always evaluates to true; • Injection with Arbitrary External Contributor Input; • Job uses all secrets; • Unverified Script Execution; • Arbitrary Code Execution from Untrusted Code Changes; • Unpinnable CI component used; • Pull Request Runs on Self-Hosted GitHub Actions Runner; • Mitigation Strategies; • Example GitHub Actions Workflow; • RCE via Git Clone; • Resources See also 📌 Attacking and Securing CI/CD Pipeline by Hiroki Suezawa, October 20, 2021 #SecDevOps

Authentic Hacker Culture: Didier Stevens Didier Stevens is a famous Belgian software developer and a respected cybersecurity word wide expert . He is best known for his tools for cracking Windows passwords, analyzing PDF documents and injection malicious code into PDF file, and as the author of the open-source Didier Stevens Suite utilities: 140 programs for system operations with files, processes, the registry and other things. As his LinkedIn profile says, Didier Stevens "started programming over 40 years ago and has no plans to stop." Since the 80s, he has been into hacker stuff, namely reverse engineering malware. In fact, he still does it to this day. If you have an interesting sample, you can send it to him by email. Didier's official career began in 1991 with the Belgian provider Belgacom, then there were Euroclear and IP Globalnet, from 2000 to 2016 he worked as a security consultant at Microsoft, first as a freelancer, and then as a Microsoft MVP for user security. In 2012, he founded Didier Stevens Labs, which is still active. He probably provides consulting services from this legal entity at a price several times higher than what he would pay an individual contractor. As they say, every good programmer should have his own company for such cases. In recent years, he has been running a private business, while holding the positions of senior handler at the Internet Storm Center (ISC) of the SANS Institute of Technology and senior analyst at NVISO, a company that deals with information security and protection against cyberattacks. Information security specialists may have come across the mention of the open source Didier Stevens Suite utilities, which contains 140 small programs. Here are some: 📌 Ariad: a tool (driver) to block code execution after inserting a USB flash drive into a port, base64dump: extract base64 strings from a file, 📌 BinaryTools: simple tools for binary operations: reverse (inverts a file) and middle (extracts a sequence), 📌 bpmtk: a set of tools for manipulating basic processes, 📌 BruteForceEnigma: a program for brute-forcing Enigma ciphers, 📌 cipher-tool: encoding and decoding texts with simple ciphers, 📌 cmd-dll: converting cmd.exe (ReactOS) to dll, 📌 CounterHeapSpray: a tool for ensuring process security: monitors the memory usage of an application to protect against heap spraying, The case of the Didier Stevens shows that the career of a cool professional can start with innocent hacker joke. As your skills and serious attitude to the matter grow, you become a "leading information security specialist" who is hired as a consultant by leading corporations and invited to speak at conferences. See also: NVISO Lab X(Twitter) Black Hat 2014

The small list tutorials of Reverse Engineering with Radare2 Radare2 (also known as r2) is a complete framework for reverse-engineering and analyzing binaries; composed of a set of small utilities that can be used together or independently from the command line. Built around a disassembler for computer software which generates assembly language source code from machine-executable code, it supports a variety of executable formats for different processor architectures and operating systems ❗️Radare2 Reversing Series by ConsoleCowboys ❗️Reverse Engineering with Radare2 by ÆTHER SECURITY LAB ❗️Radare2 Tutorial by inaryAdventure #education #reverse

Attacking Golang Golang (or Go) is a statically typed, compiled programming language designed at Google. It is known for its simplicity, efficiency, and strong performance. However, like any programming language, improper coding practices in Go can lead to security vulnerabilities. This article explores common security issues and how to mitigate them in Go. • SQL Injection; • Command Injection; • Cross-Site Scripting (XSS); • Insecure Deserialization; • Directory Traversal; • CSRF; • SSRF; • File Upload; • Memory Management Vulnerabilities; • Cryptography Failure; • LFI and RFI; • Basic Authentication (BasicAuth) alongside JSON Web Tokens (JWT); • Golang pitfalls; • RPC; • Timing Attack. #AppSec

Схема карьерных треков в результативной кибербезопасности, Positive Technologies, 2024 На схеме показаны девять направлений (ролей) развития специалиста по кибербезопасности: ➡Безопасность объектов критической информационной инфраструктуры; ➡Исследование безопасности; ➡Управление уязвимостями; ➡Администрирование средств защиты информации; ➡Аналитик SOC; ➡Комплаенс-аналитика; ➡Аналитика ИБ; ➡Безопасная разработка приложений. ❗️Официальный сайт Смотри еще: 📌 Карьера в кибербезопасности, или Как расти в ИБ #newbie

Лучшем быть одному чем быть окруженным долбо&бами. Отречься от несущественного ради гораздо большего Большинство людей не понимает что такое самопожертвование. Раньше я тоже думал, что мне положено гулять, что мне нужно как можно больше вечеринок, тр&хнуть больше телок и т.д. На самом деле это все поебень, все чешуя, все мишура. Тебе надо над собой рабоать.Ты должен чувствовать себя гордым что ты отрекаешься от этой чешуи что бы получить намного больше, понимаешь?. Когда видишь что люди тусят - забей х&й на них, мен. Чувствуй себя воином. Будь сам, один. Лучшем быть одному чем быть окруженным долбо&бами Артем Долгин (с) | Artemus Dolgin (с) #great

Всем кто ищет, кто стартует или уже в пути! Ты можешь больше чем тебе говорят! Клип Дмитрий Портнягин - В чем сила, бро? Давай, не тупи, я такой же, как ты Две ноги, две руки, одна жизнь Проживи её так, как хочешь именно ты! Мой ритм не поменял меня Я тот же пацан Меня носило в облаках Носило по лесам Посмотри в зеркало Ты видишь, искру в глазах? Значит, весь мир в твоих руках Давай, не тупи, я такой же, как ты Две ноги, две руки, одна жизнь Проживи её так, как хочешь именно ты Скажи ка, в чём наша сила, брат? Мы не боимся всё поменять Переписать с чистого листа Кем быть, пацан, ты решаешь сам #great

\\ Stub #stub

The Cybersecurity Workforce of Tomorrow, Michael Nizich, 2023 The field of cybersecurity - the protection of electronic data - offers one of the fastest growing job markets today. As the sector grows in importance there will be a rapidly growing demand for qualified analysts, cryptographers, engineers, architects, managers, and executive leaders. The Cybersecurity Workforce of Tomorrow discusses the current requirements of the cybersecurity worker and analyses the ways in which these roles may change in the future as attacks from hackers, criminals and enemy states become increasingly sophisticated. The author's predictions are based on the inevitable changes that will come for the cybersecurity industry including: Experienced practitioner and academic Michael Nizich examines the current and future human resources requirements of the cybersecurity market. His focus on workforce preparation, education and emerging technologies is essential reading for executives and cybersecurity professionals alike. #book #analytics

A startpage with online resources about Forensics by Dillon Bowe Main page #forensic

Pentest award 2025 Pentest award — отраслевая награда для специалистов по тестированию на проникновение, которую ежегодно вручает компания «Авилликс». Основная задача премии — выделить лучших специалистов и показать их вклад в развитие российского пентеста. В 2025 году мероприятие пройдет уже в третий раз. Участие в премии бесплатное, отправить можно как одну, так и несколько работ. Главный приз за победу — стеклянная именная статуэтка, MacBook, билеты на конференцию OFFZONE и, конечно, максимальный почет сообщества этичных хакеров. За вторые и третьи места призеры получат iPhone и смарт-часы. В 2025 году Pentest award значительно расширяет количество номинаций. Заявка на премию — это рассказ о лучшем проекте в свободной форме. Не нужно раскрывать эксплоиты, любые шаги в цепочке эксплуатации могут быть полностью анонимны, а детали могут быть скрыты, важно отразить сам подход и идею. ❗️ Официальный сайт ➡️ Подать заявку на участие 👀 YouTube Promo + анонс Хабр

Доля России в общем объеме мирового ВВП составила 3,2% Доля России составляет менее 1% национальных богатств мира и менее 2% ВВП всех стран. **Source: The Great Russia 2025 World Economy in One Chart Russia GDP by TadVisor #analytics

Рубль вошёл в топ-10 валют, упавших по отношению к доллару США за год Редакция TEA составила топ валют, стоимость которых сильнее всего упала за год. See more: The Decline of the Russian Ruble The Strongest (and Weakest) Currencies in the World Compared to the U.S. Dollar The U.S. Dollar Against Major Currencies in 2024 #analytics

Certified Kubernetes Security Specialist (CKS) Study Guide by Benjamin Muschko, 2025 If you're preparing for the CKS exam📘 or looking to deepen your understanding of Kubernetes security, this book is a must-read. It provides: In-depth coverage of the CKS curriculum Real-world scenarios and use cases to understand attack vectors and mitigation Hands-on examples for tools like kube-bench, Trivy, Falco, and AppArmor Guidance on securing the supply chain, hardening the system, and monitoring runtime security #book #SecDevOps