Null Open Security Community - Hyderabad Chapter
•
4 likes•43,768 views
Null Open Security Community is a group of penetration testers and moderators that aims to make the web more secure through bi-annual conferences. Members can gain certificates for speaking at conferences. The document invites others to get involved and become part of the community.
Report
Share
Report
Share
Download to read offline
Recommended
Newbytes NullHyd
Over 1.5 million customer records were stolen from T-Mobile Czech Republic by an employee. The records included names, email addresses, account numbers, but not location or traffic data. T-Mobile claims the perpetrator was caught trying to sell the database.
A hacking group in Russia allegedly used malware called Lurk to steal over 1.7 billion roubles (US $25.4 million) from bank accounts in Russia. Authorities arrested 50 people in connection with the scheme.
Github warned that a number of user accounts had been compromised through a password reuse attack related to recent data breaches at LinkedIn, MySpace, Tumblr and other sites that exposed over 642 million passwords.
Securitynewsbytes
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive function. Exercise causes chemical changes in the brain that may help protect against mental illness and improve symptoms.
Damiano Gui professore presso @IED Torino, “Agent Anatomy Canvas – Un framewo...
Damiano Gui professore presso @IED Torino, “Agent Anatomy Canvas – Un framewo...Associazione Digital Days
Il corso in Digital Applications and Technologies, parte del biennio specialistico in Transdisciplinary Design, ha esplorato l’impatto dell’intelligenza artificiale sul design e sulla professione del designer. Ha focalizzato sull’integrazione dell’IA per creare esperienze aumentate basate sull’empatia e sull’inclusione, contrastando la complessità delle reti neurali. Durante l’intervento, è stato presentato il framework sviluppato e sono stati mostrati esempi pratici tratti dai progetti degli studenti, evidenziando l’approccio interdisciplinare del corso e il suo focus sulla mobilità urbana.An Introduction to Mozilla Webmaker
These slides were an introduction to some of the other Mozilla projects at the "Firefox student ambassador training camp", held at Mozilla Taipei on 27 July 2013. IT focuses on Mozilla Webmaker (Thimble, Popcorn Maker, X-Ray Goggles, Teach the Web and Maker Party) and also mentions Open Badges (2M Better Futures). This presentation formed part of the Mozilla Taiwan Community's involvement in the day,
Quick Summary
• Introduction
• Mozilla Foundation
• Mozilla Webmaker
• Thimble, X-Ray Goggles & Popcorn Maker
• A Gallery of Makes
• Teach the Web
• Maker Party
• Open Badges
Soulitarian City: Looking for the Hacker Ethic in Glasgow by Pat Kane, The Pl...
A presentation to Urban Learning Space, by Pat Kane, author of The Play Ethic (http://www.theplayethic.com), on digital identities and practices in Glasgow, Oct 19th, 2006. See http://urbanlearningspace.org/assets/events/event.php?id=238917
Seminar 2.1 rob curran
CoderDojo is a global volunteer-led community that organizes free coding clubs for young people aged 7-17. The clubs, called Dojos, are focused on developing skills like creativity, collaboration, and problem solving through peer learning and mentoring. Dojos have spread to over 600 locations across 45 countries since starting in 2011 in Ireland. The movement aims to give more young people the opportunity to learn coding skills by reaching 100,000 regular attendees and 1,500 Dojos across 60 countries in the next 3 years.
DRIVE | things to things - where are the connections?
Our ‘everyday’ is becoming increasingly connected. How can we design meaningfully and responsibly in a connected world? Rather than looking at the Internet of Things merely in terms of efficiency or profit, this session explores, using examples, how we can be sensitive to how products fit into our lives and society at large, and how to bring this to bear on how connected products are designed and valued. The session is the launch of a series of IoT design workshops across the 3 TUs.
An Introduction to Mozilla Webmaker (with X-Ray Goggles update)
These slides were an introduction to some of the other Mozilla projects at the "Firefox student ambassador training camp", held at Mozilla Taipei on 27 July 2013. IT focuses on Mozilla Webmaker (Thimble, Popcorn Maker, X-Ray Goggles, Teach the Web and Maker Party) and also mentions Open Badges (2M Better Futures). This presentation formed part of the Mozilla Taiwan Community's involvement in the day. They have been updated with new screenshots for X-Ray Goggles, now back with the other Webmaker Tools.
Quick Summary
• Introduction
• Mozilla Foundation
• Mozilla Webmaker
• Thimble, X-Ray Goggles & Popcorn Maker
• A Gallery of Makes
• Teach the Web
• Maker Party
• Open Badges
Recommended
Newbytes NullHyd
Over 1.5 million customer records were stolen from T-Mobile Czech Republic by an employee. The records included names, email addresses, account numbers, but not location or traffic data. T-Mobile claims the perpetrator was caught trying to sell the database.
A hacking group in Russia allegedly used malware called Lurk to steal over 1.7 billion roubles (US $25.4 million) from bank accounts in Russia. Authorities arrested 50 people in connection with the scheme.
Github warned that a number of user accounts had been compromised through a password reuse attack related to recent data breaches at LinkedIn, MySpace, Tumblr and other sites that exposed over 642 million passwords.
Securitynewsbytes
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive function. Exercise causes chemical changes in the brain that may help protect against mental illness and improve symptoms.
Damiano Gui professore presso @IED Torino, “Agent Anatomy Canvas – Un framewo...
Damiano Gui professore presso @IED Torino, “Agent Anatomy Canvas – Un framewo...Associazione Digital Days
Il corso in Digital Applications and Technologies, parte del biennio specialistico in Transdisciplinary Design, ha esplorato l’impatto dell’intelligenza artificiale sul design e sulla professione del designer. Ha focalizzato sull’integrazione dell’IA per creare esperienze aumentate basate sull’empatia e sull’inclusione, contrastando la complessità delle reti neurali. Durante l’intervento, è stato presentato il framework sviluppato e sono stati mostrati esempi pratici tratti dai progetti degli studenti, evidenziando l’approccio interdisciplinare del corso e il suo focus sulla mobilità urbana.An Introduction to Mozilla Webmaker
These slides were an introduction to some of the other Mozilla projects at the "Firefox student ambassador training camp", held at Mozilla Taipei on 27 July 2013. IT focuses on Mozilla Webmaker (Thimble, Popcorn Maker, X-Ray Goggles, Teach the Web and Maker Party) and also mentions Open Badges (2M Better Futures). This presentation formed part of the Mozilla Taiwan Community's involvement in the day,
Quick Summary
• Introduction
• Mozilla Foundation
• Mozilla Webmaker
• Thimble, X-Ray Goggles & Popcorn Maker
• A Gallery of Makes
• Teach the Web
• Maker Party
• Open Badges
Soulitarian City: Looking for the Hacker Ethic in Glasgow by Pat Kane, The Pl...
A presentation to Urban Learning Space, by Pat Kane, author of The Play Ethic (http://www.theplayethic.com), on digital identities and practices in Glasgow, Oct 19th, 2006. See http://urbanlearningspace.org/assets/events/event.php?id=238917
Seminar 2.1 rob curran
CoderDojo is a global volunteer-led community that organizes free coding clubs for young people aged 7-17. The clubs, called Dojos, are focused on developing skills like creativity, collaboration, and problem solving through peer learning and mentoring. Dojos have spread to over 600 locations across 45 countries since starting in 2011 in Ireland. The movement aims to give more young people the opportunity to learn coding skills by reaching 100,000 regular attendees and 1,500 Dojos across 60 countries in the next 3 years.
DRIVE | things to things - where are the connections?
Our ‘everyday’ is becoming increasingly connected. How can we design meaningfully and responsibly in a connected world? Rather than looking at the Internet of Things merely in terms of efficiency or profit, this session explores, using examples, how we can be sensitive to how products fit into our lives and society at large, and how to bring this to bear on how connected products are designed and valued. The session is the launch of a series of IoT design workshops across the 3 TUs.
An Introduction to Mozilla Webmaker (with X-Ray Goggles update)
These slides were an introduction to some of the other Mozilla projects at the "Firefox student ambassador training camp", held at Mozilla Taipei on 27 July 2013. IT focuses on Mozilla Webmaker (Thimble, Popcorn Maker, X-Ray Goggles, Teach the Web and Maker Party) and also mentions Open Badges (2M Better Futures). This presentation formed part of the Mozilla Taiwan Community's involvement in the day. They have been updated with new screenshots for X-Ray Goggles, now back with the other Webmaker Tools.
Quick Summary
• Introduction
• Mozilla Foundation
• Mozilla Webmaker
• Thimble, X-Ray Goggles & Popcorn Maker
• A Gallery of Makes
• Teach the Web
• Maker Party
• Open Badges
The real value of open source: ROI and beyond
The slides from my presentation, "The real value of open source: ROI and beyond" from LinuxWochen Austria and Drupal Business Days Vienna 2012. - jam | Jeffrey A. McGuire | Acquia Manager of Community Affairs | jam@acquia.com
015 Essay Example Cite An Step Version How To Website Thatsno
This document provides instructions for creating an account and requesting a paper writing service from the website HelpWriting.net. It outlines a 5-step process: 1) Create an account with an email and password. 2) Complete an order form with instructions, sources, and deadline. 3) Review bids from writers and choose one. 4) Receive the paper and authorize payment if satisfied. 5) Request revisions until satisfied, with a refund option for plagiarism.
Improve your web writing skills
This document summarizes a workshop on improving editorial skills for charities. The workshop covers how to write content for charity websites that answers people's questions concisely, focuses on the audience, and moves them to take action. Attendees will learn a blueprint for effective web copywriting and a framework for writing content that is easy to read and understand.
Every page is page one baker
The document discusses how technical communication needs to adapt to the web, where every page acts as a starting point and readers navigate non-sequentially. It outlines principles for creating "Every Page is Page One" (EPPO) topics that can be read in any order, such as being self-contained, establishing context, having a specific purpose, staying at one level of detail, and linking richly. EPPO topics conform to types and assume readers are qualified to navigate independently. The approach contrasts with books, which require linear reading and can't accommodate unpredictable entry points.
#OPENcocreation workshop
The document announces a workshop on open co-creation involving NGOs, cultural activists, and civil society. It provides details on the workshop's goals (to inspire and guide the development of open projects), date/time (March 12 from 10am-5pm), location (online), and intended participants (professionals from the third sector/NGOs and end-users, partners of cultural/social institutions, developers, designers). The agenda includes discussions of open content/processes, examples of open projects, scenario forecasting for open projects, rapid prototyping through visual brainstorming, presentations and evaluation of prototypes, and establishing implementation backlogs.
Academics use of iPads at UoH
1) The document discusses academics' use of iPads at the University of Houston (UoH). It presents data on iPad users' demographics, skills, and support needs.
2) It finds that iPad users range in skills from basic to power users, and require varying levels of support. The most popular iPad apps for academics are GoodReader, Notes, and Notability.
3) The document concludes that iPads are a new technology rather than just lightweight laptops, and that digital literacy skills are more important than the device itself.
Evaluating academics' use of ipads for academic practices
Slides for the "Teacher Training and Technologies Conference", March 1, 2013 at University of Huddersfield.
Open and Closed - A New Cultural Economy
The document discusses the transition from closed systems to open systems in media and culture. It contrasts the traditional "closed system" model of tightly controlling content and users with an emerging "open system" model of freely sharing content and fostering collaboration. Some key aspects of the open system discussed include an increased emphasis on trust between brands and users, paying for content with attention, engagement or money, and making money through advertising or monetizing user contributions instead of restrictions.
Hardware security testing 101 (Null - Delhi Chapter)
Arun Mane is the founder and director of AmynaSec Labs. He is a security speaker and trainer who has presented at many conferences including Defcon, Blackhat, Nullcon, and HITB. His areas of expertise include security testing of IoT devices, connected vehicles, medical devices, and industrial control systems. Some common issues he finds include devices being publicly accessible, having backdoors, hardcoded credentials, and crypto or web application management problems. His testing methodology involves assessing web and mobile applications, embedded device communications, hardware testing through reverse engineering, and analyzing communication protocols and stored data.
Osint primer
This document outlines an agenda for a presentation on open-source intelligence (OSINT) gathering techniques. The agenda includes an introduction to OSINT, different types of intelligence gathering, a scenario example, OSINT gathering tactics and tools like Shodan, TheHarvester and Google dorks, applications of OSINT, a demonstration, references for OSINT, and a conclusion. Key OSINT tools that will be demonstrated include Twitter, Shodan, TheHarvester and Google dorks for gathering information from public online sources.
SSRF exploit the trust relationship
This document provides an overview of server-side request forgery (SSRF) vulnerabilities, including what SSRF is, its impact, common attacks, bypassing filters, and mitigations. SSRF allows an attacker to induce the application to make requests to internal or external servers from the server side, bypassing access controls. This can enable attacks on the server itself or other backend systems and escalate privileges. The document discusses techniques for exploiting trust relationships and bypassing blacklists/whitelists to perform SSRF attacks. It also covers blind SSRF and ways to detect them using out-of-band techniques. Mitigations include avoiding user input that can trigger server requests, sanitizing input, whitelist
Nmap basics
Nmap is a network scanning tool that can perform port scanning, operating system detection, and version detection among other features. It works by sending TCP and UDP packets to a target machine and examining the response, comparing it to its database to determine open ports and operating system. There are different scanning techniques that can be used like TCP SYN scanning, UDP scanning, and OS detection. Nmap also includes a scripting engine that allows users to write scripts to automate networking tasks. The presentation concludes with demonstrating Nmap's features through some examples.
Metasploit primary
The document provides an introduction and overview of the Metasploit Framework. It defines key terms like vulnerability, exploit, and payload. It outlines the scenario of testing a subnet to find vulnerabilities. It describes the main features of msfconsole like searching for modules, using specific modules, and configuring options. It promotes understanding and proper use, emphasizing that Metasploit alone does not make someone a hacker.
Api security-testing
1) The document provides guidance on testing APIs for security weaknesses, including enumerating the attack surface, common tools to use, what to test for (e.g. authentication, authorization, injections), and demo apps to practice on.
2) It recommends testing authentication and authorization mechanisms like tokens, injections attacks on state-changing requests, and how data is consumed client-side.
3) The document also discusses testing for denial of service conditions, data smuggling through middleware, API rate limiting, and cross-origin requests.
Introduction to TLS 1.3
TLS 1.3 is an update to the Transport Layer Security protocol that improves security and privacy. It removes vulnerable optional parts of TLS 1.2 and only supports strong ciphers to implement perfect forward secrecy. The handshake process is also significantly shortened. TLS 1.3 provides security benefits by removing outdated ciphers and privacy benefits by enabling perfect forward secrecy by default, ensuring only endpoints can decrypt traffic even if server keys are compromised in the future.
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...n|u - The Open Security Community
This document provides an introduction to hacking mainframes in 2020. It begins with an overview of mainframe systems and terminology. It then discusses reconnaissance methods like port scanning and credential theft to gain initial access. Next, it covers conducting internal reconnaissance to escalate privileges by exploiting surrogate users, APF authorized libraries, and UNIX privilege escalation techniques. The document aims to provide enough context for curiosity about hacking mainframe systems.Talking About SSRF,CRLF
The document discusses CRLF injection and SSRF vulnerabilities. CRLF injection occurs when user input is directly parsed into response headers without sanitization, allowing special characters to be injected. SSRF is when a server is induced to make HTTP requests to domains of an attacker's choosing, potentially escalating access. Mitigations include sanitizing user input, implementing whitelists for allowed domains/protocols, and input validation.
Building active directory lab for red teaming
The document provides an overview of Active Directory, including its components and how it is used to centrally manage users, computers, and other objects within a network. It discusses key Active Directory concepts such as forests, domains, organizational units, users, computers, and domain trusts. It also provides step-by-step instructions for setting up an Active Directory lab environment for red teaming purposes and integrating a client machine into the domain.
Owning a company through their logs
A security engineer discusses how logs and passive reconnaissance can reveal sensitive information like AWS credentials. The engineer searched for open Jenkins and SonarQube instances which led to discovering Slack channels containing AWS access keys. Key lessons are to know your boundaries, automate mundane tasks, don't presume systems mask secrets, and persistence is important in security work.
Introduction to shodan
Shodan is a search engine that indexes internet-connected devices and provides information about devices, banners, and metadata. It works by generating random IP addresses and port scans to retrieve banner information from devices. This information is then stored in a searchable database. Users can search Shodan's database using filters like country, city, IP address, operating system, and ports. Shodan can be accessed through its website or command line interface. While useful for security research, Shodan also raises privacy and security concerns by revealing information about unprotected devices.
Cloud security
This document outlines an agenda for discussing cloud security. It begins with an introduction to cloud computing and deployment models. It then discusses challenges of cloud computing and why cloud security is important. Specific threats like data breaches and account hijacking are listed. The document reviews the shared responsibility model and scope of security in public clouds. It describes cloud security penetration testing methods like static and dynamic application testing. Finally, it provides prerequisites and methods for conducting cloud penetration testing, including reconnaissance, threat modeling, and following standard testing methodologies.
Detecting persistence in windows
This document discusses several techniques for maintaining persistence on Windows systems, including modifying accessibility features, injecting into image file execution options, using AppInit DLLs, application shimming, BITS jobs, registry run keys, and Windows Management Instrumentation event subscriptions. It provides details on how each technique works, common implementations, required privileges, relevant data sources, and example event log entries.
More Related Content
Similar to Null Open Security Community - Hyderabad Chapter
The real value of open source: ROI and beyond
The slides from my presentation, "The real value of open source: ROI and beyond" from LinuxWochen Austria and Drupal Business Days Vienna 2012. - jam | Jeffrey A. McGuire | Acquia Manager of Community Affairs | jam@acquia.com
015 Essay Example Cite An Step Version How To Website Thatsno
This document provides instructions for creating an account and requesting a paper writing service from the website HelpWriting.net. It outlines a 5-step process: 1) Create an account with an email and password. 2) Complete an order form with instructions, sources, and deadline. 3) Review bids from writers and choose one. 4) Receive the paper and authorize payment if satisfied. 5) Request revisions until satisfied, with a refund option for plagiarism.
Improve your web writing skills
This document summarizes a workshop on improving editorial skills for charities. The workshop covers how to write content for charity websites that answers people's questions concisely, focuses on the audience, and moves them to take action. Attendees will learn a blueprint for effective web copywriting and a framework for writing content that is easy to read and understand.
Every page is page one baker
The document discusses how technical communication needs to adapt to the web, where every page acts as a starting point and readers navigate non-sequentially. It outlines principles for creating "Every Page is Page One" (EPPO) topics that can be read in any order, such as being self-contained, establishing context, having a specific purpose, staying at one level of detail, and linking richly. EPPO topics conform to types and assume readers are qualified to navigate independently. The approach contrasts with books, which require linear reading and can't accommodate unpredictable entry points.
#OPENcocreation workshop
The document announces a workshop on open co-creation involving NGOs, cultural activists, and civil society. It provides details on the workshop's goals (to inspire and guide the development of open projects), date/time (March 12 from 10am-5pm), location (online), and intended participants (professionals from the third sector/NGOs and end-users, partners of cultural/social institutions, developers, designers). The agenda includes discussions of open content/processes, examples of open projects, scenario forecasting for open projects, rapid prototyping through visual brainstorming, presentations and evaluation of prototypes, and establishing implementation backlogs.
Academics use of iPads at UoH
1) The document discusses academics' use of iPads at the University of Houston (UoH). It presents data on iPad users' demographics, skills, and support needs.
2) It finds that iPad users range in skills from basic to power users, and require varying levels of support. The most popular iPad apps for academics are GoodReader, Notes, and Notability.
3) The document concludes that iPads are a new technology rather than just lightweight laptops, and that digital literacy skills are more important than the device itself.
Evaluating academics' use of ipads for academic practices
Slides for the "Teacher Training and Technologies Conference", March 1, 2013 at University of Huddersfield.
Open and Closed - A New Cultural Economy
The document discusses the transition from closed systems to open systems in media and culture. It contrasts the traditional "closed system" model of tightly controlling content and users with an emerging "open system" model of freely sharing content and fostering collaboration. Some key aspects of the open system discussed include an increased emphasis on trust between brands and users, paying for content with attention, engagement or money, and making money through advertising or monetizing user contributions instead of restrictions.
Similar to Null Open Security Community - Hyderabad Chapter (8)
015 Essay Example Cite An Step Version How To Website Thatsno
015 Essay Example Cite An Step Version How To Website Thatsno
Evaluating academics' use of ipads for academic practices
Evaluating academics' use of ipads for academic practices
More from n|u - The Open Security Community
Hardware security testing 101 (Null - Delhi Chapter)
Arun Mane is the founder and director of AmynaSec Labs. He is a security speaker and trainer who has presented at many conferences including Defcon, Blackhat, Nullcon, and HITB. His areas of expertise include security testing of IoT devices, connected vehicles, medical devices, and industrial control systems. Some common issues he finds include devices being publicly accessible, having backdoors, hardcoded credentials, and crypto or web application management problems. His testing methodology involves assessing web and mobile applications, embedded device communications, hardware testing through reverse engineering, and analyzing communication protocols and stored data.
Osint primer
This document outlines an agenda for a presentation on open-source intelligence (OSINT) gathering techniques. The agenda includes an introduction to OSINT, different types of intelligence gathering, a scenario example, OSINT gathering tactics and tools like Shodan, TheHarvester and Google dorks, applications of OSINT, a demonstration, references for OSINT, and a conclusion. Key OSINT tools that will be demonstrated include Twitter, Shodan, TheHarvester and Google dorks for gathering information from public online sources.
SSRF exploit the trust relationship
This document provides an overview of server-side request forgery (SSRF) vulnerabilities, including what SSRF is, its impact, common attacks, bypassing filters, and mitigations. SSRF allows an attacker to induce the application to make requests to internal or external servers from the server side, bypassing access controls. This can enable attacks on the server itself or other backend systems and escalate privileges. The document discusses techniques for exploiting trust relationships and bypassing blacklists/whitelists to perform SSRF attacks. It also covers blind SSRF and ways to detect them using out-of-band techniques. Mitigations include avoiding user input that can trigger server requests, sanitizing input, whitelist
Nmap basics
Nmap is a network scanning tool that can perform port scanning, operating system detection, and version detection among other features. It works by sending TCP and UDP packets to a target machine and examining the response, comparing it to its database to determine open ports and operating system. There are different scanning techniques that can be used like TCP SYN scanning, UDP scanning, and OS detection. Nmap also includes a scripting engine that allows users to write scripts to automate networking tasks. The presentation concludes with demonstrating Nmap's features through some examples.
Metasploit primary
The document provides an introduction and overview of the Metasploit Framework. It defines key terms like vulnerability, exploit, and payload. It outlines the scenario of testing a subnet to find vulnerabilities. It describes the main features of msfconsole like searching for modules, using specific modules, and configuring options. It promotes understanding and proper use, emphasizing that Metasploit alone does not make someone a hacker.
Api security-testing
1) The document provides guidance on testing APIs for security weaknesses, including enumerating the attack surface, common tools to use, what to test for (e.g. authentication, authorization, injections), and demo apps to practice on.
2) It recommends testing authentication and authorization mechanisms like tokens, injections attacks on state-changing requests, and how data is consumed client-side.
3) The document also discusses testing for denial of service conditions, data smuggling through middleware, API rate limiting, and cross-origin requests.
Introduction to TLS 1.3
TLS 1.3 is an update to the Transport Layer Security protocol that improves security and privacy. It removes vulnerable optional parts of TLS 1.2 and only supports strong ciphers to implement perfect forward secrecy. The handshake process is also significantly shortened. TLS 1.3 provides security benefits by removing outdated ciphers and privacy benefits by enabling perfect forward secrecy by default, ensuring only endpoints can decrypt traffic even if server keys are compromised in the future.
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...n|u - The Open Security Community
This document provides an introduction to hacking mainframes in 2020. It begins with an overview of mainframe systems and terminology. It then discusses reconnaissance methods like port scanning and credential theft to gain initial access. Next, it covers conducting internal reconnaissance to escalate privileges by exploiting surrogate users, APF authorized libraries, and UNIX privilege escalation techniques. The document aims to provide enough context for curiosity about hacking mainframe systems.Talking About SSRF,CRLF
The document discusses CRLF injection and SSRF vulnerabilities. CRLF injection occurs when user input is directly parsed into response headers without sanitization, allowing special characters to be injected. SSRF is when a server is induced to make HTTP requests to domains of an attacker's choosing, potentially escalating access. Mitigations include sanitizing user input, implementing whitelists for allowed domains/protocols, and input validation.
Building active directory lab for red teaming
The document provides an overview of Active Directory, including its components and how it is used to centrally manage users, computers, and other objects within a network. It discusses key Active Directory concepts such as forests, domains, organizational units, users, computers, and domain trusts. It also provides step-by-step instructions for setting up an Active Directory lab environment for red teaming purposes and integrating a client machine into the domain.
Owning a company through their logs
A security engineer discusses how logs and passive reconnaissance can reveal sensitive information like AWS credentials. The engineer searched for open Jenkins and SonarQube instances which led to discovering Slack channels containing AWS access keys. Key lessons are to know your boundaries, automate mundane tasks, don't presume systems mask secrets, and persistence is important in security work.
Introduction to shodan
Shodan is a search engine that indexes internet-connected devices and provides information about devices, banners, and metadata. It works by generating random IP addresses and port scans to retrieve banner information from devices. This information is then stored in a searchable database. Users can search Shodan's database using filters like country, city, IP address, operating system, and ports. Shodan can be accessed through its website or command line interface. While useful for security research, Shodan also raises privacy and security concerns by revealing information about unprotected devices.
Cloud security
This document outlines an agenda for discussing cloud security. It begins with an introduction to cloud computing and deployment models. It then discusses challenges of cloud computing and why cloud security is important. Specific threats like data breaches and account hijacking are listed. The document reviews the shared responsibility model and scope of security in public clouds. It describes cloud security penetration testing methods like static and dynamic application testing. Finally, it provides prerequisites and methods for conducting cloud penetration testing, including reconnaissance, threat modeling, and following standard testing methodologies.
Detecting persistence in windows
This document discusses several techniques for maintaining persistence on Windows systems, including modifying accessibility features, injecting into image file execution options, using AppInit DLLs, application shimming, BITS jobs, registry run keys, and Windows Management Instrumentation event subscriptions. It provides details on how each technique works, common implementations, required privileges, relevant data sources, and example event log entries.
Frida - Objection Tool Usage
Frida is a dynamic instrumentation toolkit that allows injecting JavaScript into applications. Objection is a runtime mobile exploration toolkit powered by Frida that helps assess the security of mobile apps. It supports iOS and Android. Objection allows exploring apps by listing classes, methods, and injecting scripts to enable dynamic analysis like dumping keychain entries.
OSQuery - Monitoring System Process
Osquery is an open source tool that allows users to perform SQL queries on their system to retrieve information. It supports various platforms and makes it easy to get details about the system. Osquery consists of Osqueryi, Osqueryd, and Osqueryctl components. Basic queries can be run in user context mode to view system information, configuration, and tables. Osqueryd runs in daemon mode and can be configured using packs and decorators to monitor specific events and files. Osqueryctl is used to control the Osquery daemon process.
DevSecOps Jenkins Pipeline -Security
This document discusses DevSecOps, beginning with an introduction from Tibin Lukose. It then covers some challenges in DevSecOps such as developers lacking security skills, cultural challenges, and difficulties balancing speed, coverage and accuracy in testing. The document proposes a model DevSecOps company, Infosys, and provides a demo and contact information for any further questions.
Extensible markup language attacks
This document provides an introduction to XML and related technologies like libxml2, XSLT, XPath, and XML attacks. It discusses the basics of XML including elements, tags, attributes, and validation. It also describes common XML libraries and tools like libxml2, xmllint, and xsltproc. Finally, it provides an overview of different types of XML attacks like XML injection, XPath injection, XXE, and XSLT injection.
Linux for hackers
This document contains the agenda for a presentation on Linux for hackers. The agenda includes discussing the Linux file system, managing virtual machines smartly, command line tools like alias, tee, pipe, grep, cut, uniq, and xargs, Bash scripting, logging, and proxy chaining. It also mentions demonstrating several commands and tools. The presentation aims to be an interactive session where the presenter will answer any questions from attendees.
Android Pentesting
This document provides an overview of Android penetration testing. It discusses requirements and tools for static and dynamic analysis, including Apptitude, Genymotion, and ADB. It covers analyzing the Android manifest and classes.dex files. It also describes vulnerabilities in WebViews, such as loading cleartext content and improper SSL handling. Best practices for coding securely on Android are also presented.
More from n|u - The Open Security Community (20)
Hardware security testing 101 (Null - Delhi Chapter)
Hardware security testing 101 (Null - Delhi Chapter)
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Recently uploaded
বাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
বাংলাদেশের অর্থনৈতিক সমীক্ষা ২০২৪ [Bangladesh Economic Review 2024 Bangla.pdf] কম্পিউটার , ট্যাব ও স্মার্ট ফোন ভার্সন সহ সম্পূর্ণ বাংলা ই-বুক বা pdf বই " সুচিপত্র ...বুকমার্ক মেনু 🔖 ও হাইপার লিংক মেনু 📝👆 যুক্ত ..
আমাদের সবার জন্য খুব খুব গুরুত্বপূর্ণ একটি বই ..বিসিএস, ব্যাংক, ইউনিভার্সিটি ভর্তি ও যে কোন প্রতিযোগিতা মূলক পরীক্ষার জন্য এর খুব ইম্পরট্যান্ট একটি বিষয় ...তাছাড়া বাংলাদেশের সাম্প্রতিক যে কোন ডাটা বা তথ্য এই বইতে পাবেন ...
তাই একজন নাগরিক হিসাবে এই তথ্য গুলো আপনার জানা প্রয়োজন ...।
বিসিএস ও ব্যাংক এর লিখিত পরীক্ষা ...+এছাড়া মাধ্যমিক ও উচ্চমাধ্যমিকের স্টুডেন্টদের জন্য অনেক কাজে আসবে ...
BBR 2024 Summer Sessions Interview Training
Qualitative research interview training by Professor Katrina Pritchard and Dr Helen Williams
How to deliver Powerpoint Presentations.pptx
"How to make and deliver dynamic presentations by making it more interactive to captivate your audience attention"
How to Create a More Engaging and Human Online Learning Experience
How to Create a More Engaging and Human Online Learning Experience Wahiba Chair Training & Consulting
Wahiba Chair's Talk at the 2024 Learning Ideas Conference. Hindi varnamala | hindi alphabet PPT.pdf
हिंदी वर्णमाला पीपीटी, hindi alphabet PPT presentation, hindi varnamala PPT, Hindi Varnamala pdf, हिंदी स्वर, हिंदी व्यंजन, sikhiye hindi varnmala, dr. mulla adam ali, hindi language and literature, hindi alphabet with drawing, hindi alphabet pdf, hindi varnamala for childrens, hindi language, hindi varnamala practice for kids, https://www.drmullaadamali.com
Traditional Musical Instruments of Arunachal Pradesh and Uttar Pradesh - RAYH...
Traditional Musical Instruments of Arunachal Pradesh and Uttar Pradesh
Bed Making ( Introduction, Purpose, Types, Articles, Scientific principles, N...
Topic : Bed making
Subject : Nursing Foundation
What is Digital Literacy? A guest blog from Andy McLaughlin, University of Ab...
What is Digital Literacy? A guest blog from Andy McLaughlin, University of Aberdeen
LAND USE LAND COVER AND NDVI OF MIRZAPUR DISTRICT, UP
This Dissertation explores the particular circumstances of Mirzapur, a region located in the
core of India. Mirzapur, with its varied terrains and abundant biodiversity, offers an optimal
environment for investigating the changes in vegetation cover dynamics. Our study utilizes
advanced technologies such as GIS (Geographic Information Systems) and Remote sensing to
analyze the transformations that have taken place over the course of a decade.
The complex relationship between human activities and the environment has been the focus
of extensive research and worry. As the global community grapples with swift urbanization,
population expansion, and economic progress, the effects on natural ecosystems are becoming
more evident. A crucial element of this impact is the alteration of vegetation cover, which plays a
significant role in maintaining the ecological equilibrium of our planet.Land serves as the foundation for all human activities and provides the necessary materials for
these activities. As the most crucial natural resource, its utilization by humans results in different
'Land uses,' which are determined by both human activities and the physical characteristics of the
land.
The utilization of land is impacted by human needs and environmental factors. In countries
like India, rapid population growth and the emphasis on extensive resource exploitation can lead
to significant land degradation, adversely affecting the region's land cover.
Therefore, human intervention has significantly influenced land use patterns over many
centuries, evolving its structure over time and space. In the present era, these changes have
accelerated due to factors such as agriculture and urbanization. Information regarding land use and
cover is essential for various planning and management tasks related to the Earth's surface,
providing crucial environmental data for scientific, resource management, policy purposes, and
diverse human activities.
Accurate understanding of land use and cover is imperative for the development planning
of any area. Consequently, a wide range of professionals, including earth system scientists, land
and water managers, and urban planners, are interested in obtaining data on land use and cover
changes, conversion trends, and other related patterns. The spatial dimensions of land use and
cover support policymakers and scientists in making well-informed decisions, as alterations in
these patterns indicate shifts in economic and social conditions. Monitoring such changes with the
help of Advanced technologies like Remote Sensing and Geographic Information Systems is
crucial for coordinated efforts across different administrative levels. Advanced technologies like
Remote Sensing and Geographic Information Systems
9
Changes in vegetation cover refer to variations in the distribution, composition, and overall
structure of plant communities across different temporal and spatial scales. These changes can
occur natural.
Beyond Degrees - Empowering the Workforce in the Context of Skills-First.pptx
Iván Bornacelly, Policy Analyst at the OECD Centre for Skills, OECD, presents at the webinar 'Tackling job market gaps with a skills-first approach' on 12 June 2024
Philippine Edukasyong Pantahanan at Pangkabuhayan (EPP) Curriculum
(𝐓𝐋𝐄 𝟏𝟎𝟎) (𝐋𝐞𝐬𝐬𝐨𝐧 𝟏)-𝐏𝐫𝐞𝐥𝐢𝐦𝐬
𝐃𝐢𝐬𝐜𝐮𝐬𝐬 𝐭𝐡𝐞 𝐄𝐏𝐏 𝐂𝐮𝐫𝐫𝐢𝐜𝐮𝐥𝐮𝐦 𝐢𝐧 𝐭𝐡𝐞 𝐏𝐡𝐢𝐥𝐢𝐩𝐩𝐢𝐧𝐞𝐬:
- Understand the goals and objectives of the Edukasyong Pantahanan at Pangkabuhayan (EPP) curriculum, recognizing its importance in fostering practical life skills and values among students. Students will also be able to identify the key components and subjects covered, such as agriculture, home economics, industrial arts, and information and communication technology.
𝐄𝐱𝐩𝐥𝐚𝐢𝐧 𝐭𝐡𝐞 𝐍𝐚𝐭𝐮𝐫𝐞 𝐚𝐧𝐝 𝐒𝐜𝐨𝐩𝐞 𝐨𝐟 𝐚𝐧 𝐄𝐧𝐭𝐫𝐞𝐩𝐫𝐞𝐧𝐞𝐮𝐫:
-Define entrepreneurship, distinguishing it from general business activities by emphasizing its focus on innovation, risk-taking, and value creation. Students will describe the characteristics and traits of successful entrepreneurs, including their roles and responsibilities, and discuss the broader economic and social impacts of entrepreneurial activities on both local and global scales.
How to Make a Field Mandatory in Odoo 17
In Odoo, making a field required can be done through both Python code and XML views. When you set the required attribute to True in Python code, it makes the field required across all views where it's used. Conversely, when you set the required attribute in XML views, it makes the field required only in the context of that particular view.
Chapter wise All Notes of First year Basic Civil Engineering.pptx
Chapter wise All Notes of First year Basic Civil Engineering
Syllabus
Chapter-1
Introduction to objective, scope and outcome the subject
Chapter 2
Introduction: Scope and Specialization of Civil Engineering, Role of civil Engineer in Society, Impact of infrastructural development on economy of country.
Chapter 3
Surveying: Object Principles & Types of Surveying; Site Plans, Plans & Maps; Scales & Unit of different Measurements.
Linear Measurements: Instruments used. Linear Measurement by Tape, Ranging out Survey Lines and overcoming Obstructions; Measurements on sloping ground; Tape corrections, conventional symbols. Angular Measurements: Instruments used; Introduction to Compass Surveying, Bearings and Longitude & Latitude of a Line, Introduction to total station.
Levelling: Instrument used Object of levelling, Methods of levelling in brief, and Contour maps.
Chapter 4
Buildings: Selection of site for Buildings, Layout of Building Plan, Types of buildings, Plinth area, carpet area, floor space index, Introduction to building byelaws, concept of sun light & ventilation. Components of Buildings & their functions, Basic concept of R.C.C., Introduction to types of foundation
Chapter 5
Transportation: Introduction to Transportation Engineering; Traffic and Road Safety: Types and Characteristics of Various Modes of Transportation; Various Road Traffic Signs, Causes of Accidents and Road Safety Measures.
Chapter 6
Environmental Engineering: Environmental Pollution, Environmental Acts and Regulations, Functional Concepts of Ecology, Basics of Species, Biodiversity, Ecosystem, Hydrological Cycle; Chemical Cycles: Carbon, Nitrogen & Phosphorus; Energy Flow in Ecosystems.
Water Pollution: Water Quality standards, Introduction to Treatment & Disposal of Waste Water. Reuse and Saving of Water, Rain Water Harvesting. Solid Waste Management: Classification of Solid Waste, Collection, Transportation and Disposal of Solid. Recycling of Solid Waste: Energy Recovery, Sanitary Landfill, On-Site Sanitation. Air & Noise Pollution: Primary and Secondary air pollutants, Harmful effects of Air Pollution, Control of Air Pollution. . Noise Pollution Harmful Effects of noise pollution, control of noise pollution, Global warming & Climate Change, Ozone depletion, Greenhouse effect
Text Books:
1. Palancharmy, Basic Civil Engineering, McGraw Hill publishers.
2. Satheesh Gopi, Basic Civil Engineering, Pearson Publishers.
3. Ketki Rangwala Dalal, Essentials of Civil Engineering, Charotar Publishing House.
4. BCP, Surveying volume 1
Gender and Mental Health - Counselling and Family Therapy Applications and In...
A proprietary approach developed by bringing together the best of learning theories from Psychology, design principles from the world of visualization, and pedagogical methods from over a decade of training experience, that enables you to: Learn better, faster!
Recently uploaded (20)
বাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
বাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
How to Create a More Engaging and Human Online Learning Experience
How to Create a More Engaging and Human Online Learning Experience
Traditional Musical Instruments of Arunachal Pradesh and Uttar Pradesh - RAYH...
Traditional Musical Instruments of Arunachal Pradesh and Uttar Pradesh - RAYH...
Bed Making ( Introduction, Purpose, Types, Articles, Scientific principles, N...
Bed Making ( Introduction, Purpose, Types, Articles, Scientific principles, N...
What is Digital Literacy? A guest blog from Andy McLaughlin, University of Ab...
What is Digital Literacy? A guest blog from Andy McLaughlin, University of Ab...
LAND USE LAND COVER AND NDVI OF MIRZAPUR DISTRICT, UP
LAND USE LAND COVER AND NDVI OF MIRZAPUR DISTRICT, UP
Beyond Degrees - Empowering the Workforce in the Context of Skills-First.pptx
Beyond Degrees - Empowering the Workforce in the Context of Skills-First.pptx
Philippine Edukasyong Pantahanan at Pangkabuhayan (EPP) Curriculum
Philippine Edukasyong Pantahanan at Pangkabuhayan (EPP) Curriculum
Chapter wise All Notes of First year Basic Civil Engineering.pptx
Chapter wise All Notes of First year Basic Civil Engineering.pptx
Gender and Mental Health - Counselling and Family Therapy Applications and In...
Gender and Mental Health - Counselling and Family Therapy Applications and In...
Null Open Security Community - Hyderabad Chapter
- 1. Null Open Security Community
- 2. Imran Mohammed # Penetration Tester # Null Moderator @imran_naseem Raghunath # Penetration Tester # Null Moderator @k427h1k
- 4. Who are we ? What do we do ? Whats in it for you ? How you can be a part of it ?
- 5. n|u Who are we ?
- 8. n|u What do we do ?
- 16. All these, to Make the websphere a secure place
- 17. n|u Whats in for you ?
- 24. n|u How you can be a part of it ?
- 28. Thanks !
- 29. Credits All Icons has been taken from thenounproject.com collection. All credits goes to the respective authors."India" Symbol by Vigneshwar Shankar, from thenounproject.com collection "Certificate" Symbol by VuWorks, from thenounproject.com collection "Community" Symbol by Rémy Médard, from thenounproject.com collection "User" Symbol by Luis Prado, from thenounproject.com collection "Drink" Symbol by Natan Gorelik, from thenounproject.com collection "Dream" Symbol by James Stone, from thenounproject.com collection "Network" Symbol by Sam Ahmed, from thenounproject.com collection "Open Door" Symbol by Tak Imoto, from thenounproject.com collection "Plugin" Symbol by Florian Huber, from thenounproject.com collection
- 30. Credits "Ribbon" Symbol by Nicolò Bertoncin, from thenounproject.com collection "Invisible" Symbol by Andrew Cameron, from thenounproject.com collection "Announcement" Symbol by Olivier Guin, from thenounproject.com collection "Worker" Symbol by Bart Laugs, from thenounproject.com collection "Email" Symbol by Douglas Nash from thenounproject.com collection "Email" Symbol by Henrique Sales, from thenounproject.com collection "Memory" Symbol by Andrew J. Young, from thenounproject.com collection "Money" Symbol by Nathan Thomson, from thenounproject.com collection "Gears" Symbol by Dima Yagnyuk, from thenounproject.com collection “Ninja” symbol by John O'Shea, from thenounproject.com collection “Newspaper” symbol by John Caserta, from The Noun Project