Trouver du contenu similaire

👨‍💻 HTTP Security Headers. • X-Content-Type-Options Header; • Reflected File Download (RFD); • CORS Deception; • Clickjacking; • XSS (Cross-Site Scripting); • SSL/TLS Stripping (MITM); • Cookie Hijacking; • CSRF (Cross-Site Request Forgery); • Information Disclosure Attacks; • Cache-Control Header; • Content-Disposition Header; • Cross-Origin Resource Policy (CORP); • Extra HTTP Header Injection; • Content-Encoding Header; • Access-Control-Allow-Origin Header; • X-Rate-Limit and X-Forwarded Headers; • X-Content-Type-Options Header; • XSS and CSRF Protection; • Content-Security-Policy (CSP). #devsecops

👨‍💻 File Upload Vulnerabilities. • Attack Scenario: Insecure File Content: - 2. Non-Compliant Code: Insecure File Upload Example; - Issues with Non-Compliant Code; - 3. Compliant Code: Secure File Upload Example; - Security Enhancements in Compliant Code; - 4. Reverse Access Control; • Magic Byte Exploits and Securing File Uploads: - Magic Bytes Overview; - Attack Scenario: Magic Byte Exploit; - Non-Compliant Code: Insecure File Upload Example; - Issues with Non-Compliant Code; - Compliant Code: Secure File Upload Example; - Security Enhancements in Compliant Code; - Reverse Access Control; - Process of Securing File Uploads; • Config Overwrite: - Attack Scenario: Configuration Overwrite and Null Byte Injection; - Non-Compliant Code: Insecure File Upload Example; - Issues with Non-Compliant Code; - Compliant Code: Secure File Upload Example; - Security Enhancements in Compliant Code; - Reverse Access and Configuration Overwrite; - Process of Securing File Uploads; • Insecure Handler: - Attack Scenario: Insecure Handler Exploit; - Non-Compliant Code: Insecure File Upload Example; - Issues with Non-Compliant Code; - Compliant Code: Secure File Upload Example; - Security Enhancements in Compliant Code; - Insecure Handler and Web Shell Exploit; - Process of Securing File Uploads. #devsecops

👨‍💻Attacking OpenStack. • Apply Restrictive File Permissions: - Incorrect Example; - Writing Files with Python; - Correct Example; - Secure File Creation in Python; - Verify Ownership and Group; • Avoid Dangerous File Parsing and Object Serialization Libraries; • Python Pipes to Avoid Shells; • Unvalidated URL redirect; • Validate Certificates on HTTPS Connections to Avoid Man-in-the-Middle Attacks; • Create, Use, and Remove Temporary Files Securely: - Python Temporary File Handling; • Restrict Path Access to Prevent Path Traversal; • Use Subprocess Securely; • Parameterize Database Queries: - SQLAlchemy; - MySQL; - PostgreSQL (Psycopg2); • Protect Sensitive Data in Config Files from Disclosure: - Consequences; - Example Log Entries; • Use Secure Channels for Transmitting Data: - Clear Example; - Less Obvious Example; • Escape User Input to Prevent XSS Attacks; • Resources. #devsecops

👨‍💻 Attacking CI/CD. • CI Debug Enabled; • Default permissions used on risky events; • Github Action from Unverified Creator used; • If condition always evaluates to true; • Injection with Arbitrary External Contributor Input; • Job uses all secrets; • Unverified Script Execution; • Arbitrary Code Execution from Untrusted Code Changes; • Unpinnable CI component used; • Pull Request Runs on Self-Hosted GitHub Actions Runner; • Mitigation Strategies; • Example GitHub Actions Workflow; • RCE via Git Clone; • Resources. #devsecops

👨‍💻 Attacking Policy. • Open Policy Agent — это open-source-инструмент контроля доступа, основанный на политиках, который создан в 2016 году и с тех пор стабильно развивается. Сейчас он входит в каталог дипломированных проектов Cloud Native Computing Foundation (CNCF). Его используют Netflix, Pinterest, TripAdvisor и другие компании. • В этой статье перечислены определенные векторы атак, которые могут быть вызваны неправильной конфигурацией Open Policy Agent: • Allowed Repositories; • Automount Service Account Token for Pod; • Block Endpoint Edit Default Role; • Block Services with type LoadBalancer; • Block NodePort; • Block Wildcard Ingress; • Disallow Interactive TTY Containers; • Step-by-Step Instructions; • Allow Privilege Escalation in Container; • Step-by-Step Instructions; • Privileged Container; • Read Only Root Filesystem; • Host Networking Ports; • App Armor; • SELinux V2; • Resources. #devsecops

👨‍💻 Attacking Secrets. • Secrets in private repositories; - Scenario: An Attacker Scanning a Private Repository for Secrets; - Example Commands and Codes; • User Credentials in CI Pipelines; - Scenario: An Adversary Exploiting CI Pipeline Credentials; - Example Commands and Codes; • Azure Key-Vault Authentication Abuse; - Azure’s Documentation Overview; • Practical Implementation: Azure’s Authentication Solution; - Steps for Compromising Azure Key Vault; • Azure Key Vault RBAC; • Ansible Vault Secret; - Generating a Hash for Cracking; - Cracking the Hash; - Decrypting the File; • Vault-Backend-Migrator; - Threats; • Kubernetes Sealed Secrets; • chamber; • Vault Secrets Operator; • Buttercup Weak Password; • teller manipulate files; • BlackBox; • Conclusion; - Attacker's Next Steps. #devsecops

🏰 DevSecOps Security Architecture. • Honeypot Network and Services in DevSecOps Security Architecture; • Flume log collection; • Kafka Knowledge System; • Zookeeper Knowledge System; • ElastAlert ES Alarm Tool; • Elastic Knowledge System; • Real IP address Detection; • Nginx configuration log format; • Container security tools; • osquery operating system detection and analysis; • jumpserver open source bastion server; • wazuh Host Intrusion Detection System; • Bro Network Security Monitoring; • GitHub Information Leak Monitoring; • Application layer denial of service attacks; • Slowloris; • Resources. #DevSecOps

👨‍💻 Attacking .NET • Code Access Security (CAS); • AllowPartiallyTrustedCaller attribute (APTCA); • Distributed Component Object Model (DCOM); • Timing vulnerabilities with CBC-mode symmetric; • Race Conditions; • App Secrets; • XML Processing; • Timing attacks; • ViewState is love; • Formatter Attacks; • TemplateParser; • ObjRefs. ➡️https://blog.devsecopsguides.com/p/attacking-net #DevSecOps

👩‍💻 Attacking Rust. - Cargo Dependency Confusing; - Unsafe Code Usage; - Integer Overflow; - Panics in Rust Code; - memory leaks; - Uninitialized memory; - Foreign Function Interface; - OOB Read plus; - race condition to escalate privileges; - TOCTAU race condition; - out-of-bounds array access; - References. #devsecops

👩‍💻 Attacking NodeJS Application. - Use flat Promise chains; - Set request size limits; - Do not block the event loop; - Perform input validation; - Perform output escaping; - Perform application activity logging; - Monitor the event loop; - Take precautions against brute-forcing; - Use Anti-CSRF tokens; - Prevent HTTP Parameter Pollution; - Do not use dangerous functions; - Use appropriate security headers; - Listen to errors when using EventEmitter; - Set cookie flags appropriately; - Avoid eval(), setTimeout(), and setInterval(); - Avoid new Function(); - Avoid code serialization in JavaScript; - Use a Node.js security linter; - References. #devsecops

👨‍💻 Attacking APIs \ Атаки на API. • Программный интерфейс приложений (API) - фундаментальный элемент инноваций в современном, движимом приложениями мире. API - важная составляющая современных мобильных, SaaS и веб приложений, используемая в клиентских, партнерских и внутренних приложениях от банковской сферы, сфер розничных продаж и логистики до интернета вещей, автономных автомобилей и умных городов. • По своей природе API раскрывают логику приложения и критичные данные, например, персональные данные, именно поэтому API все чаще становятся целью злоумышленников. Стремительные инновации невозможны без безопасных API. В этой статье рассматриваются общие векторы атак на API и приводятся примеры безопасной разработки. ➡️https://blog.devsecopsguides.com/attacking-apis #devsecops

👨‍💻 Attacking Pipeline. • DevOps resources compromise; • Control of common registry; • Direct PPE (d-PPE); • Indirect PPE (i-PPE); • Public PPE; • Changes in repository; • Inject in Artifacts; • User/Services credentials; • Typosquatting docker registry image; • Resources. #DevOps#DevSecOps