Cybeats’ Post

APIDetector - Efficiently Scan For Exposed Swagger Endpoints Across Web Domains And Subdomains Amazing tool developed by my friend Rafael Brinhosa‏ https://lnkd.in/dsT_4AXt #cybersecurity #cloud #cloudsec #cloudsecurity #malware #cyber #pentesting #malwareanalysis #infosec #redteam #malwarehunting #hacking #infosec #threathunting #bugbounty #tools #offensivesecurity #cyber #future #computersecurity #cloudsecurity #opensource #infosec #aws #awsattack #offensivesecurity #defensivesecurity #PAM

This does NOT replace penetration testing. This does NOT replace penetration testing. This does NOT replace penetration testing. In my opinion, the most critical sentence from this announcement is: --- And while GitHub is clearly confident enough to suggest that the vast majority of autofix suggestions will be correct, the company does note that “a small percentage of suggested fixes will reflect a significant misunderstanding of the codebase or the vulnerability.” --- In other words, a manual penetration test is still a crucial part of your cybersecurity strategy. https://lnkd.in/ewgcabar

I have finished my writeup of DownUnderCTF challenges for this year 📝! Had a great time playing with the MQCybersec people and showing some newer CTF players the ropes. I didn't complete as many as I'd have hoped but participating in two CTFs at the same time is hard... (you'll see what I mean soon 👀). If you have time or interest please check it out here: https://lnkd.in/gKZnjvyF #hacking #ctf #hacker #cybersecurity #writeup #downunderctf

Revival Hijack supply-chain attack threatens 22,000 PyPI packages Threat actors are utilizing an attack called "Revival Hijack," where they register new PyPi projects using the names of previously deleted packages to conduct supply chain attacks. The technique "could be used to hijack 22K existing PyPI packages and subsequently lead to hundreds of thousands of malicious package downloads," the researchers say. Hijacking popular projects “Revival Hijack” is an attack vector that involves registering a new project with the name of a package that has been removed from the PyPI platform. By doing so, a threat actor could push malicious code to developers pulling updates. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

Backslash: Innovative Approach to Application Security Scanning - Backslash Security tooling scans application code for opensource vulnerabilities and source code weaknesses, via reachability analysis that allows Backslash to ignore code paths that are not actually executed. https://lnkd.in/eyd--Wpj

🚨 Hash Collision Vulnerabilities: A Security Nightmare! 🚨 In my latest blog post, I tackle one of the most critical threats in cybersecurity—hash collisions. These vulnerabilities can lead to serious security breaches, making it a must-know topic for anyone passionate about cryptography and cyber defense. 🔑 This is the second installment in my series on pwnable.kr Capture the Flag puzzles, where I break down the mechanics of hash collisions and how they can be exploited. Don’t miss it! 🧠 Check out the full post here: https://lnkd.in/gUr9km2N #CyberSecurity #HashCollisions #CTF #Infosec #TechBlog #Learning

Number Usage in Passwords, (Wed, Jan 17th): Numbers are often used in passwords to add complexity. Passwords submitted to honeypots are also often found within pre-existing passwords lists, containing compromised credentials. What numbers are most commonly used? #SANS #Cybersecurity

https://lnkd.in/guazH-KM Shoutout to JFrog for their research on this attack, and their effort in mitigating the attack by taking up the available deleted packages! The technique "could be used to hijack 22K existing PyPI packages and subsequently lead to hundreds of thousands of malicious package downloads," the researchers say. Threat actors push malicious code to developers pulling updates. If you work in Development, DevOps, Research and Development, or are a power user at your organization using the PyPI code repository, I’d recommend reading this article for further context. For anyone in information security or the defensive side of security, it’s an interesting read in general as PyPI’s security has policies in place to mitigate typosquatting, but this is a more sophisticated variation of that technique that they have yet to find a resolution for to protect against all the discovered vulnerabilities. Here’s also a link to JFrog’s research. Stay vigilant! #cybersecurity #SDLC https://lnkd.in/gx626XKY

I am excited to share my recent cybersecurity endeavors! 🛡️ In the past few weeks, I've strengthened my digital defenses with a series of proactive measures on my Raspberry Pi. Here's a glimpse into what I've been up to: 🔍 Opencanary Honeypot: Setting up an Opencanary honeypot has been an eye-opener! It's like having a digital watchdog that keeps a keen eye on any suspicious activity attempting to breach my UFW (Uncomplicated Firewall). With real-time monitoring, I can stay one step ahead of potential threats and fortify my network security. I set up the honeypot to receive mail alerts as soon as some interaction from outside happens with the ports being monitored. (https://lnkd.in/gZgXV5ES) 🔄 Weekly Backups: Recognizing the importance of data loss prevention from my recent project on data sanitization, I've implemented a robust weekly backup system on my Raspberry Pi. With automated backups stored on encrypted storage devices, I can rest easy knowing that my data is safeguarded against unforeseen events. (https://lnkd.in/gemTzRkj) 🔐 VeraCrypt Encryption: Taking data security to the next level, I've encrypted my storage devices using VeraCrypt. This adds an extra layer of protection to my sensitive information, ensuring it remains safe and secure, even in the face of potential breaches. 💻 Remote Decryption: To streamline access to my encrypted storage devices, I've developed a user-friendly web interface to securely decrypt them remotely without compromising security. (https://lnkd.in/g9PBJzch) These projects taught me crucial knowledge on implementing security measures in real and potentially vulnerable systems. These initiatives reflect my unwavering commitment to cybersecurity and data protection. By staying proactive and leveraging innovative solutions, I'm empowering myself to navigate today's digital landscape with confidence. #Cybersecurity #DataProtection #RaspberryPi #Veracrypt #Opencanary #RemoteAccess #InfoSec #DigitalDefense

🚀 New Blog Post Alert! 🚀 I’m thrilled to share my latest blog post: “Walkthrough: Escalate My Privileges”! 🛡️🔍 As a cybersecurity enthusiast, I’ve crafted a detailed guide on how to navigate and solve vulnerable machines on popular platforms. 🔗 Check out the blog here In this post, you’ll discover: Step-by-step instructions for privilege escalation Key tools and techniques used in penetration testing Real-world scenarios and practical tips Whether you’re just starting out or looking to enhance your skills, this guide has something for everyone. Let’s connect and dive deeper into the world of cybersecurity! #CyberSecurity #EthicalHacking #PenetrationTesting #InfoSec #TechBlog #CyberNetwork #NetworkDefense #SecurityOperations #ThreatIntelligence