Pierre-Albéric TROUPLIN

🚨Here is a great discovery of a very interesting repository around a SOC based on 4 Open Source tools: 👉Wazuh: Real-time monitoring and alerting for security events. 👉DFIR-IRIS: Streamlined incident response and forensics capabilities. 👉Shuffle: Automated workflow management to streamline security processes. 👉MISP: Open source threat intelligence platform. ✅T-Guard - Nusantara ✔Verified link to the official repository 🔗https://lnkd.in/eRw6y3Ts ⚙As a reminder, T-Guard is a solution around a SOC that leverages the strength of leading open-source tools to provide solid protection for your digital assets. 🤝The integrated approach ensures comprehensive defense against a wide range of cyber threats, making your systems and data safer and more secure. ✅Complete documentation (installation, configuration) ✔Verified link to the official page 🔗https://lnkd.in/eSwQwYAc 🖼Image Source: https://lnkd.in/emmNMJcg 👨 💻Set up your Labs and have fun!! #soc #opensource #security #cybersecurity #blueteam

5

🚗🔧 Ready to dive into the world of car hacking? Join us for the OWASP Ottawa Car Hacking Workshop on July 4th, 2024, with the RAMN Platform! 📅 Date: July 4th, 2024 🕔 Time: 5:00 PM EST 📍 Location: 150 Louis-Pasteur Private, University of Ottawa, Room 117 Event Details: 🔹 5:00 PM: Arrival, setup, mingle, and enjoy some PIZZA! 🍕 🔹 5:30 PM: Introduction to OWASP Ottawa, public announcements, and the hands-on Car Hacking Workshop led by Ben Gardiner. Note: This is a ticketed event due to the limited number of test environments. Get your FREE ticket here: https://lnkd.in/et5ddW3b If tickets are sold out, join the waitlist for a chance to participate. Mandatory Pre-Workshop Preparation: Laptop with GIT installed. Clone the repo: https://lnkd.in/e3pa2pX8 Install Python. Install all dependencies before the class. About the Workshop: Learn the basics of car hacking, focusing on CAN, UDS on CAN, and using scapy with the RAMN platform. This practical course will provide you with the skills to explore and test automotive networks. Speakers: Ben Gardiner - Mr. Gardiner is an independent consultant at Yellow Flag Security, Inc. presently working to secure commercial transportation at the NMFTA and connected transportation with TMNA. With more than ten years of professional experience in embedded systems design and a lifetime of hacking experience, Gardiner has a deep knowledge of the low-level functions of operating systems and the hardware with which they interface. Don’t miss this unique opportunity to learn from the best and connect with fellow enthusiasts. See you there! #OWASP #Ottawa #CarHacking #Cybersecurity #AI #AppSec #LLM #Networking

22

Which Specific Areas of Our Infrastructure Will Be Tested During a Pentest? This is a common question IT leaders ask when considering a penetration test. Here’s a guide to help you understand what to expect. If you find it valuable, please like so that it may help someone else! 🫱🏼‍🫲🏽 𝐒𝐡𝐨𝐫𝐭 𝐀𝐧𝐬𝐰𝐞𝐫: Anything explicitly part of the scope can be tested. However, there are important considerations to keep in mind: 𝐎𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞𝐬 𝐌𝐚𝐭𝐭𝐞𝐫  As we discussed in our last post about the goals of a pentest, the most important thing is to define clear objectives. A good pentesting company will help you plan these objectives and suggest specific areas to test based on your needs. 𝐓𝐚𝐢𝐥𝐨𝐫𝐞𝐝 𝐓𝐞𝐬𝐭𝐢𝐧𝐠 𝐏𝐥𝐚𝐧  A pentesting firm will tailor a testing plan to your organization’s unique needs. They will suggest areas to test after understanding your objectives, ensuring the plan aligns with your business goals. 𝐁𝐮𝐬𝐢𝐧𝐞𝐬𝐬 𝐈𝐦𝐩𝐚𝐜𝐭 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬 Conducting a business impact analysis is crucial. This helps identify the biggest risks specific to your business and understand your relevant attack surface. Focusing on critical aspects first allows you to allocate resources effectively and manage smaller risks as your security matures. 𝐏𝐫𝐨𝐝𝐮𝐜𝐭𝐢𝐨𝐧 𝐄𝐧𝐯𝐢𝐫𝐨𝐧𝐦𝐞𝐧𝐭 𝐂𝐨𝐧𝐬𝐢𝐝𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐬 Testing production environments without a solid plan can lead to disruptions and potential access to sensitive data. It's essential to: • Limit testing to environments that mirror production but do not contain actual production data. • Plan for any potential impacts to production environments to avoid legal and operational issues. 𝐂𝐨𝐧𝐬𝐮𝐥𝐭𝐚𝐧𝐜𝐲 𝐚𝐧𝐝 𝐄𝐱𝐩𝐞𝐫𝐭𝐢𝐬𝐞 With the right pentest firm, you will be equipped to: • Identify the areas that pose the biggest risks to your business. • Focus on those critical areas with well-defined objectives and scope. • Develop a strong plan for testing production environments if necessary. A successful pentest is more than just checking boxes. It’s about aligning the testing with your business goals and ensuring the key areas of your infrastructure are thoroughly assessed. This approach gives you the confidence that your most critical assets are protected. Have you considered these factors in your pentesting plans? Share your thoughts below! P.S. If you found this helpful, feel free to share it with your network ♻️ #Cybersecurity #PenetrationTesting #Ecommerce #Technology

3

Credential Dumping: Fake Services ✴ Twitter: https://lnkd.in/e7yRpDpY Have you ever heard about Fake services? Credential dumping can be performed by exploiting open ports like ftp, telnet, smb, etc. to gain sensitive data like usernames and passwords. 🔁 ftp 🔁telnet 🔁vnc 🔁SMB 🔁http_basic 🔁Pop3 🔁SMTP 🔁Postgresql 🔁MsSql 🔁http_ntlm 🔁MsSql #infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

208

2 commentaires

Credential Dumping: Fake Services ✴ Twitter: https://lnkd.in/e7yRpDpY Have you ever heard about Fake services? Credential dumping can be performed by exploiting open ports like ftp, telnet, smb, etc. to gain sensitive data like usernames and passwords. 🔁 ftp 🔁telnet 🔁vnc 🔁SMB 🔁http_basic 🔁Pop3 🔁SMTP 🔁Postgresql 🔁MsSql 🔁http_ntlm 🔁MsSql #infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

124

2 commentaires

Credential Dumping: Fake Services ✴ Twitter: https://lnkd.in/e7yRpDpY Have you ever heard about Fake services? Credential dumping can be performed by exploiting open ports like ftp, telnet, smb, etc. to gain sensitive data like usernames and passwords. 🔁 ftp 🔁telnet 🔁vnc 🔁SMB 🔁http_basic 🔁Pop3 🔁SMTP 🔁Postgresql 🔁MsSql 🔁http_ntlm 🔁MsSql #infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

80

2 commentaires

Credential Dumping: Fake Services ✴ Twitter: https://lnkd.in/e7yRpDpY Have you ever heard about Fake services? Credential dumping can be performed by exploiting open ports like ftp, telnet, smb, etc. to gain sensitive data like usernames and passwords. 🔁 ftp 🔁telnet 🔁vnc 🔁SMB 🔁http_basic 🔁Pop3 🔁SMTP 🔁Postgresql 🔁MsSql 🔁http_ntlm 🔁MsSql #infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

152

1 commentaire

Next to grace the lineup for the GSE NL Conference 2024 is Jimmy Nggeolima / Security Workgroup! Join us in the Athene 1 room for his insightful presentation, "Managing NPA Users in RACF Using Ansible." Don't miss this opportunity to learn from an expert in the field and enhance your skills in managing RACF with Ansible. Save the date and get ready for an inspiring session! #GSENL2024 #Ansible #RACF #EnterpriseIT

5

From Dangerous PHP Functions to Webshell Hunting: https://lnkd.in/dbfAK9Ki #threathunting #php #webshell #cybersecurity #security #informationsecurity

3

(Cybersecurity News) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced a new initiative called “Vulnrichment” aimed at enriching Common Vulnerabilities and Exposures (CVE) records with additional metadata to help organizations better prioritize vulnerability remediation efforts. The Vulnrichment project, hosted in a public GitHub repository, will focus on adding key data points to CVE records, including: 🔹 Common Platform Enumeration (CPE) identifiers 🔹 Common Vulnerability Scoring System (CVSS) scores Common Weakness Enumeration (CWE) identifiers 🔹 Exploitation status (e.g. proof-of-concept, active exploitation) CISA is leveraging its Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree model to assess and categorize vulnerabilities based on factors like exploitation status, technical impact, and potential for automated exploitation. #vulnerabilities #vulnerability #CISA #CVE #remediation #software #vendors #vrm #riskmanagement #vendorriskmanagement #governance #automatedexoloitation #governance #openvrm #buckler https://lnkd.in/eQ-P6VdK

1

🚨 Security Update Alert! Progress Telerik Report Server has received a critical security update addressing the authentication bypass vulnerability, CVE-2024-4358. With a CVSS score of 9.8, this vulnerability allows unauthenticated attackers to potentially access sensitive data and server functionalities, posing significant risks to organizations worldwide. Discovered by Sina Kheirkhah of the Summoning Team in partnership with Trend Micro Zero Day Initiative, the flaw affects versions up to and including 2024 Q1 (10.0.24.305). The good news is that no exploitation has been reported in the wild yet, giving us a crucial window for preventive action. To protect your systems: ✅ Upgrade to the latest version, 2024 Q2 (10.1.24.514) ✅ Regularly check for unauthorized user entries at {host}/Users/Index With SOCRadar’s Vulnerability Intelligence and Attack Surface Management (ASM) modules, stay ahead of threats. These tools offer timely updates and actionable insights, helping you safeguard your digital assets effectively. 🔗 Explore the latest CVEs and trends https://lnkd.in/de3sxqkz #CyberSecurity #TelerikReportServer #VulnerabilityManagement #ThreatIntelligence

7

🧑‍💻 The #PHP development team recently announced #security updates that addressed several vulnerabilities. The vulnerabilities are mostly critical and involve arbitrary command injection, authentication bypass, and Denial-of-Service #DoS risks. 📌 The widespread use of PHP exposes a large #attacksurface that may be #vulnerable to these exploits, reiterating the urgency for patching. For details🔻 https://lnkd.in/dJJAnwwP

11

🚨 Critical RCE Vulnerability (CVE-2024-4577) in PHP on Windows: Patch Now Available! A critical remote code execution (RCE) vulnerability has been discovered in PHP on Windows, posing a significant risk to systems. The vulnerability, tracked as CVE-2024-4577, allows attackers to execute arbitrary code, potentially compromising sensitive data and system integrity. 🔒 Patch Now Available: To secure your systems, you must take immediate action. Ensure you apply the latest patch to protect against potential exploits. Stay informed and safeguard your infrastructure by reading the full details in our latest article: https://lnkd.in/dXsB58ey #cybersecurity #infosec #RCE #PHP #Windows #patchupdate

8

🚨 UPDATE: Critical PHP Vulnerability (CVE-2024-4577) Added to KEV Catalog The Cybersecurity and Infrastructure Security Agency (CISA) has issued a crucial alert, adding the critical PHP vulnerability, CVE-2024-4577, to its Known Exploited Vulnerabilities (KEV) Catalog. Recently exploited in attacks deploying TellYouThePass ransomware, this vulnerability poses significant risks to federal enterprises. CISA urges organizations to act swiftly, mandating federal organizations to patch this vulnerability by July 3, 2024. Read more on: https://lnkd.in/dXsB58ey #CyberSecurity #CISA #PHPVulnerability #CVE20244577 #RansomwareProtection #CyberAlert

8