BSidesSF 2018 - From Bounties to Bureaucracy
https://youtu.be/6KZGmPpUvLI
Bug bounty programs are nearly ubiquitous today, but that wasn’t always the case. When the Zero Day Initiative (ZDI) was founded in 2005, bug bounty programs were considered to be a rare and somewhat controversial commodity. Now they are seen as an indispensable means for companies to acquire bug reports. Our initial goals were similar. The ZDI program extended our own research team by leveraging the methodologies, expertise, and time of others around the globe. Imagine adding more than 3,000 independent researchers from around the world to your team. Having the program asymmetrically enhanced our research capabilities through vulnerability acquisition. The program also provided the data needed to protect our customers while the affected vendor worked on a patch. Since that time, the program has awarded more than $15 million USD while ensuring nearly 4,000 0-day exploits were patched by vendors, all of which makes the computing landscape a safer space and makes ZDI the world’s largest vendor-agnostic bug bounty program.https://youtu.be/6KZGmPpUvLI
YouTube
BSidesSF 2018 - From Bounties to Bureaucracy (Brian Gorenc)
Brian Gorenc - From Bounties to Bureaucracy - The Hidden Market Factors of Exploit Economics Bug bounty programs are nearly ubiquitous today, but that wasn’t...
BSidesSF 2018 - Keep it Like a Secret: When Android Apps Contain Private Keys
https://youtu.be/-VjK0FMmGm4
We all have secrets. And the way we keep them secrets is by not telling them to others. Either because of inappropriate design, or by sheer accident, many publicly-available Android applications include private keys in them. By processing over 1 million applications from the Google Play Store, I have found thousands of private key files that are not private. Discovered private keys include PGP private keys, SSH private keys, OpenVPN keys, Android app signing keys, iOS app signing keys, HTTPS web server keys, and more. Password cracking techniques will also be discussed. Especially with password-protected private keys that are not used by the Android applications themselves, the key details and potential uses for them cannot be known until they are cracked.https://youtu.be/-VjK0FMmGm4
YouTube
BSidesSF 2018 - Keep it Like a Secret: When Android Apps Contain Private Keys (Will Dormann)
Will Dormann - Keep it Like a Secret: When Android Apps Contain Private Keys We all have secrets. And the way we keep them secrets is by not telling them to ...
BSidesSF 2018 - Simple. Open. Mobile: A Look at the Future of Strong Authentication
https://youtu.be/vKrYYOSlriA
In recent years, a growing demand to replace passwords and better protect online users has fueled the creation of new, open authentication standards that would deliver on the simplicity and security consumers require. Unlike early predecessors, newly-developed FIDO U2F and FIDO 2 standards provide strong authentication and high privacy with characteristics that have eluded previous hardware tokens – elegance and simplicity. Impossible you think? This session will change your mind and eventually protect your online accounts.https://youtu.be/vKrYYOSlriA
YouTube
BSidesSF 2018 - Simple. Open. Mobile: A Look at the Future of Strong Authentication (Jerrod Chong)
Jerrod Chong - Simple. Open. Mobile: A Look at the Future of Strong Authentication In recent years, a growing demand to replace passwords and better protect ...
BSidesSF 2018 - Crimeware Chaos: Empirical Analysis of HTTP-Based Botnet C&C Panels
https://youtu.be/QnFOuDiihpU
Cybercriminals deploy crimeware for conducting nefarious operations on the Internet. Crimeware is managed on a large scale through deployment of centralized portals known as Command and Control (C&C) panels. C&C panels are considered as attackers’ primary operating environment through which crimewave is controlled and updated at regular intervals of time. C&C panels also store information stolen from the compromised machines as a part of the data exfiltration activity. This empirical study highlights the analysis of thousands of real world C&C web Uniform Resource Locators (URLs) used for deployment of Crimeware such as botnets, key-loggers, ransomware, Point-of-Sales (PoS) malware, etc., to unearth the characteristics of HTTP-based C&C panels. This study gives a statistical view on design and technologies opted by the crimeware authors to deploy HTTP-based C&C panels.https://youtu.be/QnFOuDiihpU
YouTube
BSidesSF 2018 - Crimeware Chaos: Empirical Analysis of HTTP-Based Botnet C&C Panels (Aditya K Sood)
Aditya K Sood - Crimeware Chaos: Empirical Analysis of HTTP-Based Botnet C&C Panels Cybercriminals deploy crimeware for conducting nefarious operations on th...
Forwarded from Netsec
Trump administration may throw out PPD-20, the approval process for cyber warfare - CyberScoop
https://ift.tt/2KtUwKs
Submitted May 02, 2018 at 08:46PM by ga-vu
via reddit https://ift.tt/2w8chvG
https://ift.tt/2KtUwKs
Submitted May 02, 2018 at 08:46PM by ga-vu
via reddit https://ift.tt/2w8chvG
Cyberscoop
Trump administration may throw out the approval process for cyberwarfare
The White House is looking to rescind PPD-20, a memorandum that helps guide the use of government-backed hacking operations.
Secure your Cookies (Secure and HttpOnly flags)
https://blog.dareboost.com/en/2016/12/secure-cookies-secure-httponly-flags/
Cookies are omnipresent all over the web as they let publishers store data directly on the user’s web browser. Especially used to identify the user session allowing the web server to recognize him all along his browsing, cookies usually contain sensitive data. You have to properly protect them.https://blog.dareboost.com/en/2016/12/secure-cookies-secure-httponly-flags/
Dareboost Blog
Secure your Cookies (Secure and HttpOnly flags)
Cookies are widely used throughout the Web because they allow publishers to store data directly on the user's Web browser. They're particularly used to identify the user's session, allowing the web server to recognize the user as they navigate through the…
Campus Party Brasilia 2018
🕴🏼 Mais informações: @Alcyon_Junior
Pessoal, a OWASP Brasília, tem mais uma boa noticia hoje para todos os nossos integrantes ... chegou os códigos de desconto para quem quiser participar da Campus Party Brasília 2018!!!!!!Para ganhar o desconto, basta usar o link http://quero.party/cpbsb2codigo com o código: OWASP-CPBSB2Informações importantes!- O valor do link já esta com o desconto aplicado, porém você só consegue efetuar a compra com o seu código.- Para adquirir o camping, você tem que ativar primeiro o ingresso individual, depois a opção para adquirir o camping separadamente ira aparecer no dashboard do campuse.roAbraços e curta seu desconto!🕴🏼 Mais informações: @Alcyon_Junior
Forwarded from Full Python Alchemist
GRequests: Asynchronous Requests
https://github.com/kennethreitz/grequests
🐍 @FullPythonAlchemist
GRequests allows you to use Requests with Gevent to make asynchronous HTTP Requests easily.https://github.com/kennethreitz/grequests
🐍 @FullPythonAlchemist
GitHub
GitHub - spyoungtech/grequests: Requests + Gevent = <3
Requests + Gevent = <3. Contribute to spyoungtech/grequests development by creating an account on GitHub.
HttpWatch
https://www.httpwatch.com/httpgallery/
🕴🏼 @Phantasm_Lab
This gallery provides an overview of HTTP, from its basic operation to more complex techniques used on commercial web sites. Each section describes how a particular aspect of HTTP works and provides working examples that you can try with HttpWatch.https://www.httpwatch.com/httpgallery/
🕴🏼 @Phantasm_Lab
Forwarded from Zer0 to her0
Red team tips
The following "red team tips" were posted by Vincent Yiu (@vysecurity) over Twitter for about a year.
Including tools, exploitation and intelligence tips.
https://vincentyiu.co.uk/red-team-tips/
@fromzer0tohero
The following "red team tips" were posted by Vincent Yiu (@vysecurity) over Twitter for about a year.
Including tools, exploitation and intelligence tips.
https://vincentyiu.co.uk/red-team-tips/
@fromzer0tohero
Forwarded from Pavel Durov
Thank you, each and every one of the 12,000+ people who stood up to support the freedom of internet and Telegram today in central Moscow.
https://goo.gl/fEFtQb
https://goo.gl/fEFtQb
Forwarded from Pavel Durov
This media is not supported in your browser
VIEW IN TELEGRAM
Moscow today.
MySQL username and password leaked in developer.valvesoftware.com via source code dislosure
https://hackerone.com/reports/291057
🕴🏼 @Phantasm_Lab
Hey there it looks like you are relying on a noscript that cleans up your backup process on developer.valvesoftware.comhttps://hackerone.com/reports/291057
🕴🏼 @Phantasm_Lab
HackerOne
Valve disclosed on HackerOne: MySQL username and password leaked in...
Hey there it looks like you are relying on a noscript that cleans up your backup process on developer.valvesoftware.com:
`/noscripts/final_cleanup.sh`:
```
# Remove files post cleanup
rm -r...
`/noscripts/final_cleanup.sh`:
```
# Remove files post cleanup
rm -r...
Hard Coded username and password in registry
https://hackerone.com/reports/291200
🕴🏼 @Phantasm_Lab
I was using a tool called RegShot to take a snap shot of the registry before and after installation in order to see what changes were being made in the registry and I discovered hard-coded credentialshttps://hackerone.com/reports/291200
🕴🏼 @Phantasm_Lab
HackerOne
Kaspersky disclosed on HackerOne: Hard Coded username and password...
I was using a tool called RegShot to take a snap shot of the registry before and after installation in order to see what changes were being made in the registry and I discovered hard-coded...
Hardcoded Credentials Stored in Registry Kaspersky Lab
https://medium.com/@bluedangerforyou/hardcoded-credentials-stored-in-registry-kaspersky-lab-849ee7ea19e0
https://medium.com/@bluedangerforyou/hardcoded-credentials-stored-in-registry-kaspersky-lab-849ee7ea19e0
Medium
Hardcoded Credentials Stored in Registry Kaspersky Lab
I was using a tool called RegShot to take a snap shot of the registry before and after installation in order to see what changes were…
#Perfil #HackerOne #Series
exploitprotocol
https://hackerone.com/exploitprotocol
🕴🏽 @Phantasm_Lab
exploitprotocol
Reputation: 6363 Rank: 34thhttps://hackerone.com/exploitprotocol
🕴🏽 @Phantasm_Lab
HackerOne
HackerOne profile - exploitprotocol
Aditya is an application security consultant with over 5 years of experience. He has experience and expertise in web, mobile applications, OSINT, External Network Pentest. He is the author of some...