Category: DevSecOps

CVE-2024-6387 is a critical vulnerability in OpenSSH that allows unauthenticated remote code execution, affecting millions of Linux systems. The flaw, named “regreSSHion,” is particularly dangerous because it can be exploited without authentication, making it a significant threat to affected systems.Affected Versions: 8.5p1 to 9.7p1. Stop and Remove Existing OpenSSH Service Install OpenSSH 9.8 Maybe you encounter…

Read More “[Vulnerability] CVE-2024-6387 – Critical vulnerability in OpenSSH” »

To find vulnerabilities on your EC2 Linux instance, including ones related to OpenSSH and other software, you can use several open-source tools. Here are some recommended steps and tools: These tools will help you identify and mitigate vulnerabilities on your EC2 Linux instance. Be sure to regularly update these tools and your system to keep…

Read More “[Security] Find vulnerabilities in your EC2 Linux instance” »

You already have limited access inside the AWS account with the credentials of a compromised IAM user. To find out the name of your IAM user, you have to execute aws iam get-user. There are 3 ways to give permissions to an IAM user: inline policies (aws iam list-user-policies), attached policies (aws iam list-attached-user-policies) and…

Read More “[Security] How to access S3 when you stay at any EC2!” »

Generate Security Scanning Reports Hiện theo cách đơn giản là bạn có rất nhiều tool scanning và bạn cần 1 nơi centralize report of the scanning tool Khi bạn sử dụng 1 tool scan thì bạn config sao cho tool scan will create a report file.Và chúng ta sẽ lưu file đó vào artifact của…

Read More “[DefectDojo] Vulnerability Management and Remediation by DefectDojo” »

Look into Mutation testing. Mutation testing is a type of software testing where certain statements in the source code are changed (or “mutated”) to determine if the test cases can detect the changes. The idea is to ensure that the test suite is robust and can catch defects in the code. Here’s a basic overview…

Read More “[DevSecOps] Mutation testing” »

“Which search engines do Pentesters use during the information gathering phase❓” Today I have a great resource suggestion where you can find the answer to this question❗️🌝 You should definitely add it to your bookmarks.🤞🏻🌸

CrowdSec là một giải pháp mã nguồn mở được thiết kế để bảo vệ máy chủ và ứng dụng của bạn khỏi các cuộc tấn công độc hại. Nó hoạt động dựa trên cơ chế phát hiện và cấm IP dựa trên hành vi độc hại và sau đó chia sẻ các địa chỉ IP…

Read More “[DevSecOps] Use CrowdSec to detect the malicious behaviors in your system.” »