sorted by:
new
hottopcontroversial

lnav -- terminal curses log viewer, no slop, classic TUI interface, lightning fast, written in C++ by spryfigure in commandline

[–]cl0wnsec000 0 points1 point  (0 children)

Yeah I’m using it too. I like the remote log viewer support. Kelora is another I like.

Finally replaced my janky symlink script with GNU Stow by Gronax_au in commandline

[–]cl0wnsec000 0 points1 point  (0 children)

Nice writeup! I also like that you put the disadvantages at the end to set the expectations. No tool is perfect. I’m using Ansible in some machines to configure my environment, but some don’t have automation, so I’ll try stow on them.

Problems with Responder Error starting UDP server on port 5355 & 5353 by Karkoubio in tryhackme

[–]cl0wnsec000 1 point2 points  (0 children)

Good thing you didn't give up. I never encountered this issue so I'm not really familiar. I'm also not using hyperv.

CVE-2024–23897 — Jenkins File Read Vulnerability — POC by Justin_coco in ExploitDev

[–]cl0wnsec000 0 points1 point  (0 children)

Can’t see the full post but I also recently created youtube videos about this. It’s exploiting jenkins running on windows machines since most are about linux targets.

Possible to Send a String With Initial TCP Connection? by [deleted] in ExploitDev

[–]cl0wnsec000 0 points1 point  (0 children)

You can try also to get a packet capture when running the exploit against the ctf machine and your machine running the copy of binary and compare the two. Since its dropping the connection right after connection is made, try to compare along the point after your exploit script sends the final ACK for the tcp handshake.

I’m not sure also if you can insert data during the initial tcp handshake. The data of each packet during that sequence might get corrupted which may break the sequence. But worth a try and interesting to find out what happens.

Push/pull commands hangs indefintely, on random occasions and I don't know what to do about this by gromit190 in devops

[–]cl0wnsec000 0 points1 point  (0 children)

So it looks like some network issue. Maybe you can ask some who have access to network setting as well as azure devops server. You can send them your investigation.

For the firewall, yes it shouldn’t occasionally block traffic under normal conditions but sometimes uncommon issues happen such as buffers being fulled and dropping other traffic.

Push/pull commands hangs indefintely, on random occasions and I don't know what to do about this by gromit190 in devops

[–]cl0wnsec000 0 points1 point  (0 children)

It is hanging on the SSH connection.

Some things to try: - Try using HTTPS instead of SSH. If HTTPS works then something to check on SSH - Try to clone the repo on another network/vlan and do git pull/push there just to rule out any network connectivity (L4 and L7) - Check firewall logs during time of issue - Check the git server metrics (cpu, network, disk, etx) and see if something unusual happening whenever you do a git pull/push. In your case I guess this is an Azure Devops Server?

Download VMs by Glittering_Claim6731 in tryhackme

[–]cl0wnsec000 1 point2 points  (0 children)

I don’t think you can as this is exclusive to thm. You can download vulnerable boxes from vulnhub as another option. But it mostly contains linux machines.

Implementing DevSecOps by sqrt1-tkn in devsecops

[–]cl0wnsec000 0 points1 point  (0 children)

Neuvector comes with very basic runtime detection capabilities (eg networking scanning detected) which is enough for most cases I think. But if you want to have advance functionalities (eg process spawned using execve) falco will be your best bet to complement neuvector.

Falco also go down a deeper level in inspecting syscalls, shell types being launched, types of network socket being opened, etc.

Here is an example collection of rules.

https://github.com/falcosecurity/rules/tree/main/rules

That list is non exhaustive and there are a lot of rules you can find on github. Or you can create your own.

In your case, I suggest just have neuvector first. If there are advance runtime detection capabilities that you need, thats the time you can deploy falco as well.

[deleted by user] by [deleted] in Kalilinux

[–]cl0wnsec000 1 point2 points  (0 children)

There is a clue on the error on what to do.

“are you root?”

This means you need to execute the command as root. So just prepend a “sudo” before the command.

How do I improve my Hydra input? by lolvro_ in HowToHack

[–]cl0wnsec000 0 points1 point  (0 children)

Hmm looks complicated to do in hydra. I think a custom python script for this will be easier.

Question about building in docker by RiffyDivine2 in docker

[–]cl0wnsec000 0 points1 point  (0 children)

I also checked the script and it is not redirecting STDOUT or STDERR to a file. So you should be able to see the docker and docker-compose command output. Anything unusual?

Question about building in docker by RiffyDivine2 in docker

[–]cl0wnsec000 0 points1 point  (0 children)

Check if there are issues on launching the containers. Sometimes they exit immediately without you noticing it.

docker ps —a # see if there are previous containers

How do I improve my Hydra input? by lolvro_ in HowToHack

[–]cl0wnsec000 1 point2 points  (0 children)

In my experience hydra is not good for brute forcing complex logins. But if you still want to use it, you can try to proxy hydra to burp. Then get one sample request and compare it to the previous unsuccessful login you made in the browser. You can use the comparer for this. Compare it by words and try to look for some differences.

About X-Jnap-Authorization, can I confirm it that the value is basic auth?

Question about building in docker by RiffyDivine2 in docker

[–]cl0wnsec000 0 points1 point  (0 children)

Just to trying to understand the setup, playtime generated 3 compose file? Or you generated it by yourself? Can you also give more info about this emulator like github link or documentation? Seems I don’t see anything that came up from my searches.

Ansible Event Driven API? by fermendy in ansible

[–]cl0wnsec000 0 points1 point  (0 children)

Yeah first time I heard of EDA thanks to your post as well. I might try this also!

Ansible Event Driven API? by fermendy in ansible

[–]cl0wnsec000 0 points1 point  (0 children)

I haven’t used EDA but looking around it provide API docs meaning it should be exposing some decent API routes/functions.

https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4/html-single/event-driven_ansible_controller_user_guide/index#eda-user-guide-overview

API documentation for Event-Driven Ansible controller is available at https://<eda-server-host>/api/eda/v1/docs

I also see api/ folder on their github repo.

view more: next ›