VirtualTam's bookmarks

61. What is "AWS Security Scanner" in my server logs? 2020-07-31

    tags: cloud/aws, network, security

    [ permalink ]

    • https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
    • https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
    • https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html
    • https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/
    • https://aws.amazon.com/blogs/aws/new-host-based-routing-support-for-aws-application-load-balancers/
    • https://aws.amazon.com/about-aws/whats-new/2018/07/elastic-load-balancing-announces-support-for-redirects-and-fixed-responses-for-application-load-balancer/
    • https://www.reddit.com/r/aws/comments/e18e5n/botexploit_what_is_this_trying_to_do_and_how
    • https://www.reddit.com/r/aws/comments/e18e5n/botexploit_what_is_this_trying_to_do_and_how/f8qympp/
    • https://forums.aws.amazon.com/thread.jspa?threadID=316889
    • https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
    • https://www.wired.com/story/capital-one-paige-thompson-case-hacking-spree/
    • https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
    • https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/
    • http://www.thecloudavenue.com/2019/08/how-capital-one-hack-was-achieved-in-aws.html
    • http://www.thecloudavenue.com/2019/11/changes-to-aws-ec2-instance-metadata-service.html
62. How we abused Slack's TURN servers to gain access to internal services | Communication Breakdown 2020-04-09

    tags: cloud/aws, multimedia, network, network/webrtc, security, streaming, video

    [ permalink ]

    • https://webrtchacks.com/
    • https://www.enablesecurity.com/security-assessment/webrtc-pentest/
63. american fuzzy lop - a security-oriented fuzzer 2020-02-24

    tags: fuzzy, input, programming/c, programming/go, programming/testing, security

    [ permalink ]

    • http://lcamtuf.coredump.cx/afl/
    • https://github.com/dvyukov/go-fuzz
64. CFSSL: Cloudflare's PKI and TLS toolkit 2020-02-05

    tags: cryptography, cryptography/certificate, cryptography/certificate-authority, security

    [ permalink ]

    • https://blog.cloudflare.com/introducing-cfssl/
65. rudder-server: Privacy and Security focused Segment-alternative, in Golang and React 2020-01-10

    tags: framework/react, network/http, programming/api, programming/go, route

    [ permalink ]

    • https://rudderlabs.com/
66. SEI CERT C Coding Standard 2020-01-02

    tags: guidelines, programming/c, programming/c++, security

    [ permalink ]

    • https://resources.sei.cmu.edu/library/asset-view.cfm?assetID=454220
    • https://www.informit.com/store/secure-coding-in-c-and-c-plus-plus-9780321822130
67. GitHub - About token scanning 2019-12-31

    tags: secret, security, security/authentication, security/credentials, security/token, source-code-management/git, source-code-management/github

    [ permalink ]

    • https://developer.github.com/partnerships/token-scanning/
    • https://github.blog/2018-10-17-behind-the-scenes-of-github-token-scanning/
    • https://github.blog/2019-08-19-github-token-scanning-one-billion-tokens-identified-and-five-new-partners/
68. hyperscan: High-performance regular expression matching library 2019-12-31

    tags: intel, parser, performance, programming/json, programming/regular-expressions, security

    [ permalink ]

    • https://www.hyperscan.io
    • https://github.blog/2018-10-17-behind-the-scenes-of-github-token-scanning/
    • https://www.hyperscan.io/2017/06/20/regex-set-scanning-hyperscan-re2set/
69. CALOMEL - Open Source Research and Reference 2019-12-21

    tags: bsd, cryptography/encryption, email, linux, network, network/http, security, server, unix, web

    [ permalink ]
70. Let's build a compiler 2019-11-08

    tags: grammar, parser, pascal, security/token, text

    [ permalink ]

    • https://compilers.iecc.com/crenshaw/
71. A look at Go lexer/scanner packages - Fatih Arslan 2019-11-07

    tags: data, grammar, parser, programming/go, security/token, text

    [ permalink ]

    • https://medium.com/@farslan/hcl-parser-family-in-pure-go-86589a5648fb
    • https://github.com/hashicorp/hcl/pull/45
72. hashcat - advanced password recovery 2019-11-04

    tags: cryptography/encryption, cryptography/hash, security, security/password

    [ permalink ]

    • https://hashcat.net/wiki/
    • https://github.com/hashcat/hashcat
73. Docker & UFW 2019-10-24

    tags: linux/container/docker, linux/iptables, network, security, ufw

    [ permalink ]

    • https://github.com/moby/moby#4737
    • https://github.com/docker/for-linux/issues/690
    • https://stackoverflow.com/questions/30383845/what-is-the-best-practice-of-docker-ufw-under-ubuntu
    • https://www.mkubaczyk.com/2017/09/05/force-docker-not-bypass-ufw-rules-ubuntu-16-04/
    • https://www.techrepublic.com/article/how-to-fix-the-docker-and-ufw-security-flaw/
    • https://www.linux.com/news/how-fix-docker-and-ufw-security-flaw/
    • https://svenv.nl/unixandlinux/dockerufw/
    • https://blog.viktorpetersson.com/2014/11/03/the-dangers-of-ufw-docker.html
    • https://news.ycombinator.com/item?id=27613217
74. ssh_scan: A prototype SSH configuration and policy scanner 2019-10-24

    tags: cipher, cryptography/elliptic-curve, cryptography/rsa, mozilla, network/ssh, security

    [ permalink ]

    • https://mozilla.github.io/ssh_scan/
75. GitLab Container Registry | GitLab 2019-10-21

    tags: continuous-integration, continuous-integration/continuous-delivery, linux/container/docker, registry, security/authentication, security/authorization, source-code-management/git, source-code-management/gitlab

    [ permalink ]

    • https://docs.gitlab.com/ce/administration/packages/container_registry.html
    • https://docs.docker.com/registry/deploying/
76. RFC 2222 - Simple Authentication and Security Layer (SASL) 2019-10-21

    tags: email, linux, network/ldap, network/smtp, security, security/authentication, unix

    [ permalink ]

    • https://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer
    • https://tools.ietf.org/html/rfc2444
    • https://tools.ietf.org/html/rfc4422
    • https://tools.ietf.org/html/rfc4752
77. apt - Import the repository signing key behind a proxy - Ask Ubuntu 2019-10-16

    tags: cryptography/pgp, cryptography/pgp/gnupg, gpg, network/http, network/ldap, security

    [ permalink ]
78. ModSecurity: Open Source Web Application Firewall 2019-09-17

    tags: apache, network, network/http-server/apache-httpd, network/proxy, security, web

    [ permalink ]

    • https://github.com/SpiderLabs/ModSecurity
    • https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu
79. NAXSI - an open-source, high performance, low rules maintenance WAF for NGINX 2019-09-17

    tags: linux/kernel, network, network/http, network/http-server/nginx, network/proxy, security

    [ permalink ]

    • https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-naxsi-on-ubuntu-14-04
80. Pomerium, a standardized interface to add access control whether an application itself has authorization or authentication baked-in 2019-09-16

    tags: network/http, network/proxy, programming/api, security, security/authentication, user, web

    [ permalink ]

    • https://github.com/pomerium/pomerium