Chetan (Che) Bhatia’s Post

Critical Sprocket finding: NFS Shares World Readable. During a pentest we discovered that the client's NFS server was exporting shares without restricting access based on hostname, IP or IP range. Here's the finding we sent to the client 👇

Search for your IP to see if it was in the Fortigate breach list, here on my Github. If you find your IP listed, message me, so we can assess your exposure. #belsen #belesn #fortigate

[CVE-2024-21552: CRITICAL] All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server. https://lnkd.in/eY7Ey7r3

Phantom from Vulnlab involved decrypting a veracrypt drive having a vyos configuration file, performing resource based constrained delegation with spn less user. https://lnkd.in/d3EQsrRf

My active response bash script with iptables has evolved to 500,000 plus lines of iptables rules. It has a mind of it's own based on set parameters. It will continue to evolve since malicious acts are most common. My blocklist is closer to 700 IP Addresses. I have added redundancy.

Day 6 with @kirat_tw Cohort 2.0!🚀 ▸ Learned about authentication ▸ Got a brief intro to hashing and encryption ▸ Explored JSON Web Tokens (JWT) used in the authentication process How do you handle security in your applications?🤖

🔒 Just completed a Server-Side Vulnerability Lab: User Role Controlled by Request Parameter! 🛡️ In this lab, I used Burp Suite to intercept and modify requests. By tweaking parameters, I was able to elevate my user role from standard to admin. This allowed me to access the administrator panel and delete an admin profile named Carlos. #WebSecurity #BurpSuite #EthicalHacking PortSwigger

In this video, I demonstrate how I hacked an Active Directory target using 4 attack paths!

Quick fix: Remove cups-browsed, block UDP port 631

hi everyone, in the 0x10. HTTPS SSL project I learned about HTTPS SSL 2 main roles, encrypting traffic and what HAproxy SSL termination means, the first task of the project was about configuring my domain zone so that the subdomain `www` points to my load-balancer IP (lb-01), and write a Bash script that will display information about the subdomains, in this task I used `dig` to fetch the information needed and manipulate it with `awk` command, the second task I create a certificate using `certbot` and configure the `HAproxy` load balancer to accept encrypted traffic for the subdomain `www`. link to the repository: https://lnkd.in/e-dG4uTX Day 1 of #100DaysOfALXSE