kyoung3412
kyoung3412 on Hacker News
Hackers can use those auomated scans to target security unpatched WordPress web servers. There are approximately 134 IP addresses of v4.8.2 applied websites that have not been vulnerability patched.
It is not necessary to know specific product names to find AWS assets on a cloud attack surface.
Posted by
kyoung3412 on Monday August 22, 2022 @01:32AM
from the show-hn dept.
https://ifh.cc/g/Jlj96j.png
[OSINT TIP] AWS key Credential LeakHow to find Access Key confidential information on Amazon Cloud Services (AWS) very easily
Search the Script tag for the 'AWS.config.update()' function on the 'DynamoDB' or 'S3 Bucket Upload' function on the page using the function AWS SDK or AWS CLI.
Method to determining whether a login page is real or a phishing scam.
The 403 error denies access to clients regardless of their credentials and can act as an indication that the server contains sensitive information.
K-Pop Deepfake 19 Sites hidden by Cloudflare : Sneaky Criminals Hiding Real IP Address with Cloudflare
With a simple HTML meta description search, it was easy to find an SCADA server open to an external network. It's kind a seruious problem due to weak security.
There are many IP's with exposed credentials, many of which are of either Oauth or RESTfull API. A regular check-up with developers need to be conducted. One little mistake such as set up errors can lead to credential leakage, causing catastrophic security damage to both individuals and businesses. However it's kind a serious problem that even Secret Access Key can be seen in the banner of Open Source Scanning tools.There are API Keys with "change" permission, so just one API Key leak can lead to credential leakge or manipulation. A regular check-up with developers need to be conducted to see whether they are caught up with the most recent cyber security tech.
Perhaps the collab tools are one of the most important servers that must be managed appropriately. But there are so many exposed, opened colla tools without any authentication process.
https://blog.criminalip.io/2022/07/01/collaboration-tool-vul... Default configuration should be more secure, but less. I'd say not even 10% of people using Jira or colla tools understand how authentication works between components. Always people think they're safe, it's not their turn. But this is fundamental reason why the critical datsets of enterprises are sold in dark web or forum.
Should be ware of exposed, vulnerable open source automation CI & CD server like Jenkins or RunDeck.
One vulnerable open source CI & CD server leads to major cybersecurity flaws where attackers grasp hundreds of servers in their hands. Here is the article related to Scanning statistics of exposed open source automation server like Jenkins, RunDeck by OSINT threat intel.
It's hard to belive that there were so many exposed open source server(RunDeck, Jenkins) without any authentication process. It's serious security problem that could access just by open source intelligence. It is time to check the server authentication process once again.
Jenkins is one of the most famous Continuous Integration tools and an integral part of DevOps that is often used to integrate various DevOps stages. Recently, Jenkins securiy team disclosed tens of flaws affecting 29 plugins for the Jenkis automation server, most of them are yet to be patched.
In this regard, I did found opened x-jenkins servers by open source intelligence (shodan, criminal ip, censys). And found some servers didn't have any authentication process.
Asset search in criminalip.io, it has revealed me couples of opened jenkins servers and redis commander server.
Let's make authentication a life
Redis commander is a node.js web application used to view, edit, and manage a Redis Database.
Let's make authentication a life
a methodology for detecting exposed open source products such as nginx, apache, microsoft-iis and lighttpd
Mincraft Server port: "25565"
Even after the log4j disaster, security of minecraft seems weak.. just searched by open source intelligence(criminalip.io) there were over 50 vulnerable mincraft servers, It seems possible to penetrate from outside to inside. They need attentions.
patch has been released couple of days ago. But by scanning the net, there were still lots of servers that were not patched yet
Posted by
kyoung3412 on Wednesday June 08, 2022 @10:44PM
from the self-post dept.
On 2022-06-03, New zero-day Vulnerability occured. CVE-2022-26134 is one of command injection vulnerability. According to Report, a zero-day attack that began during the Memorial Day holiday in the United States and attacker could exploit this CVE-2022-26134 vulnerability to upload a webshell.You can see full report on this...
CVE-2021-3393 is one of the postgresql vulnerability. This is vulnerability of information leak. As a matter of fact, using internally vulnerable apps may not be a big problem. However, This IP open 5432 port outside. These IPs are at risk of being targeted by hackers.
Posted by
kyoung3412 on Thursday May 26, 2022 @10:18PM
from the show-hn dept.
https://blog.criminalip.io/2022/05/25/search-for-remote-management-systems-exposed-to-attack-surface-using-ssl-certificate-search-feature/
Search for Remote Management Systems Exposed to Attack Surface Using SSL Certificate Search Feature (ssl_issuer_organization). Search Query on how to Use ssl_issuer_organization filter.
Search for information about IP addresses, domains, malicious links, phishing sites and more
Posted by
kyoung3412 on Monday May 23, 2022 @01:56AM
from the show-hn dept.
Posted by
kyoung3412 on Monday April 25, 2022 @11:51PM
from the show-hn dept.
Posted by
kyoung3412 on Tuesday April 12, 2022 @11:12PM
from the show-hn dept.
https://blog.criminalip.io/2022/03/23/sanctions-against-russias-tls-ssl-certificate-renewal-leads-russia-to-become-increasingly-isolated-from-the-new-cyberwarfare/
Sanctions against Russia’s TLS/SSL certificate renewal leads Russia to become increasingly isolated from the new cyberwarfare. analysis report on current Certification expiration status of Russian sites.
