Divyanshu Shukla

Published in InfoSec Write-ups

·Jun 28

HTML and Hyperlink Injection via Share Option In Microsoft Onenote Application

Hyperlink Injection it’s when attacker injecting a malicious link when sending an email invitation. HTML injection attack is injecting HTML code through the vulnerable parts of the website. The Malicious user sends HTML code through any vulnerable field with a purpose to change the website’s design or any information, that…

Microsoft

4 min read

Published in InfoSec Write-ups

·Jun 1

Kubernetes 101 | Setting up Kubernetes Cluster Locally

This blog is about setting the local Kubernetes cluster for learning & testing using multiple tools like Kind, Minikube, Kubeadm & K3s. KIND kind is a tool for running local Kubernetes clusters using Docker container “nodes”. …

Kubernetes

6 min read

Published in InfoSec Write-ups

·May 25

Module-3 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit

1. Setting up Vulnerable Application For AWS WAF We will be setting custom DVWA for pentesting WAF. 1.1. We need to set up the ec2 instance where we will host DVWA. Let’s start by creating the instance by clicking “Launch Instances”.

Firewall

11 min read

Module-3 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit

Published in InfoSec Write-ups

·May 25

Module-2 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit

Q. What is Core Rule Set & why it is utilized by all the cloud WAFs? A. …

AWS

7 min read

Module-2 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit

Published in InfoSec Write-ups

·May 25

Secure Code Review -1 | Cheat sheet For Security Vulnerability In Python — Injection Flaws

Based on OWASP Top-10 Vulnerabilities. This time we are looking for secure coding bugs related to Injection Flaws 1) Path Traversal Attack Vulnerable Code Block def get_video(self, path=None): self.check_user_auth() data = None if not path: path = self.get_video_path() path = path[0] if path else None if…

Coding

4 min read

Published in InfoSec Write-ups

·May 16

Module-1 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit

Why you should not trust the cloud WAF? Introduction & Objective A web application firewall (WAF) or WAF appliance provides security by operating through an application or service thus blocking malicious calls, inputs, and outputs that do not meet the policy of a firewall. …

Waf

4 min read

Module-1 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit

Published in InfoSec Write-ups

·Apr 11

Hands on Tutorial of Amazon Simple Notification Service (SNS)

Amazon Simple Notification Service (Amazon SNS) is a fully managed messaging service for both application-to-application (A2A) and application-to-person (A2P) communication. How does Amazon SNS work? It is very easy to get started with Amazon SNS. Developers must first create a “topic” which is an “access point” — identifying a specific…

AWS

6 min read

Hands on Tutorial of Amazon Simple Notification Service (SNS)

Published in InfoSec Write-ups

·Sep 26, 2021

Quick Guide For Running Clair Scanner via Katacoda

This guide talks about setting up the Clair scanner and performs scans on vulnerable DVWA container. Also now it is possible to perform a hands-on demo on katacoda. You can run the demo on Katacoda. For running the demo visit https://www.katacoda.com/justmorpheus Setting up Clair server or using locally. CoreOs Clair https://github.com/coreos/clair Clair-scanner https://github.com/arminc/clair-scanner

Katacoda

3 min read

Published in InfoSec Write-ups

·Aug 14, 2021

Burp Automation | Automating Burp Scanning Via Rest API & Robot Framework Using Python3

Manual security scanning is very time consuming and we can leverage headless Burp Suite to perform the scanning and get the results uploaded in the Google Drive directly via Pydrive Module in Python. This automation uses Burp Suite Pro along with Robot Framework and REST API using Python3. …

Pentesting

7 min read

Burp Automation | Automating Burp Scanning Via Rest API & Robot Framework Using Python3

Published in InfoSec Write-ups

·Aug 3, 2021

GCP Inspector | Auditing Publicly Exposed GCP Bucket

Installation of GCP Inspector and basics about enumerating publicly exposed GCP buckets. While playing Thunder CTF I created a simple python tool that can audit publicly accessible GCP storage buckets. Thunder CTF allows players to practice attacking vulnerable cloud projects on the Google Cloud Platform (GCP) environment. …

Gcp

3 min read

GCP Inspector | Auditing Publicly Exposed GCP Bucket