Best of Cybersecurity — July 2024

1. 1
   Article

   freeCodeCamp·2y

   Learn Linux for Beginners: From Basics to Advanced Techniques [Full Book]

   Learning Linux offers valuable skills in the tech industry, aiding efficiency and career transitions into fields like DevOps, Cybersecurity, and Cloud Computing. This comprehensive handbook covers basics like the Linux command line to advanced topics such as shell scripting and system administration. Examples use Ubuntu 22.04.2 LTS, but the information is broadly applicable across distributions. Key sections include an introduction to Linux, setting up your environment, and managing files, all geared toward empowering new and experienced users alike.

   1.4K

   53
2. 2
   Video

   Fireship·2y

   Some bad code just broke a billion Windows machines

   1.2K

   41
3. 3
   Article

   Community Picks·2y

   CORS: the ultimate guide

   CORS (Cross-Origin Resource Sharing) is a security mechanism that protects users' data from being accessed by malicious websites when different origins interact. AJAX (Asynchronous JavaScript And XML) requests from web browsers are controlled by CORS rules, ensuring data confidentiality and security. This guide explains how CORS policies are configured via HTTP response headers to allow or deny access based on origin and credentials. It also highlights the dangers of misconfigured CORS policies and provides steps to define a secure CORS policy effectively.

   1K

   38
4. 4
   Video

   Seytonic·2y

   How the FBI Hacked the Trump Shooter's Phone

   485

   27
5. 5
   Article

   freeCodeCamp·2y

   How to Get Started With Cybersecurity

   Cybersecurity is a vital field that involves protecting individuals and their data on the internet. To start a career in cybersecurity, one must understand basic concepts, research various career paths, choose a specialized field, gain practical knowledge, and network within the community. The post provides a step-by-step guide to becoming a cybersecurity professional, including resources and additional tips to enhance learning and career progression.

   306

   6
6. 6
   Article

   The New Stack·2y

   5 JavaScript Security Best Practices for 2024

   JavaScript applications face numerous cyber threats in 2024, including cross-site scripting (XSS), man-in-the-middle (MitM) attacks, and denial of service (DoS) attacks. Key security best practices include securing APIs, implementing Content Security Policies (CSP), input sanitization, and performing regular security audits. Tools like Snyk, ZAP by OWASP, and the Cypress Testing Framework are essential for maintaining robust security in JavaScript development.

   194

   2
7. 7
   Article

   Awesome Go·2y

   How I sent 500 million HTTP requests to 2.5 million hosts

   An individual leveraged Go's simplicity and concurrency to send 500 million HTTP/1.1 requests to 2.5 million hosts for an ethical hacking use case. By utilizing Kubernetes for horizontal scaling and optimizing both code and libraries, they achieved this massive scale efficiently. Key optimizations included pre-resolving DNS, hand-crafting HTTP requests, and using the fasthttp library.

   137

   1
8. 8
   Article

   System Weakness·2y

   How Hackers Exploit Vulnerabilities with Nmap and Searchsploit: Step-by-Step Guide!

   Learn how to use Nmap for OS detection and vulnerability scanning, and how to employ Searchsploit to find corresponding exploits. This guide walks through the commands and outputs for effectively identifying and exploiting vulnerabilities in target systems, enhancing your penetration testing skills.

   84

   1
9. 9
   Article

   freeCodeCamp·2y

   More Secure Authentication: From Passwords to Passkeys

   Authentication is a critical element of digital security, but traditional methods like passwords and social logins are increasingly inadequate. Passkeys offer a more secure alternative by using public-private key cryptography and biometric verification. This guide covers the current state of authentication, the mechanics and benefits of passkeys, and the challenges in integrating this technology. Understanding and adopting passkeys could signify a major leap forward in securing digital identities.

   56
10. 10
    Article

    Javarevisited·2y

    How Long Does It Take To Learn Cyber Security?

    Becoming a cyber security professional involves learning a wide range of skills including Linux systems, Python programming, networking, and more. Depending on the time dedicated, structured programs like the Google and Microsoft Cybersecurity certificates can prepare you for entry-level positions in as little as 2-6 months. Self-learning is possible through resources such as online courses and books.

    55

    2
11. 11
    Article

    Hacker News·2y

    Introduction · Reverse Engineering

    Reverse engineering involves deconstructing an artificial object to uncover its design, code, or architecture. This set of tutorials aims to simplify the learning process for beginners and those needing a refresher on x86, x64, 32-bit ARM, and 64-bit architectures. Suitable for cybersecurity enthusiasts, the tutorials are available in PDF and MOBI formats and are updated regularly.

    51
12. 12
    Article

    Hacker News·2y

    Investing in Rust

    Research attributes over 50% of security vulnerabilities to errors that could be prevented by memory-safe languages like Rust. Despite its efficiency and safety advantages over languages like C and C++, Rust faces adoption challenges due to its incompatibility with existing engineering skills and systems. The discussion includes recommendations for U.S. public policy to support the adoption of memory-safe languages.

    40

    4
13. 13
    Article

    System Weakness·2y

    Low-Budget Cybersecurity Roadmap for Newbies (never tried before)

    This post outlines a low-budget roadmap for newbies looking to start a career in cybersecurity, particularly in offensive security. It emphasizes the importance of developing core technical and soft skills, provides guidance for both complete beginners and those with some prior experience, and suggests various free and paid resources for learning and practice. Certifications are highlighted as a means to demonstrate skills to employers, and practical advice is offered on utilizing platforms like TryHackMe and HackTheBox.

    38

    4
14. 14
    Article

    The New Stack·2y

    4 API Security Best Practices

    APIs are crucial to modern digital solutions, making API security a top priority. Key points include utilizing an API gateway to enforce policies and secure endpoints with HTTPS, and using access tokens like JWTs for robust authorization. These measures help mitigate common risks such as broken object-level authorization and unrestricted resource consumption. Implementing OAuth or OpenID Connect can enhance security further by centralizing the management of access tokens.

    37
15. 15
    Article

    ByteByteGo·2y

    EP120: What do version numbers mean?

    This ByteByteGo Newsletter issue covers topics like the difference between concurrency and parallelism, the meaning of version numbers using Semantic Versioning (SemVer), a free AI tool to help job seekers, and a brief introduction to Kubernetes and its components. Additionally, there's an overview of essential cybersecurity concepts and defense mechanisms.

    35
16. 16
    Article

    System Weakness·2y

    Bug Bounty basic for beginners & Types of bug bounty programs

    Bug bounty programs reward ethical hackers for identifying and reporting vulnerabilities in software or systems. There are several types of programs, including private, public, self-hosted, and third-party hosted. They can offer monetary rewards or other forms of recognition. Without such programs, unreported bugs could be exploited or sold on the dark web. Prominent platforms include Bugcrowd, HackerOne, and Immunefi.

    28

    1
17. 17
    Article

    System Weakness·2y

    Python Library Hijacking

    Python Library Hijacking is a privilege escalation technique that exploits misconfigured execution permissions in Python scripts, allowing for the overwriting of modules to execute code with elevated permissions. The post demonstrates this concept using TryHackMe's Wonderland box and provides mitigation strategies, such as using absolute paths for imports and restricting permissions.

    26

    1
18. 18
    Video

    David Bombal·2y

    Cracking WiFi WPA2 Handshakes (And does it work with WPA3?)

    23
19. 19
    Article

    Community Picks·2y

    CrowdSec Academy Courses

    CrowdSec Academy offers various courses on community-driven cybersecurity, covering fundamentals of the CrowdSec project, protection techniques for webshops, the use of the CrowdSec Console, and monitoring with Grafana. Additionally, there are hands-on labs for building custom parsers and behavior detection scenarios.

    23
20. 20
    Article

    Community Picks·2y

    bayufedra/MBPTL: Self-deployed Straight-forward hacking lab machine which designed for new comer who want to learn Penetration Testing field that running inside Docker for easy setup.

    Most Basic Penetration Testing Lab (MBPTL) is a straightforward self-deployed hacking lab machine designed for beginners in cyber security, specifically in penetration testing. It runs inside Docker for easy setup. The lab includes hands-on learning in reconnaissance, vulnerability analysis, exploiting vulnerable apps, cracking passwords, and post exploitation.

    23

    4
21. 21
    Article

    Community Picks·2y

    5/6 | Breaking the Internet: The Aftermath Of Our Research

    The post discusses the impact and aftermath of recent cybersecurity research that demonstrated hacking multi-billion dollar companies using a fake VSCode extension. It highlights the wide adoption of ExtensionTotal, a tool to assess the risk of VSCode extensions, by global organizations. The post announces the launch of a Supporters Program to help cover cloud costs and teases an upcoming final post in the series that will guide CISOs in integrating ExtensionTotal's API within their organizations.

    22

    4
22. 22
    Video

    Seytonic·2y

    How They Tracked the Trump Shooter's Phone

    20
23. 23
    Article

    GitHub Blog·2y

    3 ways to get Remote Code Execution in Kafka UI

    Kafka UI, a popular open-source web app for managing Apache Kafka clusters, was found to have multiple Remote Code Execution (RCE) vulnerabilities due to lack of authentication and exposure to various attack vectors. These vulnerabilities, discovered in versions prior to 0.7.2, can be exploited through Groovy script execution, JMX connector misconfiguration, and JndiLoginModule. Users are advised to upgrade to version 0.7.2 for security fixes and implement additional precautions such as serialization filters to mitigate risks.

    19
24. 24
    Article

    KDnuggets·2y

    The World Needs More Cyber Security Analysts!

    With the rise of new technologies, the demand for Cyber Security Analysts has surged due to the increasing cyber threats. These professionals are essential for protecting organizations' networks and systems. Despite high demand, the cybersecurity workforce grew by only 8.7% in 2023, indicating a gap. Many organizations now accept certifications instead of traditional degrees. Key certifications include Google’s Cyber Security Certificate, Microsoft Cybersecurity Analyst Professional Certificate, and IBM Cybersecurity Analyst Professional Certificate, all catered to beginners and providing flexible, comprehensive training for aspiring analysts.

    18

    2
25. 25
    Video

    Seytonic·2y

    When You Hire a North Korean Hacker by Mistake...

    17