Tuesday, June 30, 2020


A quien diseñe su baño para la Luna ...
La Agencia Espacial Estadounidense busca ideas para un dispositivo que sea más pequeño, más eficiente y capaz de funcionar tanto en micro-gravedad como en gravedad lunar ...

La NASA ha lanzado un concurso para elegir el diseño del baño de su próxima misión lunar, prevista para 2024 en el marco de su programa Artemis.
La agencia espacial estadounidense publicó las reglas del concurso en HeroX, una plataforma donde las organizaciones pueden usar el crowdsourcing (colaboración abierta distribuida) para encontrar soluciones innovadoras.
Aunque la Estación Espacial Internacional ya cuenta con baños especiales para los astronautas, la nueva misión tripulada a la Luna requeriría de un diseño especial para que pueda funcionar en la gravedad lunar, que es aproximadamente una sexta parte de gravedad de la Tierra.

En particular, la NASA busca ideas para un dispositivo de próxima generación que sea más pequeño, más eficiente y capaz de funcionar tanto en micro-gravedad como en gravedad lunar.

Por medio del concurso, la agencia aspira a encontrar nuevos diseños que puedan reducir la masa de los baños de última generación a más de la mitad, de 54 a 31 kilos, reduciendo su volumen en un 70 %, desde 0,17 a 0,12 metros cúbicos. El inodoro estándar de una casa pesa 30-60 kilos, pero la complejidad de operar en entornos de gravedad reducida requiere más componentes para un inodoro espacial, recuerda la NASA.

Leer el articulo completo, clic! en el enlace: Actualidad.rt.com / Ciencia
More information

Top 17 Best Websites To Learn Ethical Hacking 2018

  1. Hack Forums: Emphasis on white hat, with categories for hacking, coding and computer security.
  2. Metasploit: Find security issues, verify vulnerability mitigations & manage security assessments with Metasploit. Get the worlds best penetration testing software now.
  3. The Hacker News: The Hacker News — most trusted and widely-acknowledged online cyber security news magazine with in-depth technical coverage for cybersecurity.
  4. Phrack Magazine: Digital hacking magazine.
  5. NFOHump: Offers up-to-date .NFO files and reviews on the latest pirate software releases.
  6. Hacked Gadgets: A resource for DIY project documentation as well as general gadget and technology news.
  7. Packet Storm: Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers.
  8. Offensive Security Training: Developers of Kali Linux and Exploit DB, and the creators of the Metasploit Unleashed and Penetration Testing with Kali Linux course.
  9. Black Hat: The Black Hat Briefings have become the biggest and the most important security conference series in the world by sticking to our core value: serving the information security community by delivering timely, actionable security information in a friendly, vendor-neutral environment.
  10. SecTools.Org: List of 75 security tools based on a 2003 vote by hackers.
  11. Makezine: Magazine that celebrates your right to tweak, hack, and bend any technology to your own will.
  12. SecurityFocus: Provides security information to all members of the security community, from end users, security hobbyists and network administrators to security consultants, IT Managers, CIOs and CSOs.
  13. Exploit DB: An archive of exploits and vulnerable software by Offensive Security. The site collects exploits from submissions and mailing lists and concentrates them in a single database.
  14. KitPloit: Leading source of Security Tools, Hacking Tools, CyberSecurity and Network Security.
  15. Hakin9: E-magazine offering in-depth looks at both attack and defense techniques and concentrates on difficult technical issues.
  16. DEFCON: Information about the largest annual hacker convention in the US, including past speeches, video, archives, and updates on the next upcoming show as well as links and other details.
  17. HackRead: HackRead is a News Platform that centers on InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News with full-scale reviews on Social Media Platforms.

Thursday, June 11, 2020

BurpSuite Introduction & Installation

What is BurpSuite?
Burp Suite is a Java based Web Penetration Testing framework. It has become an industry standard suite of tools used by information security professionals. Burp Suite helps you identify vulnerabilities and verify attack vectors that are affecting web applications. Because of its popularity and breadth as well as depth of features, we have created this useful page as a collection of Burp Suite knowledge and information.

In its simplest form, Burp Suite can be classified as an Interception Proxy. While browsing their target application, a penetration tester can configure their internet browser to route traffic through the Burp Suite proxy server. Burp Suite then acts as a (sort of) Man In The Middle by capturing and analyzing each request to and from the target web application so that they can be analyzed.

Everyone has their favorite security tools, but when it comes to mobile and web applications I've always found myself looking BurpSuite . It always seems to have everything I need and for folks just getting started with web application testing it can be a challenge putting all of the pieces together. I'm just going to go through the installation to paint a good picture of how to get it up quickly.

BurpSuite is freely available with everything you need to get started and when you're ready to cut the leash, the professional version has some handy tools that can make the whole process a little bit easier. I'll also go through how to install FoxyProxy which makes it much easier to change your proxy setup, but we'll get into that a little later.

Requirements and assumptions:

Mozilla Firefox 3.1 or Later Knowledge of Firefox Add-ons and installation The Java Runtime Environment installed

Download BurpSuite from http://portswigger.net/burp/download.htmland make a note of where you save it.

on for Firefox from   https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

If this is your first time running the JAR file, it may take a minute or two to load, so be patient and wait.

Video for setup and installation.

You need to install compatible version of java , So that you can run BurpSuite.

Related news

  1. Pentest Tools Github
  2. Hacker
  3. Pentest With Metasploit
  4. Pentest Blog
  5. Pentest Smtp
  6. Pentest Linux
  7. Hacking Typer
  8. Hacker Attack

Wednesday, June 10, 2020

Save Your Cloud: DoS On VMs In OpenNebula 4.6.1

This is a post about an old vulnerability that I finally found the time to blog about. It dates back to 2014, but from a technical point of view it is nevertheless interesting: An XML parser that tries to fix structural errors in a document caused a DoS problem.

All previous posts of this series focused on XSS. This time, we present a vulnerability which is connected another Cloud Management Platform: OpenNebula. This Infrastructure-as-a-Service platform started as a research project in 2005. It is used by information technology companies like IBM, Dell and Akamai as well as academic institutions and the European Space Administrations (ESA). By relying on standard Linux tools as far as possible, OpenNebula reaches a high level of customizability and flexibility in hypervisors, storage systems, and network infrastructures. OpenNebula is distributed using the Apache-2 license.

OpenNebula offers a broad variety of interfaces to control a cloud. This post focuses on Sunstone, OpenNebula's web interface (see Figure 1).

Figure 1: OpenNebula's Sunstone Interface displaying a VM's control interface

Before OpenNebula 4.6.2, Sunstone had no Cross-Site Request Forgery (CSRF) protection. This is a severe problem. Consider an attacker who lures a victim into clicking on a malicious link while being logged in at a private cloud. This enables the attacker to send arbitrary requests to the private cloud through the victims browser. However, we could find other bugs in OpenNebula that allowed us to perform much more sophisticated attacks.

Denial-of-Service on OpenNebula-VM

At its backend, OpenNebula manages VMs with XML documents. A sample for such an XML document looks like this:
OpenNebula 4.6.1 contains a bug in the sanitization of input for these XML documents: Whenever a VM's name contains an opening XML tag (but no corresponding closing one), an XML generator at the backend automatically inserts the corresponding closing tag to ensure well-formedness of the resulting document. However, the generator outputs an XML document that does not comply with the XML schema OpenNebula expects. The listing below shows the structure that is created after renaming the VM to 'My <x> VM':
   <NAME>My <x> VM</x>
The generator closes the <x> tag, but not the <NAME> tag. At the end of the document, the generator closes all opened tags including <NAME>.

OpenNebula saves the incorrectly generated XML document in a database. The next time the OpenNebula core retrieves information about that particular VM from the database the XML parser is mixed up and runs into an error because it only expects a string as name, not an XML tree. As a result, Sunstone cannot be used to control the VM anymore. The Denial-of-Service attack can only be reverted from the command line interface of OpenNebula.

This bug can be triggered by a CSRF-attack, which means that it is a valid attack against a private cloud: By luring a victim onto a maliciously crafted website while logged in into Sunstone, an attacker can make all the victim's VMs uncontrollable via Sunstone. A video of the attack can be seen here: