According to Insight's attestation this was a 5 day test focusing on:
1. External vulnerability assessment of the Bitwarden computing systems and web applications
2.External penetration testing of the Bitwarden computing systems and web applications
1,838 karma · joined April 13, 2016
https://ramimac.me
1. External vulnerability assessment of the Bitwarden computing systems and web applications
2.External penetration testing of the Bitwarden computing systems and web applications
Right now the site provides no insight on how the calculation was made, or even what the components of the calculation are. The end result is that it really provides no value to a visitor unless they want to take a gamble and pay for vague "conversion optimization" services.
What goes into the "site score"? How do you get from "site score" to conversion percentage?
"Your site score for desktop devices is 61. Your conversion rate is 1.4%. Out of 10.000$, you are losing 8600$."
If I'm converting 14 out of a 1000,shouldn't I be converting 140 out of 10000? so losing $8860?
1) Providing the scope in a black box makes this feel far more like a blatant sales pitch, with little inherent value.
2) I'd recommend providing an example target (i.e I ended up just using amazon.com) so folks can have an easy way to give this a shot
kube-bench [1] and kube-hunter [2] are worth a look as well.
[1] https://github.com/aquasecurity/kube-bench [2] https://github.com/aquasecurity/kube-hunter
[1] https://github.com/rustsec/cargo-audit [2] https://crates.io/crates/cargo-audit [3] https://github.com/RustSec/cargo-audit#using-cargo-audit-on-...
Also of interest to anyone exploring transitioning to fountain pens would be the Pilot Vanishing Point[2], which is a retractable fountain pen that is generally well regarded.
[1] http://www.mrpen.co.uk/contents/en-uk/p866.html [2] http://pilotpen.us/categories/fountain-pens/vanishing-point-...
And while the "Hall of Fame" is empty, it seems some people are starting to complete it.
Write-up: https://dev.to/jcmullis/the-cloud-resume-challenge-2mic Result: https://www.jcmresume.com/
There is also an indiehackers discussion with some relevant examples: https://www.indiehackers.com/forum/good-examples-of-producti...
[1] https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply...
Of course, events as far out as late July are cancelled due to COVID-19
https://www.airbnb.com/help/article/2701/extenuating-circums...
If you want "clever" ideas, maybe a Lambda that moves off objects of a certain age to a private bucket?
I disagree on what the issue was with their S3 bucket. As these were all public static assets, the real problem was just the ability to bulk enumerate them. As mentioned in the post, the two issues were: 1. ListObjects was enabled 2. The filenames lacked sufficient entropy (debatable in my opinion)
> #1 "In order to bypass PayPal’s 2FA, our researcher used the PayPal mobile app and a MITM proxy, like Charles proxy."
> So you need to be MITM'd and have a malicious cert installed? Yeah... not "critical" and out-of-scope for most places.
In generally, using a proxy to perform a 2FA bypass wouldn't decrease the risk. In this case, the attacker already has compromised credentials, and they are trying to bypass the secondary control. As they are the one authenticating, the need for MiTM isn't a huge deal.
That being said, another point that was made is that the "2FA" they are bypassing isn't actually Paypal's 2FA. Instead, it is a secondary, risk-based validation. A bit of a semantic difference, but important to note that if a user was leveraging 2FA this bypass wouldn't actually get an attack who had compromised credentials access.
VSR is focused on providing quality information, network and application security consulting services. We work with clients in nearly every industry vertical and at multiple stages of maturity, from start-ups to large multi-national enterprises. VSR is always looking to expand its team of experienced security consultants so that we may better serve our clients and expand our thought leadership.
Our typical security assignments include: application penetration testing (web, mobile, commercial off-the-shelf software, products & appliances), network penetration assessments, red team exercises, and social engineering. Expertise in all areas is not necessary, however, familiarity with multiple areas is preferred. A strong desire to learn and the ability to effectively collaborate with colleagues however is a job requirement.
We're currently looking for Penetration Testers / Ethical Hackers / Security Consultants. Check out our employment page at https://vsecurity.com/company/employment.html
"Enfin, j'ai découvert une horrible et cruelle méthode, que je ne conseille qu'aux hommes d'une excessive vigueur, à cheveux noir et durs, à peau mélangée d'ocre et de vermillon, à mains carrées, à jambes en forme de balustres comme ceux de la place Louis XV."
The original text states "... with mixed/blended ochre and vermillion skin"