Collaborate Disseminate
Mirantis, the company you may still remember as one of the biggest players in the early days of OpenStack, launched an interesting new hosted SaSS service today that makes it easier for enterprises to build and deploy their on-premises clouds. The new Mirantis Model Designer, which is available for free, lets operators easily customize their […] Continue reading Mirantis makes configuring on-premises clouds easier
Source control is often the first step when starting a new project (or it should be, we’d hope!). Breaking changes down into smaller chunks and managing the changes between them makes it easier to share work between developers and to catch and revert mistakes after they happen. As project complexity …read more
Continue reading Tracking Binary Changes: Learn the DIFF-erent Ways of the ELF
second exploit from the blog posthttps://blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.htmlChained with CVE-2018-1000600 to a Pre-auth Fully-responded SSRFhttps://jenkins.io/security/advisory/2018-06-25/#SECURITY-915This affec… Continue reading Jenkins – CVE-2018-1000600 PoC
A collection of posts on attacking Jenkinshttp://www.labofapenetrationtester.com/2014/08/script-execution-and-privilege-esc-jenkins.htmlManipulating build steps to get RCEhttps://medium.com/@uranium238/shodan-jenkins-to-get-rces-on-servers-6b6ec7c960e2… Continue reading Jenkins Master Post
After the release of Orange Tsai’s exploit for Jenkins. I’ve been doing some poking. PreAuth RCE against Jenkins is something everyone wants.
While not totally related to the blog post and tweet the following exploit came up while searching.
What I hav… Continue reading Jenkins – messing with exploits pt2 – CVE-2019-1003000
Jenkins notes for:https://blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.htmlhttp://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.htmlto download old jenkins WAR fileshttp://updates.jenkins-ci.org/down… Continue reading Jenkins – messing with new exploits pt1
I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process:
process has large CPU usage
killing it, respawns it (with same name)
restarting machine spawns it (with different name)
exec is located in /de… Continue reading Jenkins malicious process identification
Facebook bug exposed private photos of 6.8 million users, thousands of Jenkins servers will let anonymous users become admins, Signal app can’t include a backdoor for the Australian government, WordPress plugs bug that led to Google indexing some… Continue reading Signal App, Jenkins Servers, & WordPress – Application Security Weekly #44
I have two set ups with ZAP and Selenium, local and on Jenkins.
Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This will turn up a number of is… Continue reading OWASP ZAP does not scan all urls in Jenkins
I suspect that what I am trying to do is something that has been done before. Hopefully, this is possible and someone knows how its done. Any information would be greatly appreciated.
I am attempting to run both Selenium and… Continue reading Running Selenium Jenkins, through OWASP ZAP, before scanning