Collaborate Disseminate
Introduction
Multi-tenant vs single-tenant software architectures
Software multitenancy is a software architecture in which a single instance of software runs on a server and serves multiple tenants. Systems designed in such manner are &q… Continue reading Calculating CVSS scores for vulnerabilities in multi-tenant applications
Let’s say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user’s session. Within the session, the attacker can view/modify the user’s credit card and billing information, and even make a purchase… Continue reading CVSS3 score for XSS leading to account takeover
Using things like Shodan and Zoomeye we can find tens of thousands of exposed Prometheus endpoints with queries like service:prometheus port:9090 etc..
Now let’s say we know that there are entities on the internet that are serving a specif… Continue reading Identify hosts that are serving specific metric on Shodan
There are all kinds of old wives’ tales surrounding proper battery use floating around in the popular culture. Things like needing to fully discharge a battery every so often, unplugging …read more Continue reading A Deep Dive on Battery Life
I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from xkcd.
According to xkcd (https://xkcd.co… Continue reading Why do entropies of passwords significantly differ from site to site?
I am trying to exec arbitrary commands on a pod via the Kubernetes metrics server. I am doing so by sending HTTP requests to the metrics server endpoint.
These are the paths that I can send requests to:
{
"paths": [
"/… Continue reading Is it possible to exec pods in Kubernetes via a metrics server?
I am trying to access kubernetes metrics server by impersonating a cluster-admin. The following is my yaml file for the cluster-admin created.
However, I am still unable to access the metrics server and the following is my outputs when tr… Continue reading Kubernetes accessing metrics server
I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec arbitrary commands on any pod.
I am qu… Continue reading Kubernetes user impersonation to obtain exec privileges
I’ve recently been given a set of guidance notes on CVSS; but the guidance isn’t making sense. I’ve sent a query off, but got no response. So asking here.
Say you have an exploit (can ignore base for now – but if you want to replicate, I’v… Continue reading CVSS Temporal guidance
The biggest tech companies have put a lot of time and money into building tools and platforms for their data science teams and those who work with them to glean insights and metrics out of the masses of data that their companies produce: how a company is performing, how a new feature is working, when […] Continue reading Transform launches with $24.5M in funding for a tool to query and build metrics out of data troves