| import yt_dlp | |
| def download_video(url, resolution="best"): | |
| try: | |
| # Set up yt-dlp options | |
| if resolution in ["720", "1080"]: | |
| # If the user specifies a resolution, prioritize that | |
| ydl_opts = { | |
| 'format': f'bestvideo[height<={resolution}]+bestaudio/best', # Download best video with audio at requested resolution | |
| 'outtmpl': '%(title)s.%(ext)s', # Output filename template (keeps original file extension) |
curl -sk https://localhost:10250/pods/--anonymous-auth is turned off, you will see a 401 Unauthorized response.--anonymous-auth is true and --authorization-mode is Webhook you'll see 403 Forbidden response with message Forbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy)--anonymous-auth is true and --authorization-mode is AlwaysAllow you'll see a list of pods.
| # CVE-2020-10148 (local file disclosure PoC for SolarWinds Orion aka door to SuperNova ? ) | |
| # @0xSha | |
| # (C) 2020 0xSha.io | |
| # Advisory : https://www.solarwinds.com/securityadvisory | |
| # Mitigation : https://downloads.solarwinds.com/solarwinds/Support/SupernovaMitigation.zip | |
| # Details : https://kb.cert.org/vuls/id/843464 | |
| # C:\inetpub\SolarWinds\bin\OrionWeb.DLL | |
| # According to SolarWinds.Orion.Web.HttpModules |
| https://github.com/search?q=BROWSER_STACK_ACCESS_KEY= OR BROWSER_STACK_USERNAME= OR browserConnectionEnabled= OR BROWSERSTACK_ACCESS_KEY=&s=indexed&type=Code | |
| https://github.com/search?q=CHROME_CLIENT_SECRET= OR CHROME_EXTENSION_ID= OR CHROME_REFRESH_TOKEN= OR CI_DEPLOY_PASSWORD= OR CI_DEPLOY_USER=&s=indexed&type=Code | |
| https://github.com/search?q=CLOUDAMQP_URL= OR CLOUDANT_APPLIANCE_DATABASE= OR CLOUDANT_ARCHIVED_DATABASE= OR CLOUDANT_AUDITED_DATABASE=&s=indexed&type=Code | |
| https://github.com/search?q=CLOUDANT_ORDER_DATABASE= OR CLOUDANT_PARSED_DATABASE= OR CLOUDANT_PASSWORD= OR CLOUDANT_PROCESSED_DATABASE=&s=indexed&type=Code | |
| https://github.com/search?q=CONTENTFUL_PHP_MANAGEMENT_TEST_TOKEN= OR CONTENTFUL_TEST_ORG_CMA_TOKEN= OR CONTENTFUL_V2_ACCESS_TOKEN=&s=indexed&type=Code | |
| https://github.com/search?q=-DSELION_BROWSER_RUN_HEADLESS= OR -DSELION_DOWNLOAD_DEPENDENCIES= OR -DSELION_SELENIUM_RUN_LOCALLY=&s=indexed&type=Code | |
| https://github.com/search?q=ELASTICSEARCH_PASSWORD= OR ELASTICSEARCH_USERNAME= OR EMAIL_NOTIFI |
| echo "" | |
| echo "************ Github Dork Links (must be logged in) *******************" | |
| echo "" | |
| echo " password" | |
| echo "https://github.com/search?q=%22$1%22+password&type=Code" | |
| echo "https://github.com/search?q=%22$without_suffix%22+password&type=Code" | |
| echo "" | |
| echo " npmrc _auth" |
| 1. What is information security and how is it achieved? | |
| 2. What are the core principles of information security? | |
| 3. What is non-repudiation (as it applies to IT security)? | |
| 4. What is the relationship between information security and data availability? | |
| 5. What is a security policy and why do we need one? | |
| 6. What is the difference between logical and physical security? Can you give an example of both? | |
| 7. What’s an acceptable level of risk? | |
| 8. What are the most common types of attacks that threaten enterprise data security? | |
| 9. What is the difference between a threat and a vulnerability? | |
| 10. Can you give me an example of common security vulnerabilities? |
| Original tweet: https://twitter.com/carnal0wnage/status/1261025130307878916 | |
| "I have a multi day drive coming up soon - please send over your best podcasts, TED talks, hacker talks, cruising music. | |
| I'll have my teenage daughter with me so topics other than infosec are welcome. Bonus points if on spotify and i can save | |
| to offline listen" | |
| List from the replies: | |
| NPR "Car Talk" podcast with the "Click and Clack Brothers" |
| OWNER='XXXXXXXXX' | |
| echo $OWNER | |
| for region in `aws ec2 describe-regions --output text | cut -f3` | |
| do | |
| echo -e "\nListing Snapshots for owner in region:'$region'..." | |
| aws ec2 describe-snapshots --owner-ids=$OWNER --region $region | |
| done |
| ### I use HSM backed SSH certs and so can you. [why?: keys can be stolen, certs expire!] | |
| 1. Get a YubiHSM2 @ https://www.yubico.com/products/hardware-security-module/ | |
| 2. Follow this: https://github.com/YubicoLabs/yubihsm-ssh-tool [ Yes, you're going to have to install all the other yubico stuff too, yubico-connector, etc, ..] on your issuing machine, or airgapped machine. | |
| 3. Be content that you can now sign certificates with the HSM on the issuer/airgapped machine. | |
| 3. Update /etc/ssh/sshd_config on remote server to add: | |
| TrustedUserCAKeys /etc/ssh/ca.pub | |
| AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u | |
| 4. Add principals here: | |
| ex: |