carnal0wnage · September 26, 2022 06:00 · rtphokie · Feb 15, 2017 · carnal0wnage · Feb 17, 2017
diff --git a/DevOOPS: Attacks And Defenses For DevOps Toolchains Talk Links b/DevOOPS: Attacks And Defenses For DevOps Toolchains Talk Links
 RSA 2017 DevOOPS: Attacks And Defenses For DevOps Toolchains Talk Links  SessionID: HTA-W02

 https://www.slideshare.net/chrisgates/devoops-attacks-and-defenses-for-devops-toolchains

 Recording of talk from CERN
 https://indico.cern.ch/event/622483/  (click the recording button)

 Past talks:
 http://www.slideshare.net/KenJohnson61/aws-surival-guide

 [Ken Johnson earlier talk on AWS security, dedicated to using these services (cloudwatch/config/cloudtrail)]
 https://www.youtube.com/watch?v=g-wy9NdATtA&feature=youtu.be

 Chris Gates & Ken Johnson - DevOops: Redux - AppSecUSA 2016 
 https://www.youtube.com/watch?v=VMyp74ct2H0

 [nVisium Blog]
 https://nvisium.com/blog/

 [Chris Gates Blog]
 http://carnal0wnage.attackresearch.com 

 [In the news examples]
 https://www.quora.com/My-AWS-account-was-hacked-and-I-have-a-50-000-bill-how-can-I-reduce-the-amount-I-need-to-pay 
 https://medium.com/how-i-learned-ruby-rails/how-to-get-robbed-by-insecure-practices-8a1118fe3d7f#.9o81eqare
 http://www.theregister.co.uk/2015/01/06/dev_blunder_shows_github_crawling_with_keyslurping_bots/ 
 http://searchaws.techtarget.com/news/2240223024/Code-Spaces-goes-dark-after-AWS-cloud-security-hack
 https://www.databreaches.net/dozens-of-clinics-thousands-of-patients-impacted-by-third-party-data-leak/
 https://mackeeper.com/blog/post/275-30-breaches-in-one
 http://www.techrepublic.com/article/massive-ransomware-attack-takes-out-27000-mongodb-servers/
 http://www.pcworld.com/article/3157417/security/after-mongodb-ransomware-groups-hit-exposed-elasticsearch-clusters.html

 [Slack Logs]
 https://api.slack.com/methods/team.accessLogs
 https://github.com/maus-/slack-auditor  

 [GitRob]
 https://github.com/michenriksen/gitrob

 [TruffleHog]
 https://github.com/dxa4481/truffleHog

 [GitMonitor]
 https://gitmonitor.com/

 [Open Source Tools for monitoring pastebin*]
 https://github.com/jordan-wright/dumpmon 
 https://github.com/xme/pastemon	
 https://github.com/cvandeplas/pystemon 

 [osquery]
 https://osquery.io/

 [Doorman]
 https://github.com/mwielgoszewski/doorman

 [BlockBlock]
 https://objective-see.com/products/blockblock.html

 [Little Snitch] 
 https://www.obdev.at/products/littlesnitch/index.html

 [CarbonBlack] 
 https://www.carbonblack.com/

 [StreamAlert]
 https://github.com/airbnb/streamalert

 Patch Management
 [Simian]
 https://github.com/google/simian

 [Munki]
 https://www.munki.org/munki/

 [Jenkins]
 https://wiki.jenkins-ci.org/display/SECURITY/Home
 https://www.pentestgeek.com/2014/06/13/hacking-jenkins-servers-with-no-password/
 http://www.labofapenetrationtester.com/2014/06/hacking-jenkins-servers.html
 http://zeroknock.blogspot.com/search/label/Hacking%20Jenkins
 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_script_console.rb

 [ElasticSearch]
 http://carnal0wnage.attackresearch.com/2017/01/devooops-elasticsearch.html

 In-Memory Databases
 [Redis]
 https://redis.io/topics/security 
 http://antirez.com/news/96
 http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/
 https://gist.github.com/lokielse/d4e62ae1bb2d5da50ec04aadccc6edf1

 [Memcache]
 http://www.slideshare.net/wallarm/us-14novikovthenewpageofinjectionsbookmemcachedinjectionswp
 http://infiltrate.tumblr.com/post/38565427/hacking-memcache 
 http://www.darkcoding.net/software/memcached-list-all-keys/ 
 https://5mins.wordpress.com/2011/04/25/plaidctf-django-challenge-writeup-web-300/ 
 http://www.slideshare.net/sensepost/cache-on-delivery 
 http://blog.couchbase.com/memcached-go-derper-black-hat-and-amazon-web-services-aws-security-bulletin 
 https://lincolnloop.com/blog/playing-pickle-security/ 
 https://www.sensepost.com/blog/2010/playing-with-python-pickle-%231/
 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/memcached_extractor.rb

 Big Data
 [Hadoop]
 http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf
 https://hadoopecosystemtable.github.io/

 [Vagrant]
 http://carnal0wnage.attackresearch.com/2017/01/devooops-client-provisioning-vagrant.html

 [Docker]
 https://zeltser.com/security-risks-and-benefits-of-docker-application/
 https://blog.docker.com/2014/06/docker-container-breakout-proof-of-concept-exploit/
 http://www.slideshare.net/jpetazzo/linux-containers-lxc-docker-and-security
 https://www.blackhat.com/docs/eu-15/materials/eu-15-Bettini-Vulnerability-Exploitation-In-Docker-Container-Environments-wp.pdf
 https://www.sumologic.com/blog-security/securing-docker-containers/
 https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/2016/april/ncc_group_understanding_hardening_linux_containers-10pdf/

 [Shipyard]
 https://github.com/shipyard/shipyard

 [AWS - Vulnerable Webapps]
 https://www.blackhat.com/docs/us-14/materials/us-14-Riancho-Pivoting-In-Amazon-Clouds-WP.pdf
 https://andresriancho.github.io/nimbostratus/

 [Review S3 buckets to determine security policy]
 https://gist.github.com/cktricky/faf0f40116e535a055b7412458136917

 [Ken Johnson earlier talk on AWS security, dedicated to using these services (cloudwatch/config/cloudtrail)]
 https://www.youtube.com/watch?v=g-wy9NdATtA&feature=youtu.be

 [Tool to list the monitoring services configuration]
 CloudWatch / CloudTrail / Config
 https://gist.github.com/cktricky/f19e8d55ea5dcb1fdade6ede588c6576

 [Review “Well Architected Framework” from AWS which discuss monitoring and other controls]
 http://d0.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf

 [Tool to inspect each user’s permissions]
 https://gist.github.com/cktricky/257990df2f36aa3a01a8809777d49f5d

 [If you’re using something like Paperclip + Rails, try Fog to leverage Roles]
 https://github.com/thoughtbot/paperclip/issues/1591 


 [Backdooring AWS accounts]
 https://danielgrzelak.com/backdooring-an-aws-account-da007d36f8f9#.e341mt8zn
 https://danielgrzelak.com/exploring-an-aws-account-after-pwning-it-ff629c2aae39#.7198xyt30
 https://danielgrzelak.com/disrupting-aws-logging-a42e437d6594#.nb8s0ser4

 [Gone in 60 Milliseconds - Intrusion and Exfiltration in Server-less Architectures ]
 https://www.youtube.com/watch?v=YZ058hmLuv0

 [Scout 2 AWS Auditing]
 https://github.com/nccgroup/Scout2
	RSA 2017 DevOOPS: Attacks And Defenses For DevOps Toolchains Talk Links SessionID: HTA-W02

	https://www.slideshare.net/chrisgates/devoops-attacks-and-defenses-for-devops-toolchains

	Recording of talk from CERN
	https://indico.cern.ch/event/622483/ (click the recording button)

	Past talks:
	http://www.slideshare.net/KenJohnson61/aws-surival-guide

	[Ken Johnson earlier talk on AWS security, dedicated to using these services (cloudwatch/config/cloudtrail)]
	https://www.youtube.com/watch?v=g-wy9NdATtA&feature=youtu.be

	Chris Gates & Ken Johnson - DevOops: Redux - AppSecUSA 2016
	https://www.youtube.com/watch?v=VMyp74ct2H0

	[nVisium Blog]
	https://nvisium.com/blog/

	[Chris Gates Blog]
	http://carnal0wnage.attackresearch.com

	[In the news examples]
	https://www.quora.com/My-AWS-account-was-hacked-and-I-have-a-50-000-bill-how-can-I-reduce-the-amount-I-need-to-pay
	https://medium.com/how-i-learned-ruby-rails/how-to-get-robbed-by-insecure-practices-8a1118fe3d7f#.9o81eqare
	http://www.theregister.co.uk/2015/01/06/dev_blunder_shows_github_crawling_with_keyslurping_bots/
	http://searchaws.techtarget.com/news/2240223024/Code-Spaces-goes-dark-after-AWS-cloud-security-hack
	https://www.databreaches.net/dozens-of-clinics-thousands-of-patients-impacted-by-third-party-data-leak/
	https://mackeeper.com/blog/post/275-30-breaches-in-one
	http://www.techrepublic.com/article/massive-ransomware-attack-takes-out-27000-mongodb-servers/
	http://www.pcworld.com/article/3157417/security/after-mongodb-ransomware-groups-hit-exposed-elasticsearch-clusters.html

	[Slack Logs]
	https://api.slack.com/methods/team.accessLogs
	https://github.com/maus-/slack-auditor

	[GitRob]
	https://github.com/michenriksen/gitrob

	[TruffleHog]
	https://github.com/dxa4481/truffleHog

	[GitMonitor]
	https://gitmonitor.com/

	[Open Source Tools for monitoring pastebin*]
	https://github.com/jordan-wright/dumpmon
	https://github.com/xme/pastemon
	https://github.com/cvandeplas/pystemon

	[osquery]
	https://osquery.io/

	[Doorman]
	https://github.com/mwielgoszewski/doorman

	[BlockBlock]
	https://objective-see.com/products/blockblock.html

	[Little Snitch]
	https://www.obdev.at/products/littlesnitch/index.html

	[CarbonBlack]
	https://www.carbonblack.com/

	[StreamAlert]
	https://github.com/airbnb/streamalert

	Patch Management
	[Simian]
	https://github.com/google/simian

	[Munki]
	https://www.munki.org/munki/

	[Jenkins]
	https://wiki.jenkins-ci.org/display/SECURITY/Home
	https://www.pentestgeek.com/2014/06/13/hacking-jenkins-servers-with-no-password/
	http://www.labofapenetrationtester.com/2014/06/hacking-jenkins-servers.html
	http://zeroknock.blogspot.com/search/label/Hacking%20Jenkins
	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_script_console.rb

	[ElasticSearch]
	http://carnal0wnage.attackresearch.com/2017/01/devooops-elasticsearch.html

	In-Memory Databases
	[Redis]
	https://redis.io/topics/security
	http://antirez.com/news/96
	http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/
	https://gist.github.com/lokielse/d4e62ae1bb2d5da50ec04aadccc6edf1

	[Memcache]
	http://www.slideshare.net/wallarm/us-14novikovthenewpageofinjectionsbookmemcachedinjectionswp
	http://infiltrate.tumblr.com/post/38565427/hacking-memcache
	http://www.darkcoding.net/software/memcached-list-all-keys/
	https://5mins.wordpress.com/2011/04/25/plaidctf-django-challenge-writeup-web-300/
	http://www.slideshare.net/sensepost/cache-on-delivery
	http://blog.couchbase.com/memcached-go-derper-black-hat-and-amazon-web-services-aws-security-bulletin
	https://lincolnloop.com/blog/playing-pickle-security/
	https://www.sensepost.com/blog/2010/playing-with-python-pickle-%231/
	https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/memcached_extractor.rb

	Big Data
	[Hadoop]
	http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf
	https://hadoopecosystemtable.github.io/

	[Vagrant]
	http://carnal0wnage.attackresearch.com/2017/01/devooops-client-provisioning-vagrant.html

	[Docker]
	https://zeltser.com/security-risks-and-benefits-of-docker-application/
	https://blog.docker.com/2014/06/docker-container-breakout-proof-of-concept-exploit/
	http://www.slideshare.net/jpetazzo/linux-containers-lxc-docker-and-security
	https://www.blackhat.com/docs/eu-15/materials/eu-15-Bettini-Vulnerability-Exploitation-In-Docker-Container-Environments-wp.pdf
	https://www.sumologic.com/blog-security/securing-docker-containers/
	https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/2016/april/ncc_group_understanding_hardening_linux_containers-10pdf/

	[Shipyard]
	https://github.com/shipyard/shipyard

	[AWS - Vulnerable Webapps]
	https://www.blackhat.com/docs/us-14/materials/us-14-Riancho-Pivoting-In-Amazon-Clouds-WP.pdf
	https://andresriancho.github.io/nimbostratus/

	[Review S3 buckets to determine security policy]
	https://gist.github.com/cktricky/faf0f40116e535a055b7412458136917

	[Ken Johnson earlier talk on AWS security, dedicated to using these services (cloudwatch/config/cloudtrail)]
	https://www.youtube.com/watch?v=g-wy9NdATtA&feature=youtu.be

	[Tool to list the monitoring services configuration]
	CloudWatch / CloudTrail / Config
	https://gist.github.com/cktricky/f19e8d55ea5dcb1fdade6ede588c6576

	[Review “Well Architected Framework” from AWS which discuss monitoring and other controls]
	http://d0.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf

	[Tool to inspect each user’s permissions]
	https://gist.github.com/cktricky/257990df2f36aa3a01a8809777d49f5d

	[If you’re using something like Paperclip + Rails, try Fog to leverage Roles]
	https://github.com/thoughtbot/paperclip/issues/1591


	[Backdooring AWS accounts]
	https://danielgrzelak.com/backdooring-an-aws-account-da007d36f8f9#.e341mt8zn
	https://danielgrzelak.com/exploring-an-aws-account-after-pwning-it-ff629c2aae39#.7198xyt30
	https://danielgrzelak.com/disrupting-aws-logging-a42e437d6594#.nb8s0ser4

	[Gone in 60 Milliseconds - Intrusion and Exfiltration in Server-less Architectures ]
	https://www.youtube.com/watch?v=YZ058hmLuv0

	[Scout 2 AWS Auditing]
	https://github.com/nccgroup/Scout2