Magno Logan magnologan

IAM Tips

Those tips where posted between June and July 2022 on LinkedIn by Roberto Migli.

IAM Tip #1

#IAM tip #1: There are 4 main types of IAM policies: Identity-based policies, resource-based policies, permissions boundaries, Organizations SCPs and Session Policies. Matt Luttrell's blog post will guide you through when and how to use them.

Security Conferences

A list of interesting conferences for vulnerability researchers. See also: https://twitter.com/i/lists/1543557448123957249

Name	Dates	Location	Site
OffensiveCon	10-11/05/2024	Berlin, Germany	https://www.offensivecon.org/
t2.fi	18-19/04/2024	Helsinki, Finland	https://t2.fi/
Zer0Con	04-05/04/2024	Seoul, South Korea	https://zer0con.org
Code Blue	08-09/11/2023	Tokyo, Japan	https://codeblue.jp/

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

Update: Please see Bishop Fox's rapid response post Log4j Vulnerability: Impact Analysis for latest updates about this vulnerability.

Technologies using Apache Log4j

The Cosmos 🌌 team at Bishop Fox 🦊 is currently researching open-source projects that appear to use Log4j by default.

Apache Druid
Apache Dubbo
Apache Flink
Apache Flume

	loader:
	project_id: 3074491541
	domain: dgormiugatox.com
	bot:
	c2s:
	- skaiortalop.com
	- ijoyzymama.com
	- ertusaporf.com
	- elcapolis.com
	- lezhidov.cloud

	function Test-WebAcademy-Labs-Status($sessionCookieValue){
	$storageFile="$env:USERPROFILE\.webacademy-labs-status"
	$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession
	$cookie = New-Object System.Net.Cookie
	$cookie.Name = "SessionId"
	$cookie.Value = $sessionCookieValue
	$cookie.Domain = ".portswigger.net"
	$session.Cookies.Add($cookie);
	Write-Host "[i] Status storage file: $storageFile" -ForegroundColor Cyan
	Write-Host "[+] Retrieving labs status from PortSwigger labs web page..." -ForegroundColor Yellow

	from hashlib import md5, sha1
	from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
	from cryptography.hazmat.backends import default_backend
	from base64 import b64encode, b64decode
	import sys, time
	import requests

	DEFAULT_MASTERKEY=b'p1a2l3o4a5l6t7o8'

	class PanCrypt():

	#!/bin/bash

	# Verify we have wget and build tools
	apt-get update && apt-get install -y wget gcc make

	# add or remove python versions; full index @ https://www.python.org/ftp/python/
	cd /tmp &&\
	wget https://www.python.org/ftp/python/3.5.10/Python-3.5.10.tgz &&\
	wget https://www.python.org/ftp/python/3.6.9/Python-3.6.9.tgz &&\
	wget https://www.python.org/ftp/python/3.7.9/Python-3.7.9.tgz &&\

	#!/bin/bash
	#########################################################################################################
	# Script to identify Log4J affected class for CVE-2021-44228 in a collection of EAR/WAR/JAR files
	# Based on this script:
	# https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/identify-class-location.sh
	#########################################################################################################
	if [ "$#" -lt 1 ]; then
	script_name=$(basename "$0")
	echo "Usage:"
	echo " $script_name [BASE_SEARCH_FOLDER]"

	#!/bin/bash
	set -x

	function setenv-all-pods() {
	echo
	DEPLOYMENT_LIST=$(kubectl -n $1 get deployment -o jsonpath='{.items[*].metadata.name}')
	echo "Set Log4J setting for all pods by overriding LOG4J_FORMAT_MSG_NO_LOOKUPS with true."
	for deployment_name in $DEPLOYMENT_LIST; do
	kubectl -n $1 set env deployment $deployment_name LOG4J_FORMAT_MSG_NO_LOOKUPS="true"
	done