DEV Community: Iannetta

Utilities

Iannetta — Wed, 17 Apr 2024 23:53:34 +0000

Here are some tools, techniques, ideas and anything else that might be useful in everyday life.

Tools

ray.so
Do you ever find yourself needing to include code examples in documentation or presentations? Now, you can streamline that process by using this tool to generate images of your code snippets. No more wasting time formatting and adjusting code manually. With this tool, you can quickly and easily create images of your snippets, adding a professional touch to your documentation and presentations.

sli.dev
Nothing beats crafting presentations as code! Slidev, powered by Vite and Vue, allows customization, creation of reusable components, and layouts.

CyberChef
This website is a collection of utilities for information security. Here's how it works: you assemble a pipeline, adding functions like encoding and hashing, then provide an input, and it generates an output based on the pipeline.

Mermaid Live
Have you ever needed to generate a workflow using tools like draw.io? Wouldn't it be great to have that as code? Well, now you can have it all: editable, shareable, and codable.

Typer
If you need to build a command-line tool and know Python, this little guy here is going to be a huge help.

Cheat.sh
Command-line heat-sheet that has more than 50 languages.
The coolest thing is that it works directly in the terminal via curl.
Command

curl cht.sh/python/lambda

Output

# Lambda are anonymous functions in Python by using the keyword lambda
# Therefore they are not bound to a name

# Simple Lambda Function
a = lambda parameter: parameter + 40
#
print (a(2))                    # Outputs 42

# Lambda Functions Inside Real Functions
def subtract_func(n) :
    return lambda x: x - n
#
a = subtract_func(1)            # Sets n to 1 for a
b = subtract_func(2)            # Sets n to 2 for b
#
print(a(-4))                    # Outputs -5 ( -5 = -4 - 1 )
print(b(-2))                    # Outputs -4 ( -4 = -2 - 2 )

# Lambda Function with Multiple Parameters
f = lambda x, y : x + y
#
print( f(1,1) )                 # Outputs 2 ( 1 + 1 )

# map() + lambda functions
a = [1, 2, 3, 4, 5]
b = [1, 2, 3, 4, 5]
#
r = map(lambda x,y : x+y, a,b)  # map() will return an iterator
r_list = list(r)                # listify r
print(r_list)                   # prints [2, 4, 6, 8, 10]

# filter() + lambda functions
# Program to filter out only the even items from a list
my_list = [1, 5, 4, 6, 8, 11, 3, 12]
#
new_list = list(filter(lambda x: (x%2 == 0) , my_list))
#
print(new_list)                 # Output: [4, 6, 8, 12]

Cloud

Iannetta — Wed, 17 Apr 2024 23:14:18 +0000

Guias

AWS
Azure

Tools

ThreatMapper: Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more.
Pulumi - IaC: Infrastructure as code using languages we already know.

Usefull links

Github :: Awesome Cloud Security by 4ndersonLin

Secret Management

Iannetta — Mon, 15 Apr 2024 14:32:34 +0000

When we are developing our solutions, it is common for us to need to connect different services. These services commonly require some type of credential, apikey, token or any access information. As an example, we have database access credentials, Google API keys, digital certificates, AWS credentials, etc. But what would happen if this information fell into the wrong hands?

For this reason we need to be careful with some information!

Checklist

Secrets in the Code
We must not leave any secret fixed in the code:

Secret hardcoded
// 🚫 BAD
const db = new DB({
  user: 'DbUser',
  pass: 'DbP@ss0rd!'
})

To solve this, we can use Environment Variables

// ✅ GOOD
const db = new DB({
  user: process.env.DB_USER,
  pass: process.env.DB_PASS
})

Or Password Vault:

Hashicorp vault
const vault = require("node-vault")({
  apiVersion: process.env.VAULT_VERSION,
  endpoint: process.env.VAULT_URL,
});

const roleId = process.env.ROLE_ID;
const secretId = process.env.SECRET_ID;

const run = async () => {
  const result = await vault.approleLogin({
    role_id: roleId,
    secret_id: secretId,
  });

  vault.token = result.auth.client_token;

  const { data } = await vault.read("secret/data/mysql/webapp");

  const databaseName = data.data.db_name;
  const username = data.data.username;
  const password = data.data.password;

  console.log({
    databaseName,
    username,
    password,
  });
};

run();

This type of information can be in several places:

Code
Settings Files (web.config, .env, application.properties, etc.)
READMEs

Access Management

Ok, we've already removed the secrets found in the code, wikis, etc. But what about the access information that people need to have, such as a bank consultation credential or log panel, what does that look like? How will the development team fix a problem or gain access to the platforms?

It is common for team members to have passwords, certificates or keys to access environments and tools. Taking care of this information is also important.

To do this, some precautions need to be taken:

Nominal Credentials

Each team member who has access to a tool or platform must have their own credential, with a specific profile for their needs.

Access Scope

When problems occur in production or a new functionality requires an analysis of the environment to avoid breaking changes, the team needs information.

Instead of restricting access to everything, creating friction and delaying work demands, let's focus on one question:

What needs to be protected?

You may come to the conclusion:

They cannot perform write operations.
They cannot access personal, sensitive and confidential data.

Great, this is where the work is.
Reach out to the team and say:

"Hey people, we're giving you freedom, we're just not going to enable access to people's data and writing operations so as not to compromise the environment, okay?"

It's MUCH better than asking:

"What do you need?"

For the simple reason that in a WAR ROOM no one knows what they need (besides coffee and an aspirin, of course) and in the end you need to give access to everything because of the pressure.

Scratchs

CWE-798: Use of Hard-coded Credencials

Someone unauthorized has access to production credentials simply because they have access to the source code or documentation.
Someone put the code in a public environment (public personal github, pastebin, etc.) and the secrets were leaked.

Guides

Tools

Bitwarden

Password manager (personal / teams).
For personal use, it is free, open source and can be used on multiple devices.
For companies, it can be used as a vault.
We recommend bitwarden for personal password manager use.

Passbolt

Open source password manager for teams.
It can be installed in different ways, but the main thing: it has a docker-compose.

Hashicorp Vault

Vault for storing passwords, certificates or any other sensitive information.
There is a free and self-hosted option.

Trufflehog

Command line tool for detecting hardcoded secrets.
It runs on docker and is capable of detecting more than 700 types of credentials.
You can scan Github, Gitlab, FileSystem, Logs and S3 Buckets.

Trufflehog with Docker

docker run -it -v "$PWD:/pwd" \
    trufflesecurity/trufflehog:latest \
    github \
    --org=trufflesecurity

Gitlab - Secret Detection

Gitlab (in all its versions) natively has a scan for hard-coded secrets.
The free version is limited compared to the ultimate, but it is a great option if the company does not want to adopt an external tool or wants to use 100% of the platform they already pay for.

Github - Secret Scanning

Github has a built-in secret scan as well.
It runs automatically in all repositories, but there are extra options if Advanced Security is purchased.

Usefull Links

Tutorials

Videos

Fabio Akita :: Your Security Sucks | Password Managers, 2FA, Encryption

Azure

Iannetta — Thu, 11 Apr 2024 22:21:13 +0000

Guides

Security in the Microsoft Cloud Adoption Framework for Azure

Where to learn

A Cloud Guru - Azure Security

AWS

Iannetta — Thu, 11 Apr 2024 22:17:31 +0000

Guides

Where to learn

JWT

Iannetta — Thu, 11 Apr 2024 13:33:32 +0000

Fast Guide

Here are the main precautions when using JWT tokens:

1. Use a strong signature

When we sign our token, we need to use a sizable secret.

We can sign a JWT token in several ways, but the main ones are using symmetric (HS256, HMAC + SHA-256) and asymmetric (RS256, RSA + SHA-256) keys.

As a recommendation, it is better to use asymmetric signature, since:

Only one service can generate the token (using private key), while other services can only verify it (public key).
If the private key is compromised, rotating it does not break other applications with the current token, after all, the public verification keys will continue to work.

JWT with asymmetric key

const fs = require('fs');
const jwt = require('jsonwebtoken');

// use 'utf8' to get string instead of byte array  (512 bit key)
const privateKEY = fs.readFileSync('./private.key', 'utf8');
const publicKEY = fs.readFileSync('./public.key', 'utf8');

const payload = {
  name: 'Gandalf'
}

// SIGN
const signOptions = {
  issuer: "Authorizaxtion/Resource/This server",
  subject: "iam@user.me",
  audience: "Client_Identity",
  expiresIn: "1d",
  algorithm: "RS256"
};

const token = jwt.sign(payload, privateKEY, signOptions);
console.log('\n\n=== TOKEN ===');
console.log(token);


// VERIFY
var verifyOptions = {
  issuer: "Authorizaxtion/Resource/This server",
  subject: "iam@user.me",
  audience: "Client_Identity",
  expiresIn: "1d",
  algorithm: "RS256"
};

const verified = jwt.verify(token, publicKEY, verifyOptions);
console.log('\n\n=== VERIFIED ===');
console.log(verified);


// DECODE
const decoded = jwt.decode(token, { complete: true });
console.log('\n\n=== DECODED ===');
console.log(decoded);

See a functional example at Replit

2. Always define the algorithm when performing the check

There is a type of vulnerability that occurs in some JWT configurations which is the None Algorithm

In summary, the attacker changes the JWT header to:

{
  "typ": "JWT",
  "alg": "none"
}

And in the backend the lib we use takes the alg value and ignores the verification key.
To prevent this from happening, we must always define the alg when checking the token:

var verifyOptions = {
  //...
  algorithm: "RS256"
};

const verified = jwt.verify(token, publicKEY, verifyOptions);

Usefull links

Articles

How to use Azure to crack API auth tokens

Bot Protection

Iannetta — Wed, 10 Apr 2024 22:52:35 +0000

Technologies

reCaptcha Enterprise
The recaptcha enterprise its a little solutions has:

Option to be invisible (do not require user interaction).
SDK Web and Mobile.

Usefull links

Articles

Cloudflare - Annoucing Turnstile, a user-friendly, privacy-preserving alternate to CAPTCHA

SBOM, Libs e Components

Iannetta — Wed, 10 Apr 2024 14:13:38 +0000

Knowledge base

Awesome SBOM

Articles

Tools

Threat Modeling

Iannetta — Wed, 10 Apr 2024 13:48:07 +0000

Guides

Usefull links
Articles

Gitlab :: Threat Modeling

Tools

OWASP Threat Dragon

DevSecOps

Iannetta — Wed, 10 Apr 2024 12:48:56 +0000

What is?

DevSecOps is a practice with a focus on automation, testing, and security verifications within the DevOps flow. It's a methodology comprising methods, techniques, and processes to connect development, security, and operations throughout all stages of DevOps: Plan, Code, Build, Test, Release, Deploy, Operate, and Monitor.

Where to learn!
TryHackMe :: Intro to Pipeline Automation

Usefull links

DAST

Iannetta — Wed, 10 Apr 2024 11:44:25 +0000

Tools

Dastardly

A lightweight web application security scanner for your CI/CD pipeline. Free, from creators of BurpSuite.

OWASP Zap

The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by a dedicated international team of volunteers. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. It's also a great tool for experienced pentesters to use for manual security testing.

Nuclei

Nuclei is used to send requests across targets based on a template, leading to zero false positives and providing fast scanning on a large number of hosts. Nuclei offers scanning for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, Headless etc. With powerful and flexible templating, Nuclei can be used to model all kinds of security checks.

Encoding

Iannetta — Wed, 10 Apr 2024 00:59:27 +0000

In computing, encoding is the process of transforming a sequence of characters (letters, numbers, punctuation, special characters, symbols) into a format that is efficient for transmission and storage. The format commonly used is . It works something like this:

package main

import (
  b64 "encoding/base64"
  "fmt"
)

func main() {
  // Here is the string to be encoded.
  data := "abc123!?$*&()'-=@~"

  // We performed the encoding.
  sEnc := b64.StdEncoding.EncodeToString([]byte(data))
  fmt.Println(sEnc)

  // We performed the decoding.
  sDec, _ := b64.StdEncoding.DecodeString(sEnc)
  fmt.Println(string(sDec))
}

Output

YWJjMTIzIT8kKiYoKSctPUB+
abc123!?$*&()'-=@~

"Okay, but what will we use this for?" You might be wondering.

Imagine yourself needing to transfer a snippet of code to another computer.

Here's an example:

package main

import (
    "fmt"
    "net/url"
)

func main() {
    s := "this will be esc@ped!"
    fmt.Println("http://example.com/say?message="+url.QueryEscape(s))
}

We have new lines, special characters, etc...
Perhaps some information may be lost in the middle of this process depending on the content being transmitted.
So transmitting this value here is better, isn't it?

Base64

cGFja2FnZSBtYWluCgppbXBvcnQgKAogICAgImZtdCIKICAgICJuZXQvdXJsIgopCgpmdW5jIG1haW4oKSB7CiAgICBzIDo9ICJ0aGlzIHdpbGwgYmUgZXNjQHBlZCEiCiAgICBmbXQuUHJpbnRsbigiaHR0cDovL2V4YW1wbGUuY29tL3NheT9tZXNzYWdlPSIrdXJsLlF1ZXJ5RXNjYXBlKHMpKQp9

You can test it yourself with the IT-TOOLS.

Before we move on to the next topic, it's worth remembering:
Encoding is NOT CRYPTOGRAPHY.