Aspaen Gimnasio Saucará: junio 2020

¿Exponer En Milán? Sencillo Si Nos Juntamos

Hace poco más de seis meses, hablábamos con Nelly de Juan una arquitecta de interiores española que vive hace bastantes años en Milán y directora del sitio ei-Design, ( plataforma de promoción del diseño español y latinoamericano en Italia) sobre la posibilidad de hacer una exposición de diseño latinoamericano en Milán, durante su semana del diseño en alianza con nuestro sitio LACOD. La idea atrevida pero viable debido a la calidad de diseñadores que tenemos en la región ella se puso en la tarea y nos dio una buena sorpresa: Era muy viable.

lanzamiento en Milán, el perchero que llamamos "organizador de pared Eriza

Nelly:

Al trabajar en equipo con ei-Design que tiene todos los contactos y enlaces logramos conseguir un espacio de buena circulación en el mejor lugar posible, por un precio muy competitivo. Gracias a su gestión y viendo a la distancia los boletines de prensa parecemos ser uno de los eventos más destacado del barrio, como se puede constatar en la divulgación que ya están haciendo medios especializados.

Milan en contexto:

El Fuori Saloni ( afuera del salón) es un evento que se hace en toda la ciudad en forma paralela a su salón del mueble ( Salone del mobile) la mayor y más importante del mundo. Debido a la magnitud de la misma y las miles de personas que acuden desde todo el planeta. En la ciudad acontecen una cantidad de eventos y exposiciones paralelas de todo tipo de empresas. Las más emblemáticas alquilan enormes bodegas por fuera del recinto ferial para invitar a sus clientes a terminar la visita allí. Lo mismo sucede con pequeñas empresas y diseñadores independientes que no encajan en la institucionalidad del "salone" Estas tienden a asociarse en espacios comunales, galerías o incluso apartamentos dentro de las zonas por las cuales se hace el movimiento que es coordinado por medios de mapas y guias interactivas. Algunos barrios y calles de la ciudad, que durante el año no tienen ninguna visibilidad, se transforman para este evento. Es conocida la zona Tortona donde están las mayores empresas del "Italian Design System" y la zona Brera, las dos alrededor del centro de Milán.

Isola:

En los últimos años ha surgido una nueva zona más alternativa y por ende más interesante el llamado "Isola Design District" que se lanzó el año pasado con un énfasis más hacia el diseño independiente y las pequeñas producciones. Lo que llaman los italianos "artiginato" que no es equivalente a su traducción literal "artesania" pues en su caso son tradiciones de oficios milenarias, mezcladas con materiales y sistemas sofisticados de producción. La entrada a Isola, está en una plaza donde está ubicado el " Bosque Vertical" Un edificio que se ha convertido en un ícono en la ciudad al lado dentro del nuevo espacio Gae Aulenti. En este lugar, desde el año anterior se creó un nuevo distrito de diseño que arrancó en la anterior semana del diseño 2017, con mucho éxito, pues es el barrio que sigue después de Brera, un sector tradicional del "Fuori Saloni". El recorrido Isola, se inicia en Ada Steca, Un centro cultural de los artesanos y pequeños productores milaneses, donde está el "cuartel general" de Isola Design District, y donde estará también está la exposición de diseño latinoamericano en Milán: Latinoamerican Contemporary Design LACOD, como evento destacado. Estamos en el centro de la acción.

El proceso:

La convocatoria a través de este sitio y de ie-Design contó con el apoyo de todos nuestros enlaces en los diferentes países precipitó una avalancha de solicitudes, más de 70 pero que infelizmente no cumplían con los requisitos de producto o diseño. A muchos excelentes diseñadores de modas, les informamos que este no era el evento para ellos, otros simplemente no tenían el nivel que la organización de "Isola Design District" exigía. Se seleccionaron 12, de los cuales infelizmente 3 no pudieron finalmente asistir.

Los seleccionados:

Ya presentes el año pasado en París y NY, el estudio 6/9 está en Milán

Al final tenemos la participación de 5 diseñadores o equipos de Colombia. 2 de México, uno de Brasil y uno de Argentina: Aqui tenemos algunas de sus piezas:

El último lanzamiento de Estudio 6-9 a partir de la plaza de toros del mismo barrio La Macarena

De Jorge y Valeria Montaña. La colección eriza que viene de la bienal de arte de Venecia.[/caption]

La mesa eriza de Jorge y Valeria Montaña

Hector Alvarez, un purista de la buena forma, viene de México

Tambien de México: Mary Arrieta con joyas

DKO studio, su socia Giovanna Antúnez es brasileña. Pero su estudio está en Nápoles. Es diseño brasileño hecho en Italia.

Daniel Rubio. El diseñador bogotano lleva dos muebles de impecable factura

Claudia Akel . Un trabajo primoroso de intervenciónn muy respetuosa sobre mochilas arhuacas a partir de referentes de la región costera colombiana.

El estudio Mangle. Ellos modestamente se definen como carpinteros pero son unos artistas del mueble y la madera con presencia mundial.

Martin Dalponte, celebra el asado. Es el autor de esta parrilla modular pero lleva a Milán una línea de accesorios como este "pinguino" inspirado en la tradición de la jarrita argentina con esta forma

La exposición Latinamerican Contemporary Design es organizada en Italia por ei-Design con la gestión y promoción de LACOD

En pocos días vamos a exponer en Milán. Lo que para muchos es un sueño irrealizable, lo conseguimos en base a gestión pura. LACOD Latinamerican Contemporary Design con otros 9 colegas de cuatro países estará en la capital del diseño mundial.

Related links

Ethical hacking : Top 14 best websites to learn hacking 2018

The Hacker News: The Hacker News — most trusted and widely-acknowledged online cyber security news magazine with in-depth technical coverage for cybersecurity.
Hakin9: E-magazine offering in-depth looks at both attack and defense techniques and concentrates on difficult technical issues.
Exploit DB: An archive of exploits and vulnerable software by Offensive Security. The site collects exploits from submissions and mailing lists and concentrates them in a single database.
Hacked Gadgets: A resource for DIY project documentation as well as general gadget and technology news.
Metasploit: Find security issues, verify vulnerability mitigations & manage security assessments with Metasploit. Get the worlds best penetration testing software now.
KitPloit: Leading source of Security Tools, Hacking Tools, CyberSecurity and Network Security.
SecurityFocus: Provides security information to all members of the security community, from end users, security hobbyists and network administrators to security consultants, IT Managers, CIOs and CSOs.
SecTools.Org: List of 75 security tools based on a 2003 vote by hackers.
DEFCON: Information about the largest annual hacker convention in the US, including past speeches, video, archives, and updates on the next upcoming show as well as links and other details.
Phrack Magazine: Digital hacking magazine.
NFOHump: Offers up-to-date .NFO files and reviews on the latest pirate software releases.
HackRead: HackRead is a News Platform that centers on InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News with full-scale reviews on Social Media Platforms.
Black Hat: The Black Hat Briefings have become the biggest and the most important security conference series in the world by sticking to our core value: serving the information security community by delivering timely, actionable security information in a friendly, vendor-neutral environment.
Packet Storm: Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers.

BurpSuite Introduction & Installation

What is BurpSuite?
Burp Suite is a Java based Web Penetration Testing framework. It has become an industry standard suite of tools used by information security professionals. Burp Suite helps you identify vulnerabilities and verify attack vectors that are affecting web applications. Because of its popularity and breadth as well as depth of features, we have created this useful page as a collection of Burp Suite knowledge and information.

In its simplest form, Burp Suite can be classified as an Interception Proxy. While browsing their target application, a penetration tester can configure their internet browser to route traffic through the Burp Suite proxy server. Burp Suite then acts as a (sort of) Man In The Middle by capturing and analyzing each request to and from the target web application so that they can be analyzed.

Everyone has their favorite security tools, but when it comes to mobile and web applications I've always found myself looking BurpSuite . It always seems to have everything I need and for folks just getting started with web application testing it can be a challenge putting all of the pieces together. I'm just going to go through the installation to paint a good picture of how to get it up quickly.

BurpSuite is freely available with everything you need to get started and when you're ready to cut the leash, the professional version has some handy tools that can make the whole process a little bit easier. I'll also go through how to install FoxyProxy which makes it much easier to change your proxy setup, but we'll get into that a little later.

Requirements and assumptions:

Mozilla Firefox 3.1 or Later Knowledge of Firefox Add-ons and installation The Java Runtime Environment installed

Download BurpSuite from http://portswigger.net/burp/download.htmland make a note of where you save it.

on for Firefox from https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

If this is your first time running the JAR file, it may take a minute or two to load, so be patient and wait.

Video for setup and installation.

You need to install compatible version of java , So that you can run BurpSuite.

Osueta: A Simple Python Script To Exploit The OpenSSH User Enumeration Timing Attack

About Osueta?
Osueta it's a simple Python 2 script to exploit the OpenSSH User Enumeration Timing Attack, present in OpenSSH versions <= 7.2 and >= 5.*. The script has the ability to make variations of the username employed in the bruteforce attack, and the possibility to establish a DoS condition in the OpenSSH server.

Read more: OpenSSH User Enumeration Time-Based Attack

The bug was corrected in OpenSSH version 7.3.

Authors of Osueta:

c0r3dump3d: coredump@autistici.org
rofen: rofen@gmx.de

Osueta's Installation
For Linux users, open your Terminal and enter these commands:
If you're Windows users, follow these steps:

Install Python 2.7.x from Python.org first. On Install Python 2.7.x Setup, choose Add python.exe to Path.
Download Osueta-master zip file.
Then unzip it.
Open CMD or PowerShell window at the Osueta folder you have just unzipped and enter these commands:
pip install python-nmap paramiko IPy
python osueta.py -h

Advice: Like others offensive tools, the authors disclaims all responsibility in the use of this script.

Osueta help menu:

Osueta's examples:
A single user enumeration attempt with username variations:
python2 osueta.py -H 192.168.1.6 -p 22 -U root -d 30 -v yes

A single user enumeration attempt with no user variations a DoS attack:
python2 osueta.py -H 192.168.1.6 -p 22 -U root -d 30 -v no --dos yes

Scanning a C class network with only one user:
python2 osueta.py -H 192.168.1.0/24 -p 22 -U root -v no

Scanning a C class network with usernames from a file, delay time 15 seconds and a password of 50000 characters:
python2 osueta.py -H 192.168.1.0/24 -p 22 -L usernames.txt -v yes -d 15 -l 50

Download Osueta

BruteSpray: A Brute-forcer From Nmap Output And Automatically Attempts Default Creds On Found Services

About BruteSpray: BruteSpray takes nmap GNMAP/XML output or newline seperated JSONS and automatically brute-forces services with default credentials using Medusa. BruteSpray can even find non-standard ports by using the -sV inside Nmap.

BruteSpay's Installation

With Debian users, the only thing you need to do is this command:
sudo apt install brutespray

For Arch Linux user, you must install Medusa first: sudo pacman -S medusa

And then, enter these commands to install BruteSpray:

Supported Services: ssh, ftp, telnet, vnc, mssql, mysql, postgresql, rsh, imap, nntpp, canywhere, pop3, rexec, rlogin, smbnt, smtp, svn, vmauthdv, snmp.

How to use BruteSpray?

First do an Nmap scan with -oG nmap.gnmap or -oX nmap.xml.
Command: python3 brutespray.py -h
Command: python3 brutespray.py --file nmap.gnmap
Command: python3 brutesrpay.py --file nmap.xml
Command: python3 brutespray.py --file nmap.xml -i

You can watch more details here:

Examples

Using Custom Wordlists:

python3 brutespray.py --file nmap.gnmap -U /usr/share/wordlist/user.txt -P /usr/share/wordlist/pass.txt --threads 5 --hosts 5

Brute-Forcing Specific Services:
python3 brutespray.py --file nmap.gnmap --service ftp,ssh,telnet --threads 5 --hosts 5

Specific Credentials:
python3 brutespray.py --file nmap.gnmap -u admin -p password --threads 5 --hosts 5

Continue After Success:
python3 brutespray.py --file nmap.gnmap --threads 5 --hosts 5 -c

Use Nmap XML Output:
python3 brutespray.py --file nmap.xml --threads 5 --hosts 5

Use JSON Output:
python3 brutespray.py --file out.json --threads 5 --hosts 5

Interactive Mode: python3 brutespray.py --file nmap.xml -i

Data Specs

{"host":"127.0.0.1","port":"3306","service":"mysql"} 
{"host":"127.0.0.10","port":"3306","service":"mysql"}
...

Changelog: Changelog notes are available at CHANGELOG.md.

You might like these similar tools:

Download BruteSpray

Related word

Learning Resources For Hacking And Pentesting

In this article, I'm going to provide you a list of resources which I have found very useful. I don't remember all of them from top of my head so I might miss some. This list will be updated on usual basis. Hope you'll find some good stuff to learn. If you have got suggestions leave them down below in the comments section.

Free Hands on Labs:

1. Hack The Box - live machines to hack your way around. Besides boxes they have awesome challenges and great labs to try out.

2. TryHackMe - great way to learn pentesting while doing it. Lots of machines to hack and lots of ground to cover.

3. Portswigger Web Security Academy - learn web application pentesting.

Free Training (Mostly Introductory stuff):

1. Tenable University - training and certification on Nessus etc.

2. Palo Alto Networks - Palo Alto Networks offers an abundance of resources to prepare for there certifications. The training is free but the exams cost.

3. Open P-TECH - has an introductory course on Cybersecurity Fundamentals.

4. IBM Security Learning Academy - has many courses but focused on IBM security services and

products.

5. Cisco Networking Academy - not all courses are free but Introduction to Cybersecurity and Cybersecurity Essentials are free.

6. AWS Training and Certification - has some free cloud security training courses.

7. Metasploit Unleashed - Free Online Ethical Hacking Course - Offensive Security's free online course on metasploit.

8. Coursera and Edx - you already know about them.

Blogs:

1. HackTricks - This is simply an awesome blog just visit it and you'll fall in love.

2. pentestmonkey - I visit it most of the time for one-liner reverse shells they are awesome.

3. Rasta Mouse

Writeups:

1. 0xdf

2. Snowscan

3. RootFlag.io

4. xct@vulndev

5. Rana Khalil

YouTube:

1. ippsec - an awesome YouTube channel with tons of information in every video. New video comes out weekly as soon as the machine on hackthebox expires. https://ippsec.rocks for video searching

2. xct - short walkthroughs on hackthebox machines.

3. Cristi Vlad - advice and content on pentesting and python.

4. LiveOverflow - reverse engineering on steroids.

5. SANS Pen Test Training - SANS institute webinars and talks.

6. VbScrub - great pentesting videos.

7. BinaryAdventure - great pentesting and reverse engineering videos.

8. GynvaelEN - great videos and talks about CTFs and pentesting.

GitHub Repos:

1. PayloadsAllTheThings - heaven of hackers.

2. Pentest Monkey - reverse shells and more.

Related word

BurpSuite Introduction & Installation

You need to install compatible version of java , So that you can run BurpSuite.

Continue reading

RFCrack Release - A Software Defined Radio Attack Tool

RFCrack uses the following hardware with RFCat libraries:

YardStick One:

https://goo.gl/wd88sr

I decided to cleanup my RF testing harness and release it as a tool named RFCrack

Mostly because it has been pain to set up use-case scenarios from scratch for every device I am testing. Rather then release a tool no one knows how to use. The below video will be a quick but comprehensive tutorial to get you started If you've been following the blogs, this will greatly simplify your testing, in the following ways:

RFCrack handles all of your data conversions.
It allows you to capture, replay and save payloads for use anytime
It will handle rolling code bypass attacks on your devices.
You can jam frequencies and fuzz specific values
It will also allow you to scan specific frequencies in discovery mode or incrementally probe them
RFCrack will hopefully have keyless entry & engine bypass support in the near future

This is the first release, everything works as intended but there will be plenty of updates as I continue to do research and find reasons to add features needed for testing. I am still making changes and making it more flexible with modifiable values and restructuring code. If you have any legitimate use case scenarios or need a specific value to be modifiable, hit me up and I will do my best to update between research, if its a legitimate use case.

You can reach me at:
Twitter: @Ficti0n
http://cclabs.io , http://consolecowboys.com

GitHub Code for RFCrack:

https://github.com/cclabsInc/RFCrack

Full RF Hacking Course in Development:

Not all of the attacks in the tool have been covered in the RF hacking blog series and a few more are in research mode, as such, not yet added to the tool but will probably be covered in a full length online class on Hacking with RF which includes all targets and equipment. Send an email to info(at)cclabs.io if your interested.

Walkthrough Training Video:

Until Next time:

Cheers, and enjoy the tool for your personal use testing devices, feedback and bug reports are appreciated. I have another RF blog coming out shortly based on my friends research into hacking garages/gates and creating keyfobs. I will post when its ready.

How To Insert Data Into Database | Tutorial 3

Welcome to my another tutorial of PHP and MYSQL. In the previous tutorial I've briefly discussed How to make a PHP file and How to save the PHP file in the root directory of the server. How to run PHP script over the Web Browser etc.

Now in this tutorial I've discussed about inserting data into database by getting the values from user with the help of HTML form. One thing should be remembered that getting a values from users by HTML form is the only way to get values from users in PHP.

How To Insert Data into Database

Step 1:

Open your text editor and create HTML form.

Step 2:

Make a database connection in PHP.

Step 3:

Write an INSERT query for the sake of insertion data into database like INSERT INTO table_Name(table_Attribute1, table_Attribute2....) VALUES('1', 'Alex'...); etc. Now watch the video to make a better understanding the concept of insertion.

Entropy Toolkit's execution

Entropy Toolkit's examples:

Example of exploiting a single webcam
entropy -b 1 -i [webcam's ip address and port] -v
Example: entropy -b 1 -i 192.168.1.100:80 -v

Example of exploiting webcams from a list
entropy -b 2 -l [file text] -v
Example: entropy -b 2 -l iplist.txt -v

Example of exploiting webcams using shodan
entropy -b 2 -v --shodan [you shodan api key]
Example: entropy -b 2 -v --shodan PSKINdQe1GyxGgecYz2191H2JoS9qvgD

Entropy Toolkit disclaimer:
Usage of the Entropy Toolkit for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, federal, and international laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Entropy Toolkit license: MIT license.

Download Entropy Toolkit
(Sign up Windscribe for free, get full protection and stay anonymous
with the best free VPN. Read more here)More information

$$$ Bug Bounty $$$

What is Bug Bounty ?

A bug bounty program, also called a vulnerability rewards program (VRP), is a crowdsourcing initiative that rewards individuals for discovering and reporting software bugs. Bug bounty programs are often initiated to supplement internal code audits and penetration tests as part of an organization's vulnerability management strategy.

Many software vendors and websites run bug bounty programs, paying out cash rewards to software security researchers and white hat hackers who report software vulnerabilities that have the potential to be exploited. Bug reports must document enough information for for the organization offering the bounty to be able to reproduce the vulnerability. Typically, payment amounts are commensurate with the size of the organization, the difficulty in hacking the system and how much impact on users a bug might have.

Mozilla paid out a $3,000 flat rate bounty for bugs that fit its criteria, while Facebook has given out as much as $20,000 for a single bug report. Google paid Chrome operating system bug reporters a combined $700,000 in 2012 and Microsoft paid UK researcher James Forshaw $100,000 for an attack vulnerability in Windows 8.1. In 2016, Apple announced rewards that max out at $200,000 for a flaw in the iOS secure boot firmware components and up to $50,000 for execution of arbitrary code with kernel privileges or unauthorized iCloud access.

While the use of ethical hackers to find bugs can be very effective, such programs can also be controversial. To limit potential risk, some organizations are offering closed bug bounty programs that require an invitation. Apple, for example, has limited bug bounty participation to few dozen researchers.

¿Exponer En Milán? Sencillo Si Nos Juntamos

Nelly:

Milan en contexto:

Isola:

El proceso:

Los seleccionados:

Related links

Ethical hacking : Top 14 best websites to learn hacking 2018

BurpSuite Introduction & Installation

Related links

Osueta: A Simple Python Script To Exploit The OpenSSH User Enumeration Timing Attack

Related links

BruteSpray: A Brute-forcer From Nmap Output And Automatically Attempts Default Creds On Found Services

Learning Resources For Hacking And Pentesting

Free Hands on Labs:

Free Training (Mostly Introductory stuff):

Blogs:

Writeups:

YouTube:

GitHub Repos:

BurpSuite Introduction & Installation

RFCrack Release - A Software Defined Radio Attack Tool

GitHub Code for RFCrack:

Full RF Hacking Course in Development:

Walkthrough Training Video:

Until Next time:

Related articles

How To Insert Data Into Database | Tutorial 3

How To Insert Data into Database

$$$ Bug Bounty $$$

Related news