OWASP Web 2.0 Project Update

Posted on 9:48 AM by Tina

Some of you likely recall the talk back in 2016 or so of updating the OWASP Foundation website to not appear so much like a...well, a wiki.  That talk was carried forward into 2017 and 2018 and, with each year, the proposal got pushed ahead as there were other, deeper projects to tackle.  With the arrival of 2019 and a firm project plan under the guidance of Mike McCamon, Executive Director, we are finally moving toward a functioning, modern website that will be a whole lot less...wiki-like.  The journey has been circuitous and, while we are not anywhere near complete, we have a set plan in place to bring it to fruition within the calendar year (second quarter of the year, actually).

TLDR: How Can You Help? 

There are certainly ways in which you can get involved now.  For instance, we are looking for a clean way to get wiki pages into GitHub markdown format for archival.  I have done some work here but there are parsing issues with some of the tools.  Do you know a good tool or have you done similar work?  Also, are you or do you know a good designer, someone familiar with GitHub pages that can provide some useful help and feedback along the way?  A Jekyll expert to help code a theme with a handful of templates would be a great addition.  In addition, we could use website server admins who could help with assigning redirects to maintain search integrity.  Finally, there will be a great many pages to move that we will also eventually need community involvement in.  

So, What Have We Done? 

Thus far we have researched various ideas for standing up a new site, including modifying the current wiki, spinning up our own web server, contracting a third party to host and build a new site, and also using existing infrastructure with our own content to launch a new face for OWASP.  Our discussions led us to a familiar place, one that nearly every developer in the OWASP space is familiar with: GitHub.   

In our conversations with GitHub, it became readily apparent that using the platform would be a win for the Foundation as well as GitHub.  Nearly everyone who runs a project at OWASP (documentation or otherwise) uses GitHub.  Because our target audience is also mostly developers we know that they are also very comfortable with the platform.  And while GitHub has a number of high profile companies using their GitHub Pages, the use of the platform as the basis for the entire website of the number one non-profit foundation in the application security sector is a big draw.

We have run with that GitHub Pages idea and have spent internal manpower on a proof of concept.  This proof of concept is less about the UX of the site than the functionality, the ability to utilize the authentication systems, and the ability to utilize automation to push out changes quickly.

Where Are We Now?

We are doing the final stages of website architecture. We are also planning what needs to be in the site, how the pieces will integrate with current projects and chapters, and how we might utilize the community to integrate the pieces so that we have a visually and functionally cohesive website that spans across multiple repositories.

What Is Next?

We will soon be looking for a modern website design that is responsive and clean.  We will begin using the knowledge gained from our proof of concept to build out the internals of the website and then we will start implementing the highest traffic pages and administrative areas into the new platform.  Once we have the big-ticket items moved we will start looking at what is left and moving over those pieces.  The eventual goal would be to have a new, modern website for the future of OWASP while keeping the wiki as an archive of really useful information.


We hope you are as excited as we are about the future of the OWASP Foundation website and will join us as we move toward a modern web presence.  If you have any questions or would like to volunteer your time, experience or knowledge, please contact me at harold.blankenship@owasp.com

Related posts

0 comments

How To Automatically Translate Any Android App Into Any Language

Posted on 1:20 AM by Tina

There is the number of applications which are not having the features of translating apps to your favorite languages. This makes it difficult for the users to translate apps into their native language. Today, I am going to tell you about an application which will help you to Automatically Translate Any Android App into Any Language.
Nowadays there are around hundreds of application on play store which is having the feature of translate but some applications don't have this features. This is just because they don't have proper developers or sometimes translators.
There is an application launched by Akhil Kedia from XDA Developer which made it possible for all the users to translate the application to any language you need. This is something which everyone needs it.
Akhil Kedia built an Xposed module in which users can easily change the language of any application to whichever they like or love. Personally, we all love English language but there are peoples in many parts of the world they are suitable for other languages.
Automatically Translate Any Android App into Any Language
Automatically Translate Any Android App into Any Language

Automatically Translate Any Android App into Any Language

The best part about this Xposed Module is that it translates the application to any language whichever you like and there are around many languages which you can try it. The other best part about this application is that the user interface which is amazing.
In an Android application, the best thing is the user interface. This is something which helps users to download the module or application to run again and again. There are about many settings which can be changed from the application.
The setup process is a bit different from other applications but if you will look at the application you will definitely love it. Just because of too many settings and features available in the application and you can turn it to any language without any crashing issues of the application.

Requirements:

  • Rooted Android Phone
  • Xposed Framework installed on your phone.
  • Android 5.0 or higher.
  • Unknown Source enabled (You might be knowing it)
How to Automatically Translate Any Android App into Any Language
  • Download the module called as All Trans from here: Download
Automatically Translate Any Android App
  • Now, after installation, it will ask you to reboot your phone to activate the module
  • Now, you need to get the API Key to get it you need to sign up with Yandex first so sign up: Yandex Sign up
Automatically Translate Any Android App
  • Then after sign up you will get the API key just enter the API key in the All-Trans application.
Automatically Translate Any Android App
  • Open All Trans Application and the swipe right to Global Settings.
Automatically Translate Any Android App
  • Click on Enter Yandex Subscription key and then enter your key.
Automatically Translate Any Android App
  • In Global Settings click on Translate from and select the Language the application is already in. (Eg: English)
Automatically Translate Any Android App
  • Now, click on translate to and select your favorite language. This will change the language.
Automatically Translate Any Android App
  • Swipe left and select the applications which you need to translate and done.
Automatically Translate Any Android App
  • After selecting just open the application and the language is translated automatically.
Automatically Translate Any Android App

Final Words:

This is the best and easy way to Automatically Translate Any Android App into Any Language. I hope you love this article.Share this article with your friends and keep visiting for more tips and tricks like this and I will meet you in the next one.
Stay Updated Tune IemHacker

Continue reading

0 comments

HACK SNAPCHAT ACCOUNT BY MAC SPOOFING

Posted on 4:53 PM by Tina

In the last article, I have discussed a method on how to hack SnapChat account using SpyStealth Premium App. In this article, I am gonna show you an advanced method that how to hack SnapChat account by mac spoofing. It works same as WhatsApp hacking by mac spoofing. It's a bit more complicated than the last method discussed and requires proper attention. It involves the spoofing of the mac address of the target device. Let's move on how to perform the attack.

HOW TO HACK SNAPCHAT ACCOUNT BY MAC SPOOFING?

Note: This method will work if SnapChat is created on a phone number.
Here I will show you complete tutorial step by step of hacking the SnapChat account. Just understand each step carefully.
  1. Find out the victim's phone and note down it's Mac address. To get the mac address in Android devices, go to Settings > About Phone > Status > Wifi Mac address. And here you'll see the mac address. Just write it somewhere. We'll use it in the upcoming steps.
  2. As you get the target's mac address, you have to change your phone's mac address with the target's mac address. Perform the steps mentioned in this article on how to spoof mac address in android phones.
  3. Now install SnapChat on your phone and use victim's number while you're creating an account. It'll send a verification code to victim's phone. Just grab the code and enter it here.
  4. Once you do that, it'll set all and you'll get all chats and messages which victims sends or receives.
This method is really a good one but very difficult for the non-technical users. Only use this method if you're technical skills and have time to perform every step carefully. Otherwise, you can hack SnapChat account using Spying app.

Related news


  1. Pentest Reporting Tools
  2. Hack Tools Online
  3. Hack Tools For Ubuntu
  4. Pentest Tools Website
  5. Hacking Tools 2019
  6. Pentest Tools Kali Linux
  7. Pentest Tools Open Source
  8. Nsa Hacker Tools
  9. Nsa Hack Tools
  10. Hack Tools
  11. Hackrf Tools
  12. Hacker Tools Mac
  13. Best Hacking Tools 2019
  14. Hacker Hardware Tools
  15. Pentest Tools Bluekeep
  16. Hacking Tools Github
  17. Hackers Toolbox
  18. Hack Tools Download
  19. Hacker Tools 2020
  20. Pentest Tools For Ubuntu
  21. Hacking Tools Online
  22. Hack Website Online Tool
  23. Termux Hacking Tools 2019
  24. Hacker Tools Apk Download
  25. Hacking Tools Software
  26. Pentest Tools Port Scanner
  27. Hacking Tools For Windows 7
  28. Hack Website Online Tool
  29. Hacker Tools 2020
  30. Pentest Tools Open Source
  31. Pentest Automation Tools
  32. Hacking Tools Software
  33. Best Hacking Tools 2020
  34. Hacking Tools 2020
  35. Game Hacking
  36. Hacking Tools Download
  37. Pentest Tools Free
  38. How To Hack
  39. Hacker Tools 2020
  40. Hacker Security Tools
  41. Hack Tools Github
  42. Hacker Tools 2019
  43. Hacker Tools Free Download
  44. Hacking Tools For Pc
  45. Hacker Tools For Mac
  46. Hacker Tools 2020
  47. Underground Hacker Sites
  48. Hack Apps
  49. Hacker Tools 2020
  50. Nsa Hacker Tools
  51. Hack Tools Mac
  52. Hack Tools For Windows
  53. Hacking Tools Kit
  54. Pentest Tools Alternative
  55. Hack Tools Download
  56. How To Make Hacking Tools
  57. Pentest Tools Windows
  58. Pentest Tools Apk
  59. Tools Used For Hacking
  60. New Hack Tools
  61. Hacking Tools For Pc
  62. Hack Tools For Games
  63. Tools 4 Hack
  64. Hacking Tools Github
  65. Hacking Tools For Windows 7
  66. Hacking Tools For Games
  67. What Are Hacking Tools
  68. What Are Hacking Tools
  69. Hacking Tools For Games
  70. Hacking Tools Free Download
  71. Hacking Tools For Pc
  72. How To Install Pentest Tools In Ubuntu
  73. Free Pentest Tools For Windows

0 comments

DNSSEC, From An End-User Perspective, Part 3

Posted on 8:26 AM by Tina

In the first post of this DNSSEC series, I have shown the problem (DNS vulnerabilities), and in the second post, the "solution." In this third post, I am going to analyze DNSSEC. Can DNSSEC protect the users against all of the attacks? Or just part of them? What about corner cases?

The following list are the attack types from the first post, where DNSSEC can protect the users:

  • DNS cache poisoning the DNS server, "Da Old way"
  • DNS cache poisoning, "Da Kaminsky way"
  • ISP hijack, for advertisement or spying purposes
  • Captive portals
  • Pentester hijacks DNS to test application via active man-in-the-middle
  • Malicious attacker hijacks DNS via active MITM

The following list are the attack types from the first post, where DNSSEC cannot protect the users:

  • Rogue DNS server set via malware
  • Having access to the DNS admin panel and rewriting the IP
  • ISP hijack, for advertisement or spying purposes
  • Captive portals
  • Pentester hijacks DNS to test application via active man-in-the-middle
  • Malicious attacker hijacks DNS via active MITM

If you are a reader who thinks while reading, you might say "What the hell? Am I protected or not???". The problem is that it depends… In the case where the attacker is between you and your DNS server, the attacker can impersonate the DNS server, downgrade it to a non DNSSEC aware one, and send responses without DNSSEC information.

Now, how can I protect against all of these attacks? Answer is "simple":
  1. Configure your own DNSSEC aware server on your localhost, and use that as a resolver. This is pretty easy, even I was able to do it using tutorials.
  2. Don't let malware run on your system! ;-)
  3. Use at least two-factor authentication for admin access of your DNS admin panel.
  4. Use a registry lock (details in part 1).
  5. Use a DNSSEC aware OS.
  6. Use DNSSEC protected websites.
  7. There is a need for an API or something, where the client can enforce DNSSEC protected answers. In case the answer is not protected with DNSSEC, the connection can not be established.

Now some random facts, thoughts, solutions around DNSSEC:

That's all folks, happy DNSSEC configuring ;-)

Note from David:
Huh, I have just accidentally deleted this whole post from Z, but then I got it back from my browsing cache. Big up to Nir Sofer for his ChromeCacheView tool! Saved my ass from kickin'! :D

Related news


0 comments

Subscribe to: Posts (Atom)