![Little More Help](/img/default-banner.jpg)
- Видео 124
- Просмотров 143 673
Little More Help
США
Добавлен 12 мар 2020
Welcome to Little More Help! This channel is your ultimate resource for comprehensive computer software, hacking, and cloud security tutorials. We provide step-by-step videos, offering clear instructions, practical demonstrations, and expert advice. Whether you're looking to enhance your programming skills, delve into ethical hacking techniques, or explore the world of cloud security, we've got you covered. Join us as we unlock the secrets of technology, equip you with powerful tools, and empower you to navigate the digital landscape confidently. Get ready to level up your tech skills and embark on an exciting journey with us!
Hacking AWS Services | rce_web_app (Medium / Hard)
CloudGoat (☁️🐐)
CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool.
=-=-=-=-=-==-=-==-=-==-=-==-=-==-=-==-=-==-=-=
Note: This is for educational purposes only!
=-=-=-=-=-==-=-==-=-==-=-==-=-==-=-==-=-==-=-=
Starting as the IAM user Lara, the attacker explores a Load Balancer and S3 bucket for clues to vulnerabilities, leading to an RCE exploit on a vulnerable web app which exposes confidential files and culminates in access to the scenario’s goal: a highly-secured RDS database instance.
Alternatively, the attacker may start as the IAM user McDuck and enumerate S3 buckets, eventually leading to SSH keys which grant direct access to the EC2 server and the database beyond...
CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool.
=-=-=-=-=-==-=-==-=-==-=-==-=-==-=-==-=-==-=-=
Note: This is for educational purposes only!
=-=-=-=-=-==-=-==-=-==-=-==-=-==-=-==-=-==-=-=
Starting as the IAM user Lara, the attacker explores a Load Balancer and S3 bucket for clues to vulnerabilities, leading to an RCE exploit on a vulnerable web app which exposes confidential files and culminates in access to the scenario’s goal: a highly-secured RDS database instance.
Alternatively, the attacker may start as the IAM user McDuck and enumerate S3 buckets, eventually leading to SSH keys which grant direct access to the EC2 server and the database beyond...
Просмотров: 134
Видео
Hacking AWS Services | ecs_takeover (Medium / Moderate)
Просмотров 557 месяцев назад
CloudGoat (☁️🐐) CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Note: This is for educational purposes only! =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Starting with access to the external website the attacker needs to find a remote code execution vulnerability. Through this the attacker can take advantage of resources available...
Hacking AWS Services | ec2_ssrf (Medium / Moderate)
Просмотров 597 месяцев назад
CloudGoat (☁️🐐) CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Note: This is for educational purposes only! =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Starting as the IAM user Solus, the attacker discovers they have ReadOnly permissions to a Lambda function, where hardcoded secrets lead them to an EC2 instance running a web app...
Hacking AWS Services | iam_privesc_by_attachment (Medium / Moderate)
Просмотров 947 месяцев назад
CloudGoat (☁️🐐) CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Note: This is for educational purposes only! =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Starting with a very limited set of permissions, the attacker is able to leverage the instance-profile-attachment permissions to create a new EC2 instance with significantly grea...
Hacking AWS Services | cloud_breach_s3 (Small / Moderate)
Просмотров 1128 месяцев назад
CloudGoat (☁️🐐) CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Note: This is for educational purposes only! =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Starting as an anonymous outsider with no access or privileges, exploit a misconfigured reverse-proxy server to query the EC2 metadata service and acquire instance profile keys. ...
Hacking AWS Services | lambda_privesc (Small / Easy)
Просмотров 698 месяцев назад
CloudGoat (☁️🐐) CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Note: This is for educational purposes only! =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Starting as the IAM user Chris, the attacker discovers that they can assume a role that has full Lambda access and pass role permissions. The attacker can then perform privilege ...
Hacking AWS Services | iam_privesc_by_rollback (Small / Easy)
Просмотров 748 месяцев назад
CloudGoat (☁️🐐) CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Note: This is for educational purposes only! =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Starting with a highly-limited IAM user, the attacker is able to review previous IAM policy versions and restore one which allows full admin privileges, resulting in a privilege ...
Hacking AWS Services | vulnerable_cognito (Small / Moderate)
Просмотров 1308 месяцев назад
CloudGoat (☁️🐐) CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Note: This is for educational purposes only! =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= In this scenario, you are presented with a signup and login page with AWS Cognito in the backend. You need to bypass restrictions and exploit misconfigurations in Amazon Cognito ...
Hacking AWS Services | vulnerable_lambda (Small / Easy)
Просмотров 2899 месяцев назад
CloudGoat (☁️🐐) CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= Note: This is for educational purposes only! =-=-=-=-=- -=- -=- -=- -=- -=- -=- -=-= In this scenario, you start as the 'bilbo' user. You will assume a role with more privileges, discover a lambda function that applies policies to users, and exploit a vulnerabili...
Introduction to Cloud Hacking | flaws2.cloud LEVEL 3
Просмотров 889 месяцев назад
flaws2.cloud -all levels =-=-=-=-=-=-=-=-=-=-=-= Level 3 challenge The container's webserver you got access to includes a simple proxy that can be access with: container.target.flaws2.cloud/proxy/flaws.cloud or container.target.flaws2.cloud/proxy/neverssl.com flaws2.cloud LEVEL 3 Walkthrough
Introduction to Cloud Hacking | flaws2.cloud LEVEL 2
Просмотров 919 месяцев назад
flaws2.cloud -all levels =-=-=-=-=-=-=-=-=-=-=-= Level 2 challenge This next level is running as a container at container.target.flaws2.cloud/. Just like S3 buckets, other resources on AWS can have open permissions. I'll give you a hint that the ECR (Elastic Container Registry) is named "level2". flaws2.cloud LEVEL 2 Walkthrough
Introduction to Cloud Hacking | flaws2.cloud LEVEL 1
Просмотров 2139 месяцев назад
flaws2.cloud -all levels =-=-=-=-=-=-=-=-=-=-=-= Level 1 For this level, you'll need to enter the correct PIN code. The correct PIN is 100 digits long, so brute forcing it won't help. flaws2.cloud LEVEL 1 Walkthrough
Introduction to Cloud Hacking| flaws.cloud LEVEL 6
Просмотров 22210 месяцев назад
flaws.cloud - all levels =-=-=-=-=-=-=-=-=-=-=-= Level 6 For this final challenge, you're getting a user access key that has the SecurityAudit policy attached to it. See what else it can do and what else you might find in this AWS account. Access key ID: AKIAJFQ6E7BY57Q3OBGA Secret: S2IpymMBlViDlqcAnFuZfkVjXrYxZYhP dZ4ps u flaws.cloud LEVEL 6 Walkthrough
Introduction to Cloud Hacking| flaws.cloud LEVEL 5
Просмотров 33110 месяцев назад
flaws.cloud -all levels =-=-=-=-=-=-=-=-=-=-=-= Level 5 This EC2 has a simple HTTP only proxy on it. Here are some examples of it's usage: •4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/flaws.cloud/ •4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/summitroute.com/blog/feed.xml •4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/neverssl.com/ See if you can use th...
Introduction to Cloud Hacking| flaws.cloud LEVEL 4
Просмотров 38210 месяцев назад
flaws.cloud -all levels =-=-=-=-=-=-=-=-=-=-=-= Level 4 For the next level, you need to get access to the web page running on an EC2 at 4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud It'll be useful to know that a snapshot was made of that EC2 shortly after nginx was setup on it.
Introduction to Cloud Hacking| flaws.cloud LEVEL 3
Просмотров 27010 месяцев назад
Introduction to Cloud Hacking| flaws.cloud LEVEL 3
Introduction to Cloud Hacking| flaws.cloud LEVEL 2
Просмотров 25710 месяцев назад
Introduction to Cloud Hacking| flaws.cloud LEVEL 2
Introduction to Cloud Hacking| flaws.cloud LEVEL 1
Просмотров 52911 месяцев назад
Introduction to Cloud Hacking| flaws.cloud LEVEL 1
How to use PGP Encryption | This is how Asymmetric Encryption Works DEMO | GNU PG
Просмотров 49511 месяцев назад
How to use PGP Encryption | This is how Asymmetric Encryption Works DEMO | GNU PG
GNU PG Installation | Kleopatra Installation
Просмотров 3,3 тыс.11 месяцев назад
GNU PG Installation | Kleopatra Installation
ngrok | Put localhost on the internet & Reverse Shell
Просмотров 2,8 тыс.Год назад
ngrok | Put localhost on the internet & Reverse Shell
9. Exploiting XXE to retrieve data by repurposing a local DTD
Просмотров 258Год назад
9. Exploiting XXE to retrieve data by repurposing a local DTD
8. Exploiting XXE via image file upload
Просмотров 395Год назад
8. Exploiting XXE via image file upload
6. Exploiting blind XXE to retrieve data via error messages
Просмотров 245Год назад
6. Exploiting blind XXE to retrieve data via error messages
7. Exploiting XInclude to retrieve files
Просмотров 150Год назад
7. Exploiting XInclude to retrieve files
5. Exploiting blind XXE to exfiltrate data using a malicious external DTD
Просмотров 352Год назад
5. Exploiting blind XXE to exfiltrate data using a malicious external DTD
4. Blind XXE with out-of-band interaction via XML parameter entities
Просмотров 197Год назад
4. Blind XXE with out-of-band interaction via XML parameter entities
3. Blind XXE with out-of-band interaction
Просмотров 177Год назад
3. Blind XXE with out-of-band interaction
2. Exploiting XXE to perform SSRF attacks
Просмотров 96Год назад
2. Exploiting XXE to perform SSRF attacks
1. Exploiting XXE using external entities to retrieve files
Просмотров 319Год назад
1. Exploiting XXE using external entities to retrieve files
Great video.Thank you very much.
WORKS!
thats create explain thx , am doing this lab now
thx bro 🖤
I h4te AWS, why do they complicate everything??
GOAT
A simple explanation and perfectly articulated thinking to solve the level! Amazing video :>
i cant connect my bluetooth mic to rpi in HFP. Any help?
mine dont have the .exe and i followed all the steps?
thanks buddy
I've been trying each and everything since yesterday,thanks a lot🥲🥲🥲
Love from India❤❤
I will keep watching kindly complete the authentication lab
Awesome video
Well we should
Nobody subscribes to hackers
Thank u boss
😃👍
👍😃
Thank u so much brooo 😊✌💞 I fixed the issue ❤
thanks!!!
Hmm. We’re having trouble finding that site. (burp , burpsuite) notworking
Thank you brother ❤
Your tutorials on these aws scenarios are amaziiinggg!! great job and thank you.😊😊
Bro it’s not solved
Is it possible to automate this process?
Sure, but this is a one time thing, once you set it up you're good to go.
man thank you very much!
Is there away to solve this lab out with the community edition? Thank you
Not sure if Community Edition supports Burp Collaborator, but there are other tools or websites you can use that can do the same thing Collaborator does.
Can't find the site same problem
If you cannot reach that site, it might mean that you do not have your "Proxy" turned on. You need to turn on your Proxy between Firefox and Burp, and then follow the steps shown
This works on Kali Linux too!!!! Although I will say I had to go with mousepoll=4
Mine did not have .exe after it, and came up as file not found?
You might have installed wrong OS's file
website wont open even after installing it
Email me, I'll try to help
@@LittleMoreHelp help me it does not open burpsuite
explained very clearly thank you
Thank You So Much <3
thanks
You are the Man! Many thanks homie 🙏🙏🙏
Thanks for this video ♥️😊
Life Saver for a noob like me
Thank you very much Your explanation was so easy to understand
i cant go to burpsuite it says forbidden
thx
Man thanks a lot, you are the best to have ever explained this issue and my problem has been solved. I hope others find help here too. Thank you. Now I can go ace my cmit495
what terminal are you using?
thaks
Tanks
Amazing - love your style of video - keep going man!
do we manually add peter as default password on the password list?
Not only that, you also have to follow the format shown in the video. Please re-watch and make sure you do is exactly as I've done it in the video.
Thanks it worked for me
love you bro. ispent nearly 6 hours for this
│ Error: file provisioner error after 2:39 help
Try running: ` $ ./cloudgoat.py config profile $ ./cloudgoat.py config whitelist --auto ` Or update your whitelist.txt
@@LittleMoreHelp u didnt turn off public access option
@@eyesoffloraandfauna8728 Thank you for letting me know, but I deleted all the resources related to each challenge after I am done with them