Open in app

Sign In

Write

Sign In

Takahiro Oda
Takahiro Oda

404 Followers

Home

About

Mar 11, 2022

[OWASP Top 10]: API Security Basics ~Series 1~ Security principles

We will cover the important security principles for API security standards. Security principles 1: Simplicity We should reimagine how cloud security can improve security and provide value by making it easier to use. Managing numerous security products can result in more costs, greater complexity, and a greater requirement for specialized labor — all…

API

3 min read

[OWASP Top 10]: API Security Basics ~Series 1~ Security principles
[OWASP Top 10]: API Security Basics ~Series 1~ Security principles
API

3 min read


Mar 6, 2022

[Road to Cloud Security Engineer] Series 1 ~Understand Microservices~

In this series, you will learn how to become a Cloud Security Engineer. Series 1 is to understand Microservices. Image taken from: https://docs.microsoft.com/en-us/azure/architecture/microservices/ What is a microservice? The microservice architectural style approaches developing a single application as a suite of small services, each running in its process and communicating with lightweight mechanisms, often an HTTP resource API. These…

Microservices

3 min read

[Road to Cloud Security Engineer] Series 1 ~Understand Microservices~
[Road to Cloud Security Engineer] Series 1 ~Understand Microservices~
Microservices

3 min read


Jan 28, 2022

[OWASP Top 10]: API Security Basics ~Series 2~ Risks and Countermeasures

Overview — We will cover the OWASP top 10 API security basics 1:Broken Object Level Authorization (Insecure direct object reference) what is it? For example,

API

5 min read

[OWASP Top 10]: API Security Basics ~Series 2~ Risks and Countermeasures
[OWASP Top 10]: API Security Basics ~Series 2~ Risks and Countermeasures
API

5 min read


Jan 18, 2022

[Application security] How to conduct server-side request forgery (SSRF)

What we will do in this article 1: set up an initial environment using Docker 2: conduct server-side request forgery (SSRF) What is server-side request forgery (SSRF)? A10 Server Side Request Forgery (SSRF) - OWASP Top 10:2021 This category is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above…owasp.org SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when…

Ssrf

10 min read

[Offensive security] How toconduct server-side request forgery (SSRF)
[Offensive security] How toconduct server-side request forgery (SSRF)
Ssrf

10 min read


Jan 17, 2022

[Offensive security] Let’s steal the confidential files from the misconfigured S3 bucket.

What we will do in this article 1: setup an initial environment using Docker 2: steal the confidential files from the misconfigured S3 bucket. overview Starting as an anonymous outsider with no access or privileges, exploit a misconfigured reverse-proxy server to query the EC2 metadata service and acquire instance profile keys. Then, use those keys to discover, access…

AWS

3 min read

[Offensive security] Let’s steal the confidential files from the misconfigured S3 bucket.
[Offensive security] Let’s steal the confidential files from the misconfigured S3 bucket.
AWS

3 min read


Jan 17, 2022

[Malware Analysis Bootcamp] Let’s start your first malware analysis!!

What Is Malware Analysis? Malware analysis is the process of analyzing a malware sample/binary and extracting to understand the scope of the functionality of the Malware, how the system was infected with the malware and how to defend against similar attacks Objectives of malware analysis To understand the type of malware and the entire scope of what it…

Virustotal

12 min read

[Malware Analysis Bootcamp] Let’s start your first malware analysis!!
[Malware Analysis Bootcamp] Let’s start your first malware analysis!!
Virustotal

12 min read


Jan 16, 2022

[Offensive Security] Command and Control with Pupy!!

What is Pupy? Pupy is an open-source remote admin and post-exploitation tool written in python. Pupy executes in memory, allowing it to leave a low footprint. Pupy also offers multiple communications channel options to make traffic. MITRE ATT&CK initial access execution persistence privillege escalation defense evasion credential access discovery lateral movement collection command & control …

Pupy

3 min read

[Offensive Security] Command and Control with Pupy!!
[Offensive Security] Command and Control with Pupy!!
Pupy

3 min read


Jan 15, 2022

[Wireshark]Cyber security analysis and identify common cyber network attacks

overview — We will cover the basics of Wireshark first, then you’ll gain the ability to threat hunt at the packet level. capture traffic and examine the packet open Wireshark and choose Ethernet you can check capture options

Wireshark

8 min read

[Wireshark]Cyber security analysis and identify common cyber network attacks
[Wireshark]Cyber security analysis and identify common cyber network attacks
Wireshark

8 min read


Jan 13, 2022

[Vulnerability management]How to manage vulnerabilities using Nmap and OpenVAS

Overview you’ll focus on Asset Management. Asset Management ensures an organization’s assets are accounted for, maintained, and eventually disposed of. And what is an asset? Defined simply, an asset includes hardware, software, or the information an organization values. Over the next few challenges, you’ll focus on scalable ways to approach Asset…

Nmap

8 min read

[Vulnerability management]How to manage vulnerabilities using Nmap and OpenVAS
[Vulnerability management]How to manage vulnerabilities using Nmap and OpenVAS
Nmap

8 min read


Jan 11, 2022

[EventBridge]Create a Serverless EventBus Using Amazon EventBridge

overview you’ll practice creating and configuring a serverless EventBus using Amazon EventBridge. When you’re finished with this lab, you’ll have a good understanding of setting up rules to consume events from an EventBus and configuring targets. Amazon EventBridge fully managed, pay-as-you-go native integration with SaaS providers 90 AWS services as sources 17 AWS…

Eventbridge

5 min read

[EventBridge]Create a Serverless EventBus Using Amazon EventBridge
[EventBridge]Create a Serverless EventBus Using Amazon EventBridge
Eventbridge

5 min read

Takahiro Oda

Takahiro Oda

404 Followers

Cloud security engineer https://www.linkedin.com/in/takahiro-oda-881423197/

Help

Status

Writers

Blog

Careers

Privacy

Terms

About

Text to speech