In this series, you will learn how to become a Cloud Security Engineer. Series 1 is to understand Microservices. Image taken from: https://docs.microsoft.com/en-us/azure/architecture/microservices/ What is a microservice? The microservice architectural style approaches developing a single application as a suite of small services, each running in its process and communicating with lightweight mechanisms, often an HTTP resource API. These…

Overview — We will cover the OWASP top 10 API security basics 1:Broken Object Level Authorization (Insecure direct object reference) what is it? For example,

What we will do in this article 1: set up an initial environment using Docker 2: conduct server-side request forgery (SSRF) What is server-side request forgery (SSRF)? A10 Server Side Request Forgery (SSRF) - OWASP Top 10:2021 This category is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above…owasp.org SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. …

What we will do in this article 1: setup an initial environment using Docker 2: steal the confidential files from the misconfigured S3 bucket. overview Starting as an anonymous outsider with no access or privileges, exploit a misconfigured reverse-proxy server to query the EC2 metadata service and acquire instance profile keys. …

What Is Malware Analysis? Malware analysis is the process of analyzing a malware sample/binary and extracting to understand the scope of the functionality of the Malware, how the system was infected with the malware and how to defend against similar attacks Objectives of malware analysis To understand the type of malware and the entire scope of what it…

What is Pupy? Pupy is an open-source remote admin and post-exploitation tool written in python. Pupy executes in memory, allowing it to leave a low footprint. Pupy also offers multiple communications channel options to make traffic. MITRE ATT&CK initial access execution persistence privillege escalation defense evasion credential access discovery lateral movement collection command & control …

overview — We will cover the basics of Wireshark first, then you’ll gain the ability to threat hunt at the packet level. capture traffic and examine the packet open Wireshark and choose Ethernet you can check capture options

Overview you’ll focus on Asset Management. Asset Management ensures an organization’s assets are accounted for, maintained, and eventually disposed of. And what is an asset? Defined simply, an asset includes hardware, software, or the information an organization values. Over the next few challenges, you’ll focus on scalable ways to approach Asset…

overview you’ll practice creating and configuring a serverless EventBus using Amazon EventBridge. When you’re finished with this lab, you’ll have a good understanding of setting up rules to consume events from an EventBus and configuring targets. Amazon EventBridge fully managed, pay-as-you-go native integration with SaaS providers 90 AWS services as sources 17 AWS…