opsdisk

https://scan17.com/

Automated network port change detection. Scan17 provides a solution to the question:

So your CTO decides to outsource firewall management - and the vendor carelessly leaves a network port open, exposing your production database. How does your team find out before an attacker?

Think of it as nmap port scan diff-ing. If a network port goes from closed to open you get an email or webhook alert. There is a REST API for automated workflows and privately hosted engines will be supported for some plans. There is a wait-list form on the website if you want to stay in the loop.

If you work in infosec / cyber security and are interested in being an early product designer / beta tester, let's chat! See my profile for how to get in touch.

Appreciate the mention wbadart!

Actual title is "One Product, Many Pieces", but I changed it to appeal to the technical and engineering audience here.

Would love a blog post on how you're using Docker Swarm.

If anyone is curious on how this can be abused, here's my "There's no place like 169.254.169.254 - (Ab)using cloud metadata URLs" slides [1] and talk [2] from 2019.

tl;dr - misconfigured reverse proxies allowed cloud metadata URL access across the bigger cloud providers.

[1] https://github.com/opsdisk/cloud_metadata_extractor/blob/mas...

[2] https://www.youtube.com/watch?v=vxReTpBCmh8

This is the biggest infosec-focused collection I've seen https://github.com/0x90n/InfoSec-Black-Friday.

My shameful promotion to level up your SSH tunneling and port redirection game:

* $10 for the interactive lab - The Cyber Plumber's Lab Guide and Access https://opsdisk.gumroad.com/l/cphlab/blackfriday2021

* The accompanying book is free: https://github.com/opsdisk/the_cyber_plumbers_handbook

If you're looking at going even deeper into SSH tunneling and port redirection, I recently made The Cyber Plumber's Handbook free: https://github.com/opsdisk/the_cyber_plumbers_handbook

I made it free to the HN community a few years back [1]. There is a paid interactive lab portion (details in the repo) if you are looking for hands-on experience.

Book Overview

This book is packed with practical and real world examples of SSH tunneling and port redirection in multiple realistic scenarios. It walks you through the basics of SSH tunneling (both local and remote port forwards), SOCKS proxies, port redirection, and how to utilize them with other tools like proxychains, nmap, Metasploit, and web browsers.

Advanced topics included SSHing through 4 jump boxes, throwing exploits through SSH tunnels, scanning assets using proxychains and Metasploit's Meterpreter, browsing the Internet through a SOCKS proxy, utilizing proxychains and nmap to scan targets, and leveraging Metasploit's Meterpreter portfwd command.

[1] https://news.ycombinator.com/item?id=19946941

I made this free to the HN community a few years back [1], but decided to make it available to everyone via a GitHub repo. There is a paid interactive lab portion (details in the repo) if you are looking for hands-on experience.

Book Overview

This book is packed with practical and real world examples of SSH tunneling and port redirection in multiple realistic scenarios. It walks you through the basics of SSH tunneling (both local and remote port forwards), SOCKS proxies, port redirection, and how to utilize them with other tools like proxychains, nmap, Metasploit, and web browsers.

Advanced topics included SSHing through 4 jump boxes, throwing exploits through SSH tunnels, scanning assets using proxychains and Metasploit's Meterpreter, browsing the Internet through a SOCKS proxy, utilizing proxychains and nmap to scan targets, and leveraging Metasploit's Meterpreter portfwd command.

[1] https://news.ycombinator.com/item?id=19946941

Nice...looking forward to seeing this evolve!

Glad to see more open source options (I develop and maintain Scantron https://github.com/rackerlabs/scantron/) when it comes to network scanning! Appreciate your contribution to the community.

So you're not using nmap under the hood?

What's the largest IP space you've tested it on so far?

Appreciate the support pixelface...hope it helps!

Let me know if it's still giving you trouble...contact info is in my profile.

Appreciate the shout out magicconch! Just added a HN family discount to pick up the book, lab guide, and lab access for $10.

https://gum.co/cph_book_and_lab/hackernews20210207

Just out of curiosity, what "industry-leading scanning engine" are you using to power your vulnerability scans?

Edit: Never mind, looks like it's Nessus (https://help.intruder.io/en/articles/3167760-internal-vulner...)

This is great! Thanks for putting this together.

Sounds interesting, can you expand more on what you're trying to do with it? Are you trying to connect patients with Registered Dietitians?

I'm a huge fan of Gumroad and their API. I wrote a minimal Python API client if anyone is interested...

https://github.com/opsdisk/pygumroad

Any recommendations for a type of black paint? I'll probably check it once a year, but I'm not too worried since the environment is pretty stable.

I hadn't even noticed the ridge on top could be used to hold stuff. I'll have to leverage that more!

Did you purchase it individually? Do you recall what you paid for it? In the blog, I linked to a YouTube video that said they retailed for $300-400. I believe it, but would like to hear confirmation.

I didn't search too long, but did not find using "dental tabs" to clean the key caps! Glad it worked out though, enjoyed reading your cherry restore.

Someone pointed out that this site to me that sells replacement parts. I was looking at getting new flipper springs for the keys that don't always register.

https://www.modelfkeyboards.com/product/flipperspring/

I had a link to that same video in the post. It was great getting more of the background about them. Good luck with the restore!

That is funny imagining the sheer noise! Luckily it's just me in the room with the keyboard.

Great to hear you like yours! The different Ctrl key location and no super/windows key have been the most noticeable for me so far.

Coincidentally, there was a HN post about it today: https://news.ycombinator.com/item?id=25025035

I just dropped a blog post covering how I restored one of the original Model F keyboards: https://news.ycombinator.com/item?id=25029571

Article was perfect timing for me. The company I work at started one of these and I'm in the middle of trying to grow an idea/product. Great food for thought for long term strategy / positioning if it does go anywhere.

A very beta Python API client to interact with Gumroad's API for sweet automation workflows. Not all of the endpoints and HTTP verbs supported by the Gumroad API have been added yet.

Good stuff, thanks for the link!