Fw：薪酬转股权方案，有效降低企���的人力成本

【疫情当下】
因为新型病毒的发生，全国开工时间的延后，企业的现金流发现严重断裂，但是员工人力成本却不减反增怎么办？
国外疫情严峻，外贸企业员工难开发国外订单，该如何利用股权激励使员工为公司拼命干业绩，留住人心，创造价值？
让老板彻底解放，享受有钱有闲、富而仁贵的富足生活？

【学习股权两小时，受用一辈子】不满意全额退款，今晚股权微课堂开课， 分享以下知识点：
①股权什么时候分，分给哪些人，分多少？
②如何激励内部核心团队，提高员工积极性？员工要不要花钱购买股份？
③刘强东是如何通过股权设计，用不到20%的股权，却拥有将近80%的表决权的，马云又是如何用7.4%的股权牢牢掌控阿里巴巴？
④股份分出去后，如何把握公司控制权？
⑤跟人合伙怎么分配股权，不同类型的股东如何分配比例？
⑥我们操作股权激励有哪些致命雷区？
⑦公司如何估值，股份如何作价？
⑧股权分配不合理，如何调整？
⑨如何设计股权众筹方案？
⑩进入机制和退出机制，怎么设计？
①①如何做股权布局和顶层设计？
①②个性化问题在线1对1咨询答疑。

企业从来不是缺少人才，而是缺失吸纳和储备人才的机制，如何运机制激励的思维对内留住并层层培养，对外吸引并牢牢结合人才，打造企业发展所必需的人才梯队，真正发挥人的效力，今晚的股权微课堂就为你解答持续推动企业发展的方案！

学习时间: 晚上8：00-10：00
学习地址: 微信群
授课形式: 语音+文字+图片+案例【课后可与老师一对一咨询】
学习费用:【168元】（如学习不满意可全额退款）
报名即免费赠送价值1280元的16套资料 :
1、 《公司股权分配方案》
2、 《创始人合伙人股权架构设计》
3、 《股东合作及股权协议书》
4、 《股权架构方案设计》
5、 《增资扩股协议》
6、 《创业合伙协议》
7、 《股东投资入股协议书》
8、 《公司股东合作协议书》
9、 《股东进入和退出机制》
10  《创业公司股权架构设计书》
11  《股份代持的法律风险及规避》
12、《绩效考核方案》
13、《股权融资方案》
14、《商业模式计划书模板》
15、《公司内部员工入股协议》
16、《公司章程可自行约定事项》

学习价格168元，报名学习添加区老师Wechat：Alonge8  （学习不满意全额退款）
 课程详细了解链接：https://jinshuju.net/f/8QN4M3

点击此处退订

OWASP API Security Project Media Coverage

A list of must read articles on OWASP API Security Project: 

• 10/3/19, APISecurity.IO (UMV: 1,510): Issue 51: Gartner Releases Full Report on API Security
• 10/2/19, ADT Magazine (UMV: 117,500): API Security Project Identifies Top 10 Vulnerabilities
• 9/26/19, Dark Reading (UMV: 57,800): Why You Need to Think About API Security
• 9/24/19, The Daily Swig (UMV: 30,500): OWASP Reveals Top 10 Security Threats Facing API Ecosystem
• 9/20/19, Security Boulevard (UMV: 29,100): New OWASP List Highlights API Security Holes
• 9/13/19, Security Boulevard (UMV: 29,100): Why You Need to Be Thinking About API Security
• 9/13/19, CyberWire (UMV: 49,380): Daily Briefing: OWASP API Security Project
• 9/12/19, Dark Reading (UMV: 57,800): APIs Get Their Own Top 10 Security list
• Also included in Dark Reading's weekly newsletter on 9/19/19

More articles

1. Pentesting Tools
2. Hacking Jacket
3. Pentest Magazine
4. Pentest Online Course
5. Hacking The System
6. Hacking Box
7. Pentest Reporting Tool
8. Hacking Jacket
9. Hacking Tutorials
10. Hacking Games Online
11. Pentest Active Directory
12. Hacking Typer
13. Hacking Websites
14. Hacker Types
15. How To Pentest A Network
16. Hacking Games
17. Hacking Youtube
18. Hacking Attack
19. Hacking Images

Recovering Data From An Old Encrypted Time Machine Backup

Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.

The problem

1. I had an encrypted Time Machine backup which was not used for months
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI

The struggle

By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.

As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.

Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.

YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.

YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.

Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.

The solution

Finally, a blog post provided the real solution - hdiutil.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.

To mount any NAS via SMB:

mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>

To mount a Time Capsule share via AFP:

mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>

And finally this command should do the job:

hdiutil attach test.sparsebundle -readonly

It is nice that you can provide read-only parameter.

If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:

printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly

Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device

And now, you can find your backup disk under /Volumes. Happy restoring!

Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.Related links

1. Pentest Jobs
2. Pentest Wifi
3. Hacking Books
4. Pentest Report Generator
5. Pentest Gear
6. Hacking With Raspberry Pi
7. Pentest Box
8. Hacker Wifi Password
9. Pentest Vs Ceh
10. Pentest Certification
11. Pentest Devices
12. Pentest Questions
13. Pentest Certification

PKCE: What Can(Not) Be Protected

This post is about PKCE [RFC7636], a protection mechanism for OAuth and OpenIDConnect designed for public clients to detect the authorization code interception attack.

At the beginning of our research, we wrongly believed that PKCE protects mobile and native apps from the so called „App Impersonation" attacks. Considering our ideas and after a short discussion with the authors of the PKCE specification, we found out that PKCE does not address this issue.

In other words, the protection of PKCE can be bypassed on public clients (mobile and native apps) by using a maliciously acting app.

OAuth Code Flow

In Figure 1, we briefly introduce how the OAuth flow works on mobile apps and show show the reason why we do need PKCE.
In our example the user has two apps installed on the mobile phone: an Honest App and an Evil App. We assume that the Evil App is able to register the same handler as the Honest App and thus intercept messages sent to the Honest App. If you are more interested in this issue, you can find more information here [1].

Figure 1: An example of the "authorization code interception" attack on mobile devices. 

Step 1: A user starts the Honest App and initiates the authentication via OpenID Connect or the authorization via OAuth. Consequentially, the Honest App generates an Auth Request containing the OpenID Connect/OAuth parameters: client_id, state, redirect_uri, scope, authorization_grant, nonce, …. 

Step 2: The Browser is called and the Auth Request is sent to the Authorization Server (usually Facebook, Google, …).

• The Honest App could use a Web View browser. However, the current specification clearly advice to use the operating system's default browser and avoid the usage of Web Views [2]. In addition, Google does not allow the usage of Web View browser since August 2016 [3].

Step 3: We asume that the user is authenticated and he authorizes the access to the requested resources. As a result, the Auth Response containing the code is sent back to the browser.

Step 4: Now, the browser calls the Honest App registered handler. However, the Evil App is registered on this handler too and receives the code.

Step 5: The Evil App sends the stolen code to the Authorization Server and receives the corresponding access_token in step 6. Now, the Evil App can access the authorized ressources.

• Optionally, in step 5 the App can authenticate on the Authorization Server via client_id, client_secret. Since, Apps are public clients they do not have any protection mechanisms regarding the storage of this information. Thus, an attacker can easy get this information and add it to the Evil App.

Proof Key for Code Exchange - PKCE (RFC 7636)

Now, let's see how PKCE does prevent the attack. The basic idea of PKCE is to bind the Auth Request in Step 1 to the code redemption in Step 5. In other words, only the app generated the Auth Request is able to redeem the generated code.

Figure 2: PKCE - RFC 7636 

Step 1: The Auth Request is generated as previosly described. Additionally, two parameters are added:

• The Honest App generates a random string called code_verifier
• The Honest App computes the code_challenge=SHA-256(code_verifier)
• The Honest App specifies the challenge_method=SHA256

Step 2: The Authorization Server receives the Auth Request and binds the code to the received code_challenge and challenge_method.

• Later in Step 5, the Authorzation Server expects to receive the code_verifier. By comparing the SHA-256(code_verifier) value with the recieved code_challenge, the Authorization Server verifies that the sender of the Auth Request ist the same as the sender of the code.

Step 3-4: The code leaks again to the Evil App.

Step 5: Now, Evil App must send the code_verifier together with the code. Unfortunatelly, the App does not have it and is not able to compute it. Thus, it cannot redeem the code.

 PKCE Bypass via App Impersonation

Again, PKCE binds the Auth Request to the coderedemption.

The question rises, if an Evil App can build its own Auth Request with its own code_verifier, code_challenge and challenge_method.The short answer is – yes, it can.

Figure 3: Bypassing PKCE via the App Impersonation attack

Step 1: The Evil App generates an Auth Request. The Auth Request contains the client_id and redirect_uri of the Honest App. Thus, the User and the Authorization Server cannot recognize that the Evil App initiates this request. 

Step 2-4: These steps do not deviate from the previous description in Figure 2.

Step 5: In Step 5 the Evil App sends the code_verifier used for the computation of the code_challenge. Thus, the stolen code can be successfully redeemed and the Evil App receives the access_token and id_token.

OAuth 2.0 for Native Apps

The attack cannot be prevented by PKCE. However, the IETF working group is currently working on a Draft describing recommendations for using OAuth 2.0 for native apps.

References

[1] http://mews.sv.cmu.edu/papers/ccs-14.pdf

[2] https://tools.ietf.org/html/draft-ietf-oauth-native-apps-06#section-8.1

[3] https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html

Authors

Vladislav Mladenov
Christian Mainka (@CheariX)

More info

• Pentest Gear
• Hacking Growth
• Pentest Ubuntu
• Pentest Enumeration
• Pentest Example Report
• Pentesting Tools
• Pentest Cyber Security
• Pentest Firewall
• Hackerrank
• Hacker Keyboard
• Hacking Quotes
• Pentest Meaning
• Pentest Tools
• Pentest Os

Top 10 Most Popular Ethical Hacking Tools (2019 Ranking)

     Top 10 powerful Hacking  Tools in 2019.       

If hacking is performed to identify the potential threats to a computer or network then it will be an ethical hacking.

Ethical hacking is also called penetration testing, intrusion testing, and red teaming.

Hacking is the process of gaining access to a computer system with the intention of fraud, data stealing, and privacy invasion etc., by identifying its weaknesses.

Ethical Hackers:

A person who performs the hacking activities is called a hacker.

There are six types of hackers:

• The Ethical Hacker (White hat)
• Cracker
• Grey hat
• Script kiddies
• Hacktivist
• Phreaker

A security professional who uses his/her hacking skills for defensive purposes is called an ethical hacker. To strengthen the security, ethical hackers use their skills to find vulnerabilities, document them, and suggest the ways to rectify them.

Companies that provide online services or those which are connected to the internet, must perform penetration testing by ethical hackers. Penetration testing is another name of ethical hacking. It can be performed manually or through an automation tool.

Ethical hackers work as an information security expert. They try to break the security of a computer system, network, or applications. They identify the weak points and based on that, they give advice or suggestions to strengthen the security.

Programming languages that are used for hacking include PHP, SQL, Python, Ruby, Bash, Perl, C, C++, Java, VBScript, Visual Basic, C Sharp, JavaScript, and HTML.

Few Hacking Certifications include:

1. CEH
2. GIAC
3. OSCP
4. CREST

Let's Explore!!

#1) Nmap

Price: Free

Description:

Nmap is a security scanner, port scanner, as well as a network exploration tool. It is an open source software and is available for free.

It supports cross-platform. It can be used for network inventory, managing service upgrade schedules, and for monitoring host & service uptime. It can work for a single host as well as large networks. It provides binary packages for Linux, Windows, and Mac OS X.

Features: 

• Nmap suite has:
  • Data transfer, redirection, and debugging tool(Ncat),
  • Scan results comparing utility(Ndiff),
  • Packet generation and response analysis tool (Nping),
  • GUI and Results viewer (Nping)
• Using raw IP packets it can determine:
  • The available hosts on the network.
  • Their services offered by these available hosts.
  • Their OS.
  • Packet filters they are using.
  • And many other characteristics.

Best for: Nmap is best for scanning network. It is easy to use and fast as well.

Website: Nmap

******************

#2) Netsparker

Netsparker is a dead accurate ethical hacking tool, that mimics a hacker's moves to identify vulnerabilities such as SQL Injection and Cross-site Scripting in web applications and web APIs. 

 

Netsparker uniquely verifies the identified vulnerabilities proving they are real and not false positives, so you do not need to waste hours manually verifying the identified vulnerabilities once a scan is finished.

 

It is available as a Windows software and an online service.

=> Visit Netsparker Website Here

******************

#3) Acunetix 

Acunetix is a fully automated ethical hacking tool that detects and reports on over 4500 web application vulnerabilities including all variants of SQL Injection and XSS.

The Acunetix crawler fully supports HTML5 and JavaScript and Single-page applications, allowing auditing of complex, authenticated applications.

It bakes in advanced Vulnerability Management features right-into its core, prioritizing risks based on data through a single, consolidated view, and integrating the scanner's results into other tools and platforms.

=> Visit Acunetix Official Website

******************

#4) Metasploit

Price: Metasploit Framework is an open source tool and it can be downloaded for free. Metasploit Pro is a commercial product. Its free trial is available for 14 days. Contact the company to know more about its pricing details.

Description:

It is the software for penetration testing. Using Metasploit Framework, you can develop and execute exploit code against a remote machine. It supports cross-platform.

Features: 

• It is useful for knowing about security vulnerabilities.
• Helps in penetration testing.
• Helps in IDS signature development.
• You can create security testing tools.

Best For Building anti-forensic and evasion tools.

Website: Metasploit

#5) Aircrack-Ng

Price: Free

Description:

Aircrack-ng provides different tools for evaluating Wi-Fi network security.

All are command line tools. For Wi-Fi security, it focuses on monitoring, attacking, testing, and cracking. It supports Linux, Windows, OS X, Free BSD, NetBSD, OpenBSD, Solaris, and eComStation 2.

Features:

• Aircrack-ng can focus on Replay attacks, de-authentication, fake access points, and others.
• It supports exporting data to text files.
• It can check Wi-Fi cards and driver capabilities.
• It can crack WEP keys and for that, it makes use of FMS attack, PTW attack, and dictionary attacks.
• It can crack WPA2-PSK and for that, it makes use of dictionary attacks.

Best For: Supports any wireless network interface controller.

Website: Aircrack-Ng

#6) Wireshark

Price: Free

Description:

Wireshark is a packet analyzer and can perform deep inspection of many protocols.

It supports cross-platform. It allows you to export the output to different file formats like XML, PostScript, CSV, and Plaintext. It provides the facility to apply coloring rules to packet list so that analysis will be easier and quicker. The above image will show the capturing of packets.

Features:

• It can decompress the gzip files on the fly.
• It can decrypt many protocols like IPsec, ISAKMP, and SSL/TLS etc.
• It can perform live capture and offline analysis.
• It allows you to browse the captured network data using GUI or TTY-mode TShark utility.

Best For: Analyzing data packets.

Website: Wireshark

#7) Ettercap

Price: Free.

Description:

Ettercap supports cross-platform. Using Ettercap's API, you can create custom plugins. Even with the proxy connection, it can do sniffing of HTTP SSL secured data.

Features:

• Sniffing of live connections.
• Content filtering.
• Active and passive dissection of many protocols.
• Network and host analysis.

Best For: It allows you to create custom plugins.

Website: Ettercap

#8) Maltego

Price: The Community version, Maltego CE is available for free. Price for Maltego Classic is $999. Price for Maltego XL is $1999. These two products are for the desktop. Price for the server products like CTAS, ITDS, and Comms starts at $40000, which includes training as well.

Description:

Maltego is a tool for link analysis and data mining. It supports Windows, Linux, and Mac OS.

For the discovery of data from open sources and visualizing the information in graphical format, it provides the library of transforms. It performs real-time data-mining and information gathering.

Features:

• Represents the data on node-based graph patterns.
• Maltego XL can work with large graphs.
• It will provide you the graphical picture, thereby telling you about the weak points and abnormalities of the network.

Best For: It can work with very large graphs.

Website: Maltego

#9) Nikto

Price: Free

Description:

Nikto is an open source tool for scanning the web server.

It scans the web server for dangerous files, outdated versions, and particular version related problems. It saves the report in a text file, XML, HTML, NBE, and CSV file formats. Nikto can be used on the system which supports basic Perl installation. It can be used on Windows, Mac, Linux, and UNIX systems.

Features:

• It can check web servers for over 6700 potentially dangerous files.
• It has full HTTP proxy support.
• Using Headers, favicons, and files, it can identify the installed software.
• It can scan the server for outdated server components.

Best For: As a Penetration Testing tool.

Website: Nikto

#10) Burp Suite

Price: It has three pricing plans. Community edition can be downloaded for free. Pricing for Enterprise edition starts at $3999 per year. Price of the Professional edition starts at $399 per user per year.

Description:

Burp Suite has a web vulnerability scanner and has advanced and essential manual tools.

It provides many features for web application security. It has three editions, community, enterprise, and professional. With community editions, it provides essential manual tools. With the paid versions it provides more features like Web vulnerabilities scanner.

Features:

• It allows you to schedule and repeats the scan.
• It scans for 100 generic vulnerabilities.
• It uses out-of-band techniques (OAST).
• It provides detailed custom advisory for the reported vulnerabilities.
• It provides CI Integration.

Best For: Security testing.

Website: Burp Suite

#11) John The Ripper

Price: Free

Description:

John the Ripper is a tool for password cracking. It can be used on Windows, DOS, and Open VMS. It is an open source tool. It is created for detecting weak UNIX passwords.

Features:

• John the Ripper can be used to test various encrypted passwords.
• It performs dictionary attacks.
• It provides various password crackers in one package.
• It provides a customizable cracker.

Best For: It is fast in password cracking.

Website:  John the Ripper

#12) Angry IP Scanner

Price: Free

Description:

Angry IP Scanner is a tool for scanning the IP addresses and ports. It can scan both on local network and Internet. It supports Windows, Mac, and Linux operating systems.

Features:

• It can export the result in many formats.
• It is a command-line interface tool.
• It is extensible with many data fetchers.

Website:  Angry IP Scanner

Conclusion

As explained here, Nmap is used for computer security and network management. It is good for scanning the network. Metasploit is also for security and is good for building anti-forensic and evasion tools.

Aircrack-Ng is a free packet sniffer & injector and supports cross-platform. Wireshark is a packet analyzer and is good in analyzing data packets. As per the reviews available online, people recommend using Nmap instead of Angry IP scanner as Angry IP Scanner comes with unwanted applications.

John the Ripper is fast in password cracking. Nikto is a good open source tool for penetration testing. Maltego presents the data in a graphical form and will give you information about weak points and abnormalities.

This was all about the ethical hacking and the top ethical hacking tools. Hope you will find this article to be much useful!!

@EVERYTHING NT

More information

• Pentest Wiki
• Pentest Framework
• Pentest +
• Hacking Google
• Hacker Attack
• Hacking Wifi
• How To Pentest A Website
• Pentest With Kali
• Hacker Wifi Password
• Hacking Page
• Pentestmonkey Sql Injection
• Pentest Distro
• Pentest Tools Framework
• Basic Pentest 1 Walkthrough
• Pentest Vs Red Team
• Pentest
• Hacking With Python
• Hacking Tutorials
• Pentest Methodology