Snow❄️

♂️❄️ Studying

[Valentin Ignatev @valigo]

🚨 BREAKING 🚨
Infamous Russian hacker and beatboxer exposes exactly how hackers got access to private GitHub repositories

[El Programador Senior @5eniorDeveloper]

Trabajé en una startup donde dejaban que el ORM gestionara la base de datos.

Si un dev necesitaba una columna, la agregaba al modelo y dejaba que la 'magia' ocurriera.

Cada dev hacía lo que quería; cuando supe esto, generé el diagrama de la base de datos y era algo como esto:

[Hacking Articles @hackinarticles]

Red Teaming Mindmap: Complete Offensive Security Roadmap 🧠🔥

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

The Red Teaming Mindmap is a structured visual guide that maps the entire offensive security lifecycle—from initial access to full domain compromise.

⚡ Key Features of Red Team Mindmap
🔍 Structured attack methodology breakdown
🧩 Covers tools, techniques & tradecraft
⚙️ Maps real-world adversary simulation flow
🛡️ Helps understand enterprise attack paths
📡 Useful for learning & operational planning

🎯 Core Red Team Domains
💥 Initial Access (Phishing, Exploits, Misconfigurations)
🧪 Credential Access (Kerberoasting, dumping, reuse)
🧬 Privilege Escalation (AD abuse, token impersonation)
🌐 Lateral Movement (SMB, WinRM, Impacket tools)
⚡ Persistence & Domain Dominance

📖 Resource: https://t.co/5UcmCcKCtN

#RedTeam #CyberSecurity #EthicalHacking #Pentesting #ActiveDirectory #InfoSec #MITREATTACK

[Snow❄️ @SnowIsWorking12]

https://t.co/2kSJDGzgnx

[Damilola Ashiedu | Pretty Cyber Girl 💻💡 @prettycyb3rgirl]

📂 Cybersecurity Stack

┃
┣ 📂 Foundations
┃ ┣ 📂 Networking (TCP/IP, DNS, HTTP/S)
┃ ┣ 📂 Linux & Windows Internals
┃ ┣ 📂 OSI Model
┃ ┣ 📂 Cryptography Basics
┃ ┗ 📂 Security Principles (CIA Triad)
┃
┣ 📂 Security Operations (SOC)
┃ ┣ 📂 SIEM (Splunk, ELK)
┃ ┣ 📂 EDR/XDR
┃ ┣ 📂 Log Analysis
┃ ┣ 📂 Alert Triage
┃ ┗ 📂 Incident Response
┃
┣ 📂 Threat Intelligence
┃ ┣ 📂 OSINT
┃ ┣ 📂 Threat Feeds
┃ ┣ 📂 MITRE ATT&CK
┃ ┣ 📂 Cyber Kill Chain
┃ ┗ 📂 Threat Hunting
┃
┣ 📂 Vulnerability Management
┃ ┣ 📂 Vulnerability Scanning
┃ ┣ 📂 Risk Assessment
┃ ┣ 📂 CVE Analysis
┃ ┣ 📂 Patch Management
┃ ┗ 📂 Reporting
┃
┣ 📂 Web & API Security
┃ ┣ 📂 OWASP Top 10
┃ ┣ 📂 OWASP API Top 10
┃ ┣ 📂 Authentication & Authorization
┃ ┣ 📂 Session Management
┃ ┗ 📂 Input Validation
┃
┣ 📂 Penetration Testing
┃ ┣ 📂 Reconnaissance
┃ ┣ 📂 Scanning
┃ ┣ 📂 Exploitation
┃ ┣ 📂 Post-Exploitation
┃ ┗ 📂 Reporting
┃
┣ 📂 Cloud Security
┃ ┣ 📂 AWS / Azure / GCP
┃ ┣ 📂 IAM
┃ ┣ 📂 Cloud Misconfigurations
┃ ┣ 📂 Logging & Monitoring
┃ ┗ 📂 Container Security
┃
┣ 📂 DevSecOps
┃ ┣ 📂 CI/CD Security
┃ ┣ 📂 SAST
┃ ┣ 📂 DAST
┃ ┣ 📂 SCA
┃ ┗ 📂 Secrets Management
┃
┣ 📂 Digital Forensics
┃ ┣ 📂 Disk Analysis
┃ ┣ 📂 Memory Forensics
┃ ┣ 📂 Log Investigation
┃ ┣ 📂 Evidence Handling
┃ ┗ 📂 Reporting
┃
┣ 📂 Governance, Risk & Compliance (GRC)
┃ ┣ 📂 ISO 27001
┃ ┣ 📂 PCI-DSS
┃ ┣ 📂 Risk Management
┃ ┣ 📂 Policies & Standards
┃ ┗ 📂 Auditing
┃
┣ 📂 Security Tools
┃ ┣ 📂 Burp Suite
┃ ┣ 📂 Nmap
┃ ┣ 📂 Wireshark
┃ ┣ 📂 Metasploit
┃ ┗ 📂 OWASP ZAP
┃
┗ 📂 AI Security
┣ 📂 Prompt Injection
┣ 📂 Model Security
┣ 📂 Data Leakage
┣ 📂 LLM Threats
┗ 📂 AI Risk Assessment

What do you think is missing? 🔁 & ❤️

[OccupytheWeb @three_cube]

The Best Cybersecurity Starter Bundle!

Get the All New Cybersecurity Bundle II for
just $149 during our 9th Birthday Celebration!

https://t.co/XZjrhZhm82

[Laprovittera Carlos @laprovittera]

Nueva web, nueva academia, nuevas rutas.....

[Laprovittera Carlos @laprovittera]

Se viene pronto nuevo curso con certificación....

[Snow❄️ @SnowIsWorking12]

@laprovittera Veamos. como comienzo con tu material.

[Snow❄️ @SnowIsWorking12]

@laprovittera Tras llevar un tiempo en esto del hacking, la mayria de cursos son de hacking etico. ¿Pero por qué tambien me meto a otros lados a aprender hacking no etico? Porque eso tambien me ayuda a entender profundamente como funciona el que ataca y no solo saber cuidar.

[Snow❄️ @SnowIsWorking12]

@laprovittera Tendré que complementar con otros materiales lo que la Unino enseña. Tanto la Uni y lo que complemente ayudará a que me de ventaja y complementarme mejor ya sea laboral o en conocimiento.

[Snow❄️ @SnowIsWorking12]

@laprovittera Comenzarón las clases. 4 a 6 horas de estudio de ciberseguridad todos los días y los fines de semana 3 o 4 horas. 2 horas de progrmación durante la semana.

Cada una hora, 15 minutos de repaso todo los días o si quiero en tiempos desocupado tambien.

[Ivan Castañeda @ivancastl]

Atacando un bot malicioso

Se detectó un sitio web que simula ofrecer descargas de Microsoft Excel, pero en realidad distribuye malware. Además, cuenta con un bot conectado a Telegram mediante JavaScript para extraer información del usuario a través de ipInfo, incluyendo la dirección IP, región, ISP, país, ubicación, agente de usuario y zona horaria.
Vamos a ver que podemos hacer:
Hilo👇

[OccupytheWeb @three_cube]

New to Cybersecurity?

This is the place to start!

[🇷🇴 cristi @CristiVlad25]

Deep Research paints me a clear perspective on app security.

From a security perspective, every component and communication channel is part of the attack surface. For example:

The browser interface (HTML/JS) can be manipulated by the user, so never trust client-side enforcement of rules. A malicious user can craft requests outside the normal UI flow.

HTTP requests include headers, cookies, query params, body data – all of which can be tampered with. Attackers will try unexpected values, very large inputs, or meta-characters to find weakness (hence, robust input validation is vital).

The server integrates with databases, file systems, email servers, and external APIs – each integration point can introduce vulnerabilities if not carefully handled (SQL injection when talking to DB, path traversal when handling file paths, SSRF when fetching URLs, etc.).

In modern apps, an API layer often exposes business logic directly. For instance, a banking SPA might call /api/transfer – if that endpoint isn’t secure, it doesn’t matter how pretty or secure the front-end is.

Understanding data flow is crucial: consider how data enters (HTTP request), how it’s processed (e.g., converted to SQL query, or passed to an internal API), and where it goes (database, external call, etc.). Each step needs appropriate controls (validation, encoding, authentication, etc.).

The concept of trust boundaries helps here – e.g., the boundary between client and server is a zero-trust boundary (never trust client data). In microservices, the boundary between services might be semi-trusted, but still validated, especially if one compromised service could be used to attack another.

[Snow❄️ @SnowIsWorking12]

@laprovittera El compa estuvo de cumle el 17 de febrero?
Feliz cumples atrasado, compa.

[Ben Sadeghipour @NahamSec]

Give Me 13 Minutes and 2025 Will Be Your Best Bug Bounty Year

🎥👉🏼https://t.co/syd0tLcwJs

[Hacking Articles @hackinarticles]

Pic of the Day

#infosec #cybersecurity #cybersecuritytips #pentesting #cybersecurityawareness #informationsecurity