🐝 Hive Five 102 – Running a Mastodon server, Reverse Prompt Engineering, and 2022 reviews

Hive Five

By securibee 🐝

Hi friends,

Greetings from the hive!

Happy New Year! I hope you and yours are in good health and achieved all that you set out to.

The start of the year often means reviewing what you have accomplished in the previous one. This prompted me to check out my newsletter stats (which I should do more often). The Hive Five in 2022 had a 77% open rate, an 83% click rate, and contained 390582 words.

I have also looked at different methods and implementations of how people review their year. This format by Mike stood out to me, and I thought I’d share. He listed “six areas of life balance” from his goals page and rated each. So I might give it a try.

Did you have any yearly goals? If so, how did you do on them?

Let’s take this week by swarm!

🐝 The Bee’s Knees

1. Hachyderm’s Kris Nova on running a Mastodon Server. In Hanselminutes Podcast 872, Scott talks with Kris Nova who has been building and scaling Hachyderm, a Mastodon instance that began in her basement and is now moving into the cloud. more

2. Hunting for Amazon Cognito Security misconfigurations. This is a talk that was delivered as part of NahamCon EU 2022 virtual conference. The topic outlines and discusses a few common security misconfigurations that affect Amazon Cognito implementation along with various techniques and methods to test against these security issues. more | slides

3. Reverse Prompt Engineering for Fun and (no) Profit. For the non-technical folks, the term “prompt injection” was chosen to evoke SQL Injection, the third worst security vulnerability in traditional web applications. more

4. A list of interesting macOS/iOS Kernel Security research in 2022 by Alex. more

5. Pass-the-Challenge: Defeating Windows Defender Credential Guard. New techniques for recovering the NTLM hash from an encrypted credential protected by Windows Defender Credential Guard. more

️💪 Sponsor

Want me to write about your company? Sponsor the Hive Five.

🔥 Buzzworthy

✅ Changelog

1. j3ssie/osmedeus v4.3.0 includes AWS Provider Support, integration with an S3 bucket, new built-in scripts for importing and extracting workspace data. more

2. The 10th edition of OSINT Techniques is now available. The book is required reading for numerous college courses, university degrees, and government training academies. more

📅 Events

1. Justin Gardner and 0xteknogeek are launching a new podcast called Critical Thinking. You can expect coverage of new web hacking techniques, bug bounty tips, exclusive bug explanations, and sick interviews. more

2. ZwinK is planning to publish a Z-winK University series on Udemy. more

3. Omar Espino is starting a new journey at websec as a Senior Security Consultant. more

4. Architecture Notes announces their first CTF which is live now. This is a encryption challenge that is open to participants of all skill levels and I dare you to solve. This first challenge will test your knowledge around encryption and networking. more