Posts | Ukant Jadia

403 vs 404: Why GitHub Hides Private Repos

Tue, 27 Oct 2026 04:47:00 +0530

One letter.

Cacti, an open-source network monitoring tool, answered a failed login with “Login failed” when the username existed and “Login Failed” when it didn’t. That capital F told anyone guessing which accounts were real. It became a public vulnerability, CVE-2026-49442, on October 23, 2026.

GitHub closed this hole long ago. I just didn’t notice.

I have private repos on GitHub. Log out, open one, and GitHub says it doesn’t exist. For years I read that as a glitch. A few months ago I finally asked why, and the answer was simple: it isn’t broken. It’s lying to me on purpose.

403 vs 404: what each answer tells the caller

There are two ways for a server to say no.

403 Forbidden means “it’s here, but not for you.” 404 Not Found means “there’s nothing here.”

A 403 is a locked door, and a locked door proves there’s a room. A 404 is a wall.

	403 Forbidden	404 Not Found
What the caller learns	It exists, but you can’t have it	Nothing is here
Confirms the thing exists?	Yes	No
Use it when	The caller can fix it, for example by logging in	Even knowing it exists is a secret

Why GitHub returns 404 for private repos

GitHub chose the wall, and it says why in one sentence on a troubleshooting page almost nobody reads. It answers 404 “instead of a 403 Forbidden response to avoid confirming the existence of private repositories.”

This isn’t a hack. The HTTP standard allows it. RFC 9110 says a server that wants to “hide” a forbidden resource “MAY instead respond with a status code of 404.”

And there’s a lot behind that wall. In GitHub’s Octoverse 2025 report, 81.5% of all contributions happened in private repos. Most of GitHub is wall.

Try it: open a private repo while logged out

Here’s how solid the wall is. Logged out, I asked GitHub for one of my private repos and for a name nobody owns. Both came back exactly the same, byte for byte: 404 Not Found, 132 bytes long.

The website does the same. Both pages show an identical “Page not found”. From the outside, my private repo and a typo are the same thing.

Should you return 403 or 404?

Not always 404. The wall has a cost, and the owner pays it too.

Logged out, I get the same “doesn’t exist” for my own repo. So does a teammate who forgot to sign in. GitHub’s own troubleshooting page has to remind people that if they know it exists, “you should check your authentication.”

So choose on purpose. Return 403 when the caller can fix the problem, usually by logging in, and telling them helps. Return 404 when even knowing the thing exists is the secret: a private repo, someone else’s invoice, an email that may or may not have an account.

That last one has a name: enumeration. Guess names, watch the answers, keep the ones that come back different. Make 1,000 guesses against a server that says 403, and you walk away with a list of every name that’s real. Make them against GitHub, and you walk away with 1,000 identical answers. It’s the attack the wall stops.

What a 404 alone does not hide

The status code is one part of the answer. Everything around it has to match too.

The body. Cacti’s leak wasn’t a status code at all. It was this:

- Login failed <- the user exists
+ Login Failed <- the user does not exist

Other pages. One page can follow the rule while another forgets it. Every page that touches the private thing has to give the same answer.

The clock. If “private” takes longer to answer than “missing”, a stopwatch gives the secret away, whatever the status code says.

How we use it: GitHub’s wall, around our posters

Our posters go to business owners, so two things on our side are private: the artwork, and the list of who it’s for. We built a private link that knows the difference. It hands over the artwork. It never hands over the list. And everything it refuses gets the same 404.

It’s the same wall GitHub puts in front of a private repo, rebuilt around our posters.

Four requests reach the private link. Only the artwork gets through. The recipient list, a wrong link and anything else all hit the same 404.

How to return 404 instead of 403

OWASP, the Open Worldwide Application Security Project, gives the same advice: “map both cases to the same public response, such as a 404.” In plain words, your app needs one rule:

When someone asks for a file:
 it doesn't exist -> "404 Not Found"
 it isn't theirs -> "404 Not Found" (the same answer)
 it's theirs -> here it is

Every web framework can do this in a few lines. The trick is to look up only what belongs to the person asking, so “not yours” and “doesn’t exist” become the same answer automatically.

Then check it. Sign in as a normal user, ask for something that belongs to someone else, then ask for something that doesn’t exist. If the two answers match word for word, nothing leaks. When I tested a deliberately broken version, both answers were 22 bytes long, but one said “Forbidden” and the other “Not Found”. Same size, different meaning. Compare the words, not the size.

If you do one thing after reading this, run that check on your own app.

Where else this applies

Anywhere a “no” could confirm that something exists:

Password reset. Say “If that email has an account, we’ve sent a link,” whether it has one or not.
Invite and share links. A wrong or expired link should look exactly like one that never existed.
Admin pages. An /admin that answers 403 tells a scanner where to dig.

The wall can point at bots too. Answer 404 to a crawler and, as far as it knows, your site isn’t there.

It only stops the polite ones. Polite bots say who they are, and they already obey robots.txt, the file where a site lists what bots may read. The scrapers you want gone pretend to be an ordinary browser. And point the wall at Googlebot by mistake and you drop out of Google. Turning bots away from your own site is your call. Aim carefully.

The question I should have asked years ago

The answer was in GitHub’s docs the whole time. I only found it the day I asked the exact question: why 404, and not 403?

AI works the same way. It hands you the basics until you ask for the specific thing. Learning to ask is the skill.

An error message is information. Give strangers none.

Sources

GitHub Docs, Troubleshooting the REST API: 404 Not Found for an existing resource
IETF, RFC 9110 HTTP Semantics, section 15.5.4 (403 Forbidden)
GitHub Blog, Octoverse 2025
NVD, CVE-2026-49442 (Cacti)
OWASP, Insecure Direct Object Reference Prevention Cheat Sheet

Steal Like an Engineer #1. Stolen from: GitHub. More from me: linkedin.com/in/ukantjadia.

SAS Fraud Management Platform

Thu, 29 Aug 2024 14:19:38 +0530

SAS Fraud Management Platform - All in one solution for Fraud Detection

The issue of fraud has always presented challenges, but in today’s digital age, it has grown more complex and sophisticated. Fraudsters are continuously devising new methods to exploit systems and pilfer valuable resources, especially in sectors such as banking, retail, subscription fraud, and credit card fraud. However, technology is pushing back with great force. I recently watched a talk presentation by Varun Mehta, a renowned fraud prevention expert from SAS Middle East, where he shed light on how advanced analytics, artificial intelligence (AI), and machine learning (ML) are revolutionizing the battle against fraud.

In this post, I will guide you through the main ideas of Varun’s speech, explaining how SAS’s creative tools are aiding companies worldwide in identifying and stopping fraud with greater efficiency. If you work in finance, healthcare, or any sector susceptible to fraudulent behavior, the information from this talk could be extremely beneficial in fortifying your security measures.

Introduction to SAS and Their Role in Fraud Detection

SAS is not just like any other software company. They have been leading the way in business analytics for more than 41 years, consistently pushing the boundaries with new technologies. What impressed me the most was their commitment to reinvesting a substantial portion of their revenue - 25%, which is more than twice the industry average - back into research and development. This focus on innovation has allowed SAS to develop strong, long-term partnerships with clients and provide state-of-the-art solutions to address the constantly changing challenges of fraud. SAS currently supports over 80,000 clients in 148 nations, assisting them in addressing various fraud situations using a flexible and integrated technology platform.

The SAS Fraud Platform: A Comprehensive Solution

Varun Mehta presented a detailed overview of the SAS Fraud Platform, which is a powerful tool designed to combat various forms and types of fraud in different sectors. This platform is valuable because it eliminates the need for separate systems to address different types of fraud, providing a unified and comprehensive solution.

Here are some key points

Cross-Industry Application: The SAS Fraud Platform is capable of detecting fraud across various industries such as banking, insurance, healthcare, e-commerce, and procurement, thanks to its versatile technology.
Real-Time Detection: Its real-time fraud detection capability is a game-changer as it can swiftly identify and prevent fraudulent activities, safeguarding organizations from significant financial losses.
Advanced Analytics and Machine Learning: Through advanced analytics and machine learning, the platform can uncover unnoticed fraud by examining extensive data and identifying irregular patterns. This includes identifying suspicious banking transactions and uncovering procurement fraud involving ghost vendors and duplicate invoices.

Recently SAS also did a survey by sending 22 questions to its member all over the world for asking about their organization’s anti-fraud initiatives. Here are the ways you can explore the report, first A visually appeling dashboard and second complete report with a login report.

here is a screen shot of showing the uses of analytics tools in banking and finance services for fraud detection

Real-World Examples of Fraud Detection

Varun shared several real-world examples that highlight the effectiveness of the SAS Fraud Platform.

Example 1

In a situation in which malicious individuals took advantage of an unused bank account and changed their account address and phone no. to illegally transfer large amounts of money in small increments, the standard monitoring systems did not detect fraudulent activity until after it had already occurred. The perpetrators efficiently carried out their plan over a short period of about 30 minutes, using various mule accounts to withdraw the unlawfully obtained funds and bypass standard surveillance methods.

If the organization had incorporated SAS Fraud Protection into its system, the platform would have quickly caught the abnormal activity by identifying key signs, such as sudden changes in account information followed immediately by high-value transactions. These irregularities would have triggered real-time alerts within the first 5 minutes, enabling proactive detection and allowing the organization to promptly halt all account activities before the fraudulent individuals could carry out their plan.

Example 2

Another example is a company with 8,000 employees. During an audit, it was discovered that 140 people were over the age of 80, even though the official government retirement age is 63. It was found that salaries for these individuals were still being paid after they retired. What happened is that when a person retired or left the company, the payroll department did not stop the payments but instead changed the account details to their controlling account. This is a form of fraud where people’s money is taken unlawfully.

The examples emphasize the growing challenges of fraud in today’s digital age and highlight the pivotal role of advanced analytics, artificial intelligence, and machine learning in combatting fraudulent activities. It stresses the importance of implementing advanced technological solutions to protect against and prevent fraudulent behavior in various sectors.

Reference

Federated Learning vs. De-Anonymization -- Protecting Your Data

Sun, 16 Jun 2024 14:15:39 +0530

Federated Learning vs. De-Anonymization: Protecting Your Data

In simple terms, federated learning is a technique where a machine learning model is shared with different nodes, clients, or data collectors (like IoT devices). Each client device trains the model locally using its own data and then sends the updated parameters and weights to a central model. This central model then aggregates these updates, learns from them, and shares the new parameters back with the client models.

Here are some terms used in this process:

Client: Total number of devices involved in the federated learning process.
Active Client: Some clients are selected to perform training based on certain conditions such as stable network connection, charging status, etc.
Round: The number of times each active node will perform training locally and then share the final parameters with the central model.

Even when data is made anonymous, personal information can still be revealed. Two cases illustrate this issue:

Case 1: Revealing the Identity of Netflix Users

Netflix shared anonymous viewing data for a competition to enhance its recommendation system. Yet, researchers managed to uncover the identities of individuals by linking this data with publicly available IMDb ratings. By comparing the viewing habits of a small number of users in both datasets, the researchers were able to identify specific people and their viewing preferences. This raised serious concerns about the reliability of anonymization methods.

Case 2: Strava Heat Map Exposing Military Locations

Strava, a fitness-tracking app, creates a map showing the activity levels of its users around the world. Although the data is anonymous, it has accidentally revealed sensitive military locations. Researchers discovered that by studying the map, they could figure out how people move in remote areas. In some cases, this helped them locate military bases and track the movements of personnel, disclosing important information.

Measures to Prevent Information Leaks in Federated Learning

To mitigate the risks associated with data de-anonymization, several techniques can be employed:

Stochastic Gradient Descent (SGD): SGD is a technique used in machine learning to improve a model by adjusting weights based on the gradient of the loss function. By adding noise to the gradient calculation, it can enhance privacy protection by making it more difficult to extract exact data points.
Differential Privacy: Differential privacy means sharing information about a group without revealing information about individuals. It ensures that adding or removing a single data point doesn’t significantly change the results, protecting individual privacy.
Federated Averaging: Federated averaging is a method used in federated learning where multiple devices work together to train a model without sharing their raw data. Each device calculates updates to the model based on its local data. Only the updates, not the data itself, are shared and averaged to improve the global model. This approach helps maintain data privacy across decentralized systems.

Conclusion

Protecting personal information in the age of big data is a tough job that requires advanced techniques. The example of Netflix and Strava shows that even when data is anonymized, it can still be at risk of de-anonymization attacks. By using methods like stochastic gradient descent, differential privacy, and federated averaging, organizations can improve their data protection measures and better protect individual privacy.

References

How To Break Anonymity of the Netflix Prize Dataset Paper
Anonymity and the Netflix Dataset - An Essay
Heat Marks the Spot: De-Anonymizing Users’ Geographical Data on the Strava Heatmap - Paper
Lecture 23 — Differentially Private Machine Learning - By Prof. Gautam Kamath - Lecture Notes

Introduction to Federated Learning

Sat, 16 Mar 2024 14:15:39 +0530

Intro to FL(Federated Learning)

The Problem with Current Machine Learning

Data goes to your model.

Getting data from different sources can change the true nature and authenticity of the data. It also creates worries about sharing and keeping the collected data private.
Today’s machine learning algorithms have data stored in one central place. This means the authenticity and originality of the data can be altered, and the data can be fake or synthetic.

The Solution: Federated Learning (FL)

In FL, your model goes to the data.

In simpler terms, your model is shared and spread across the different data sources, and your model is trained on the data on individual devices or machines. All the updated model weights are then combined into a central model.
There is a main central model that communicates with other models distributed across many client devices. The client model is trained on the client’s system multiple times in rounds so that it can handle different types of data. After addressing data issues, the distributed models share their final weights with the central model.

For example, people from different regions use Google’s keyboard, and they get suggestions in their local languages.

Another example we’re all familiar with is next-word predictions on our phone keyboards. The suggestions are based on our typing habits.

Another use case is detecting anomalies in industrial IoT devices, as different IoT devices work differently based on their surroundings and characteristics, needing different maintenance predictions from other IoT devices.

How FL is Effective

There are various methods to use data from different sources and train models, but Federated Learning is a proven and widely used technique. It solves privacy issues and the risk of exposing personal data by not taking data from clients.

For data generalization, having many different forms of data can reduce the performance of a regular machine-learning model. To avoid this, our model should be able to handle all kinds of data.
The machine learning model should use less computing power so it doesn’t overload client devices and machines.
The model should be trained in multiple rounds to train efficiently by handling the different types of data and resource availability on clients’ devices.

source

Reading Material link

What I Know About Java

Sat, 30 Dec 2023 14:23:50 +0530

Explaining the

pubic static void main(String[] args)

the execution of our code starts form main.
let in order to create the object of class x we should have the main method
So main is a parameter and it takes parameter ie. main ( )
And the type of the parameter can be anything so we take the string because String except values and we don’t know how many values we are taking so we take array main(String args[])
There is nothing to return in main so it is a void type
In order to call the method we require the object and the execution of our code is start from the main so that’s why it considered as static void main(String args[])
and it made public so public static void main(String args[])

creating a object inside the main

we type the class name and obj name Main obj
then we have a keyword new : it tell the jvm how memory it required for the given class, for that the size of class is define by the default constructor.

it is like a blowing the air inside the pillow (keyword new ), and capacity of that pillow is constructor.

Java OOP

Method Overloading

Methods with same name but diff in (parameter or data type of the(both)).
this kind of methods are known as overloaded method. ex :

void func(){..}
int func(){...}
float func(int x){...}
void func(int x, float k, long l){...}

Method overloading should be consider by the type or count of the parameter that passed to a method not by the return type of the method.

Constructor

It is member method.

Constructor have same name as class name.

Constructor will never return anything.

It used to allocate the memory.

Every time when we have to create a any object we have to use the constructor weather we define it or not.

If we don’t create a constructor it will be there that’s a default constructor.

What a Constructor do : it will define the size of class which help keyword new to create the memory accordingly .

unlike methods, a constructor has the same name as that of class and does not have any return type.
In java similar to method but only invoked when an object of the class is created. ex:

class Main{
 private short num;

 // constructor
 Main() {
 System.out.println("After the object is create. ");
 num = 27;
 }

 public static void main(String[] args){
 // object of class is created 
 Main obj = new Main();
 // calling the var
 System.out.println("the short number is "+ obj.num);
 }
}

There are three type of Constructor
Private Constructor : Private constructor can’t be accessed from outside the class.
No-Arg Constructor : Constructor that does not accept any arguments.
Parameterized Constructor : Constructor that accepts arguments.
Default Constructor : Constructor that is automatically created by the Java compiler if it is not defined.

A constructor can not be abstract, static or final

Access Modifier

It is helpful in the Encapsulation ( preventing the data from misuse and alter.).
And to Control what part of program can access the members of a class.
Default : Declarations are visible only within the package(package private).
Public : This can be access by other class.
Private : This can not be accessed by other class.
Protected : Declarations are visible within the package or all subclasses.
refer to this image this

this key word

this : refer to the current object inside a method or constructor.
in other words: this is treating the variable with same name, differently according to there position/place.
using this with getters and setters : in getters/setters we are using the same var name as in the program
using this in constructor overloading ex:

class Complex {

 private int a, b;

 // constructor with 2 parameters
 private Complex( int i, int j ){
 this.a = i;
 this.b = j;
 }

 // constructor with single parameter
 private Complex(int i){
 // invokes the constructor with 2 parameters
 this(i, i);
 }

 // constructor with no parameter
 private Complex(){
 // invokes the constructor with single parameter
 this(0);
 }

 @Override
 public String toString(){
 return this.a + " + " + this.b + "i";
 }

 public static void main( String[] args ) {

 // creating object of Complex class
 // calls the constructor with 2 parameters
 Complex c1 = new Complex(2, 3);

 // calls the constructor with a single parameter
 Complex c2 = new Complex(3);

 // calls the constructor with no parameters
 Complex c3 = new Complex();

 // print objects
 System.out.println(c1);
 System.out.println(c2);
 System.out.println(c3);
 }
}

passing this as an argument : - i also didn’t get it. ask to sir

final keyword

final keyword means used to denote the constants and it can be used with variables,method and classes.
final variable cannot be reinitialized with another value.
the final method cannot be overridden.
the final class cannot be extended.

`instanceOf` operator

used to check whether an object is an instance of class or not
syntax objectName instanceOf className;

Inheritance

It allows to create a new class from an existing class.
just inherit it from it’s father class.

class Main
{
 public static void main(String args[])
 {
 child boy = new child();

 boy.display();
 }
}

class parent{
 String color = "White";
 System.out.println("It is same like we get the traits from our parents, JDK or JVM also doing the same thing.");
 // it is same like we get the traits from our parents, JDK/JVM/java is also doing the same thing. 
}


// inherit from parents
class child extends parent{
 public void display(){
 System.out.println("The value for variable \'color\' is comming from the parent class.");
 System.out.println("Color of child is "+color);
 }
}

Learn Visualization With Seaborn

Sat, 30 Dec 2023 14:23:16 +0530

Seaborn Tutorial

IMPORTANT Que: What is Probability Density of Data? Ans: The Probability Density of Data refers to the likelihood of a certain value or range of values occurring within a dataset. It is mathematical function that describes the distribution of the data and can be used to make prediction and to understand the underlying patterns and relationship within the dataset.

Note Python notebook containing all plots with various parameter can be obtain from [here]

Setup

Install the matplotlib and seaborn in your editor or notebook by using following commands

pip install seaborn # to install in termianl 
pip install matplotlib
!pip install seaborn # to install in notebook
!pip install matplotlib
conda install seaborn # to install in conda env 
conda install matplotlib

Plots

Distribution Plots

Joint Plot

Joint Plot is a combination of scatter plot and a histogram or kernel density estimate (KDE) plot to display the distribution of one variable along the x-axis and the distribution of another variable on y-axis. It allows to visualize the relationship between two variables.

KDE Plot

Kernel Density Estimation is a graphical representation of the probability density function of a continuous random variable. It uses a smoothed line to show how often different values appear in the dataset. It is a non-parametric method(it does not make any assumptions about the underlying distribution of data.)

Pair Plot

Also known as Scatter plot matrix. A pair plot is used to visualize the relationship between multiple variables in a dataset. It uses a grid of subplots, where each subplot shows a scatter plot of two variables. Pair plot is often used to explore the relationship in a dataset.

Rug Plot

Rug plot shows the distribution of a single numeric variable. A set of vertical lines is plotted for each observation in the dataset, with x-axis representing the variable of interest and the y-axis representing a value of 0 or 1. The resulting plot allows you to see the density of observations at different values of the variable. It’s called rug-plot because it looks like a carpet or a rug.

Styling

Style and customization can be done using various function and options like you can change the color palette of a plot, adjust the size and font of the axis labels, or add a title to the plot, scale and provide context to the plot, various plotting function and Faceting(split data across multiple subplots).

Categorial Plots

Bar Plot

In Bar Plot bars can represent different categories or groups, and the height of the bar plot can represent a numerical value or count. In Seaborn the barplot() function can plot a bar char of the y-axis variable against the x-axis variable.

Count Plot

Count Plot shows the number of occurrences of each category in a dataset. It used to visualize the distribution of categorical data. The x-axis represents the categories and the y-axis represents the count of data points in each category.

Box Plot

Violin Plot

Violin Plot is similar to the box plot, but instead of a box it plots the data as kernel density estimate(KDE). The violin plot shows the probability density of the data at different values. It has a marker to indicate the median of the data and the width of violin indicates the frequency of the data points.

Strip Plot

It displays the individual data points as dots or points on a single line. It is used to show the distribution of a single variable and often used in combination with other types of plots to provide additional information.

Swarm Plot

Palettes

A palette refers to a set of colors that can be used to create visualizations. sns.color_palette() function can be used to create custom palettes. Different palettes can be used to create different types of plots, such as categorical plots, sequential plots, and diverging plots

Matrix Plot

Heat Maps

Heat maps use color to show the density of distribution of the data, where the values are represented by colors. It is a 2-dimensional representation of data. The data can be passed as a matrix or a data-frame, with each row and column representing a variable in the data, and the values of the cells representing the measurements or observations.

Cluster Map

Cluster Map group similar data points together and separated dissimilar data points. In Cluster Map, the rows and columns of the data are rearranged to group of similar data points together and to make patterns in the data more visible.

Pair Grid

Pair Grid allows to plot multiple plots together in a grid format.

Regression Plot

Markdown to Html Conversion

Sat, 30 Dec 2023 14:22:57 +0530

Conversion of Markdown(.md) to html markup language

get the pandoc
Use the following command

 pandoc smaple_readme.md -t html -o sample_readme.html

In shell it would be written like

cat=$(pandoc $1.md -t html -o $1.html )

It will be run the loop with wildcard like

 for i in ~/locat/.md/file/* ; do $(var) ; done

Modification

check extension of each file with if condition and print the non md file like

if [ $1 -ne *.md ]
then
 echo "UNEXPECTED Document format $1 "
 continue
else:
 `further code`
fi

Learn tmux, a Terminal Multiplexer

Sat, 30 Dec 2023 14:22:29 +0530

tmux

Installation

Linux : sudo apt-get install tmux
Fedora : sudo dnf -y install tmux
Cent-OS : sudo yum -y install tmux
Arch Linux : sudo pacman -S tmux
to start : tmux
NOTE: Prefix key : Ctrl+b
github

What is tmux ??

It is terminal multiplexer.
It acts as a window manager in your terminal.
It also allows to create multiple window and panes in a single terminal window.

What it can do

Tmux keeps the sessions , windows and panes in a server located at /tmp/tmux
If your terminal window is crash or killed(detach) then still all your process and session is alive, until you kill the tmux server(reboot).
Again you can pick the session from where you left by simply attaching to the session.
tmux is also helpful while working with remote machine.

tmux key binds

NOTE: Prefix key C-b == Ctrl+b

to start : tmux
Splitting Pane :
- for left and right : C-b+%
- for top and bottom : C-b+"
Navigates through panes :
- C-b+<arrow_keys
- to move left : C-b ⬅
- to move right : C-b ➡
- to move up : C-b ⬆
- to move down : C-b ⬇
Closing pane: type exit or C-b x
Creating windows : C-b c
- rename windows : C-b ,
- to kill window : C-b &
Navigates through windows :
- for previous window : C-b p
- for next window : C-b n
- for required : C-b <number> where number is number in front of the window’s name in your status bar
Session handling :
- to detach your current session : C-b d
- for list of session to detach : C-b D
  - for list of session : C-b s
  - for list of session : tmux ls it worked without a tmux session
  - to attach to session from list : tmux attach -t 0 -t 0 -t for specific target and 0 name of the session
  - attach to a new session : tmux new -s database new -s database new for new , -s for session , database as name of session new -w __ -w for new window
  - rename session : C-b $ rename before starting the session : tmux rename-session -t 0 database
to enter command prompt mode : C-b :

NOTE : to see the more key bindings use C-b ?

It will show the all binding available in it

Links 🔗

Network Concepts Basics

Sat, 30 Dec 2023 14:21:26 +0530

Networking Concept

Mac address

Media control access
It is physical address to identify the devices
it identify the NIC of each divices (NIC–> Network identification card)
ex:- ether 00:0c:49:0a:43:03
Mac work in the second and third layer of the OSI model
Specially it is related to the switches

TCP –VS– UDP

TCP

Transmission COntrol Protocol
Connection oriented protocol
used in HTTPS/SSH/TelNet/SMTP/FTP
provide the more security and relailablity
it form one-to-one connection and it gurantee the complete delivery of data
Three way hand shake
SYN -> SYN-ACK -> ACK
it is slow due to three-way-handshake, it take time to complete and establis the connection
Use port to establish the connection
During hand-shake it acknowldge your machine to the requested server
contains the 20Byte packet

UDP

User Datagram Protocol
Connection less Protocol
it provide the fast transmission
Broadcast or multicast the message and the complete delivery of data is note guarnted
Streamming on voice-over-io(VOIP), DHCP,DNS
Used for streaming the data like procast, video
contains the 8Byte packet

Comman Ports and Protocol

TCP

 PROTOCOL/SERVICE PORT'S
FTP 21
SSH 22
TelNet 23
SMTP 25
DNS 53
HTTP/HTTPS 80/443
POP3 110
SMB 139+445
IMAP 143

UDP

 PROTOCOL/SERVICE PORT'S
DNS 53
DHCP 67.68
TFTP 69
SNMP 161

The OSI Model

Open Systems Interconnection(OSI)
Learn this mnemonic to to know the seven layer sequence
Please Do Not Throw Sausage Pizza Away

OSI seven layers are

 1. Physical (P)Please
2. Data link (D)Do
3. Network (N)Not
4. Transport (T)Throw
5. Session (S)Sausage
6. Presentation (P)Pizza
7. Application (A)Away

OSI Model Explain REF

 Layers For
1. Physical -- Provide the connection between computer and network, it includes physical datacable,server
2. Data Link -- Make sure the data-transfer is error-free between different node, when data packet arrive at network layer then data link layer(DLL) deliver that packet to the requested host using MAC address.
3. Network -- Transmitt the data from one host to other, in different netwroks.It also place the reciver/sender ip address in header of packet.
4. Transport -- Data packet referred as Segment, it is responsible for the end-to-end delivery of complete message without any error/packet loss.
5. Session -- Responsible for the establishing the session,maintaining and also ensure the security
6. Presentation --- Data from application layer(layer 7) is extracted here and manipulate as per the required to transmit over network.
7. Application --- Used by the end user software such as web browser and email clients.

While Receiving the data from network model work from layer 1 –> layer 7

While sending the data from machine model work from layer 7 –> layer 1

Networks

IP address are work with the third layer of the OSI Model
There are two types of ip address
- IPv4 : 192.168.34.123
- IPv6 : 23:s3:3w:34:dw:23:2d
In IPv4 each section after delimeter(.) is contain the 8 bits each (0 & 1)
The total of complete ip address is 32 byte.
the total in terms of the bits is 256 that is from 0 to 255.
There are many network around you and your system and all are having the very specific identity number that is known as IP address.
Types of ip address in a network

Class Start ip End ip Subnet Mask Netwroks(max) Hosts(max)

A 0 127 255.0.0.0 126 16,646,144

B 127 191 255.255.0.0 16,383 15,024

C 192 223 255.225.255.0 2097,151 254
IP address in the binary format
- 11111111.11111111.11111111.0 == 255.255.255.0
- == 192.168.15.
Some Standard Slash Network
- /24 Network
  
  128 64 32 16 8 4 2 1
  
  1 0 0 0 0 0 0 0
- /25 Network
  
  128 64 32 16 8 4 2 1
  
  1 1 0 0 0 0 0 0

Class	Start ip	End ip	Subnet Mask	Netwroks(max)	Hosts(max)
A	0	127	255.0.0.0	126	16,646,144
B	127	191	255.255.0.0	16,383	15,024
C	192	223	255.225.255.0	2097,151	254

128	64	32	16	8	4	2	1
1	0	0	0	0	0	0	0

128	64	32	16	8	4	2	1
1	1	0	0	0	0	0	0

Links

It is getting hard for me to write and draw the ahed so i am adding some link of my document go through them, Some link to internet resources

Information Gathering, the First Step for Exploitation

Sat, 30 Dec 2023 14:20:17 +0530

Recon

There are two type of Reconnaissance

Passive Reconnaissance :– Doing the recon without coming in direct contact of the target. \
Active Reconnaissance :– Doing the active notecible action on the target site.

Passive Reconnaissance includes

local/Geo Information
- Satellite Images
- Building layout
- Cabin location, fence, count of head in building, ways to exit, break areas, security fencing.
Job information
Senior manager name, meeting routine, job title.
Image from social sites like badge photo, cubical, desktop.

Web and Network Information

Targe Validation

First thing you have to do is, validate your target.

Weather the description of given target is having the relating with the given ip

Finding Subdomain

Testing only one domain or some domain is decrease the chances of finding the flaw.

Testing the all in-scope sub-domain is a good practice.

Tool can be use for finding the subdomain are

Google fu, dig, Nmap, sublist3r, bluto, crt.sh etc.

Fingerprinting

We need to know which website running what on front or back.

What’s running on the host.

What’s web server, ssh, ftp, services.

Data Breaches

Just check if the credentials or account is pawned or not

Use this to check

havebeenpawned, Breach-prose, weleakinfo.

NOTE: Better Recon, enumeration makes you better pentester.

Email Address gathering with Hunter.io

You can use Hunter.io to find the people email address working or related to the domain you enter.
In free plan it only provide the 20 searches as free, so do not abuse the searches.
It also tell the where it get all emails written in source.
You have to login with valid email id to have account.
It also provide the category of email address, the department of the email owner.

Breach-Phrase from github

It is tool on the GitHub, it checks for the leaked credentials in its own in-build data of credentials
This in build data is gather from the dark web store.

NOTE: the gather email address are plays important role in further recon and enumeration.

Utilizing the Harvester

It searches with the domain.
It can gather the subdomain name, e-mail addresses, virtual hosts, open ports/banner, and employee name from different public sources like search engine, social site

Hunting Subdomain

We need see/identify what are the available or working subdomain out there. use this

Sublist3r
- Sometimes it only give the 3 level subdomain
crt.sh
- It give the all registered subdomain that can be 3 level or 4 level
OWASP Amass is more efficient tool than above mentioned
Sublist3r is slow during to fast up increase the threads NOTE: Found subdomain may or may not alive.

Identifying the Web Technologies

To Fingerprinting the web page or to get the services running in the background
wappalyzer is browser extension which show the frontend and backend services.
Terminal tool is whatweb
- use whatweb -h for more details of tool

Imputation of Missing Data

Sat, 30 Dec 2023 14:19:38 +0530

Find the missing data

In order to find the missing data in large dataset we use the functions of pandas library, functions is isnull()

DataFrame_name.isnull()
it will give the outout as boolean for every element of dataset.
To get the status of a single comlumn apply the with .any(axis=1) parameter like df[df.isnull().any(axis-1)]

NOTE: DataFrame_name.isnull() function do not consider an empty string or string with space as missing value. So we have to check and replace the empty string from our dataset if any exist.

Process to Handle Missing Data

There are mainly two process to handle the missing data in our observation

drop the missing data by row/column
Imput the missing values using mean/median/mode

To drop the data row with missing/nan values :

df.dropna()

We can imput the data in servel ways using the df.fillna() on the dataset.

df['col_name'].fillna(1,inplave=True) # It will replace nan with 1 in the col_name column

df['date'].fillna(method='ffill', inplace=True) # It will fill the previous value on the next nan observation

We can also use the mean,mode and median to fill the missing value

What if we ignore the Missing Value/data

Missing Data can lead to bias and inaccurate result and conclusions.

Basic Git Commands

Sat, 30 Dec 2023 14:15:59 +0530

what you should do in git

git init -b main
git remote add origin <repo_link>
git remote -v

cd to the root file of the project
echo "+ Project " >> README.md
git init
git add .
git commit -m "README"
git branch -M Main
git remote add origin <repo_link>
git push -u origin Main

pushing an existing repo from cli git remote add origin https://github.com/UserCtf777/Inkdrop.git git branch -M Main git push -u origin Main

after clonning any repo it have the address of origin, simply you cannot add your repo url for backup/project/ICR for that you have to change the origin url follow the following command

to check the origin url try the remote verbose git remote -v
to change the remote origin try git remote set-url origin <repo_url>

new error found
sometimes when we clone the repo we use depth=1 to remove it’s history
this give the error during pushing it to other origin
error looks like

 ![remote rejected] Main -> Main (shallow update not allowed)

```
 error: failed to push some refs to
```
to solve this try git remote set-url <old_url> git fetch –unshallow old

git init -b main
git remote add origin <repo_link>
git remote -v

cd to the root file of the project echo “+ Project " » README.md git init git add . git commit -m “README” git branch -M Main git remote add origin <repo_link> git push -u origin Main

pushing an existing repo from cli git remote add origin https://github.com/UserCtf777/Inkdrop.git git branch -M Main git push -u origin Main

after clonning any repo it have the address of origin, simply you cannot add your repo url for backup/project/ICR for that you have to change the origin url follow the following command

to check the origin url try the remote verbose git remote -v
to change the remote origin try git remote set-url origin <repo_url>

new error found
sometimes when we clone the repo we use depth=1 to remove it’s history
this give the error during pushing it to other origin
error looks like

 ![remote rejected] Main -> Main (shallow update not allowed)

```
 error: failed to push some refs to
```
to solve this try git remote set-url <old_url> git fetch –unshallow old +!/bin/bash

cd ~/work/obs/Obsidian

git add . git commit -m ‘daily update’ git push

+!/bin/bash

to make dir work as git repo git init
to check the changes git status
to sort/simplify the changes git add .
git log shows the log of all commit done git log
restore to discard the changes git restore .
to commit the changes [with ‘-m’ for successful commit/{-m => metadata of changes}] git commit -m “daily update”
git push to add new file to the repo git push
command to add remote repo / it skip the authentication part during git push git remote add origin git@github.com:UserCtf777/Obsidian.git git branch -M master git push -m origin master
To solve the conflicts during rebasing git rebase –continue + fix conflicts and run this git rebase –skip + to skip this patch/changes git rebase –abort + to checkout the original branch
When we have unresolved conflicts before merging or having error related to add git fetch + to gain the latest changes from server git merge origin master + to give a try to automatice merging
it will only work if branch has to merge something– it can be checked with git status git merge –abort + the unresolved conflicts will be cleared off
to edit the conflicts git rebase –edit-todo git rebase –continue
if conflicts dosen’t resolve then git rebase –abort
it will give the path of unresolved files
if you know how to edit then resolve them
OR you can remove that confict by git rm
if nothing is ahppening you can skip the commit wiht git rebase –skip

Enumeration Second Step for Exploitation

Sat, 30 Dec 2023 14:15:39 +0530

Enumeration

Kioptrix level 1

Now as beginner we should a have vulnerable machine to test
Use kioptrix level a from vulnhub.
This is used for beginner to develop there skill by testing the vulnerable machine.
Download it, and set up it on your virtual software.
Make sure the network connection is set to NAT
Open the root folder(which contain all configuration files) and open configuration file and change Bridge to NAT
I Coppied select this option form pop dialogue
Once the setup is done do the arp-scan -l
On your system it will discover the available host in your ip CHIR
Ignore the x.x.x.1 and x.x.x.254 because this are your network identity and broadcast ip, Rest all machine are lying in your ip range.

Nmap stealthy scan

What normal two-way connection looks like

SYN <-> SYNACK <-> ACK

Stealthy scan doesn’t establish the connection it ask for the open port on the serve as server reply the status it will take the step back without establishing the connection.

SYN <-> SYNACK <-> RST

Use this Namp flags for better enumeration nmap -T4 -p- -A <ip_address>
Go through the scan properly
Visit ip/webpage, check weather there you can do anything like directory busting.
Get all services running, also check the header and behaviour.
Do whatever you can do.
Then use nikto web vulnerability tool.

nikto -host <url>

Directory busting

dirbuster / birb / gobuster

Dirbuster

start dirbuster from terminal
fill the slot with information of your target
for word file use /usr/share/wordlist/dirbuster
File extension depends on you or the time you have.
Received/common url can be a information disclosure of anything like stats, user-data, server header, response.

Dwmbar vs Dwmblocks, a Task Manager

Sat, 30 Dec 2023 14:15:02 +0530

2022-05-17

problem statement

with dwmbar the cpu uses is touching its picks and that thing i don’t like

solution

to solve this i am trying to get the dwmblocks of Bugswriter

error or problem faced

get repo
run make and you may get this error 🔽
Pasted image 20220518015013.png
solving this we get this

Solution

okh now the error is fixed

So first know what is error about

error we are trying to automatically compile the dwmblocks.c file and in the code the library which is ariseing the error that is -lX11 The path to solve this is we have to do the maual compilation of an C language file and that is very easy

command for compilation is gcc dwmblocks.c -lX11 -o dwmblocks ▶ gcc as in-build compiler, dwmblocks.c file to compile, -lX11 is lib adding manually during compilation, -o to get output with, dwmblocks as name of output file

edit the config file according to required blocks

NOTE📌 : cp the dwmblocks file to the /usr/local/bin so it can run from any where

take the dwmbloks script form lukesmith voidrice build use this

add bar scripts in the /usr/local/bin this path is given in the documentation of dwmblocks

now you are ready to run

Command

idconfig –> configure dynamic linker run-time bindings.

Used to create links and cache to the most recent shared libraries .

gcc <-lib-to-add> -o <output-file-name>

gcc dwmblocks.c -lX11 -o dwmblocks

Networking Command Netstat

Sat, 30 Dec 2023 14:14:11 +0530

Learn Netstat

A basic Linux network command

NETSTAT

Prints the network connection and routing tables.
Like an CCTV monitor for every connection come in and go out from your machine.
MiniManual

netstat -ant : a for all connection, n for numeric, t for all TCP connection//u for the UDP connection

netstat -rnec :r for the route information, n numeric, e extend, c continous prints the result

netstat -stuw : s for statistics summary,t/u for tcp/udp, w prints raw data

netstat -tulpn : it shows the connectio with PID numbers

lsof -i : it establish the connection

Cloud Computing Basics

Sat, 30 Dec 2023 14:13:52 +0530

Cloud Computing

Types of cloud/ Cloud deployment model

Public Cloud

Public cloud managed by third parties which provide cloud service over the enternet to the pubilc
public cloud is the go-to option for the small enterprise, where they are able to start there businesse without large upfront investment.
multitenacy :–> meant to serve multiple user not a singel user

Private Cloud

aka coprate cloud or internal cloud
used by the organization to built and manage there own data centers internally or by the third party.
private cloud distrubuted system that work on private infrastructure and provide the user with dynaminacally provisioning of computing resource
Advantages
better performance, improved speed, space complexity
suitable for the organization that requires a separate cloud for there personal use and data security is the first priority.
Coustomer information protection
Infrastureture ensuring SLA
Complience with standard procedures and operations

Hybrid Cloud

-->

it is a combination of public and private cloud
Hybrid cloud is partially secure because the services which are running the public cloud can be access by anyone and service running by private cloud can be access by the organization user’s.
Example : Google application gmail, gdrive, office 365

Basics of Operating Sys

Mon, 21 Mar 2022 22:56:25 +0530

1. Operating System[OS]

Paging :–>

it eleminates the need of contiguos memory allocation
have two main component and parts
component -> page number(p) and frame number(d)
parts + Logical address -> addres generated by the CPU {represented in bits} + Physical address -> physical location of a required data in a memory
In the process of accessing any data from memory, that will be done by accessing the memory location twice to remove this double accessing of the memory we use the TLB{Translation Lockaside Buffer}.
TLB –> It contains the page table entries that have been most recently used. IMAGE
it is a kind of cache memory resister of memory with there physical address
TLB stored the frequently used data for high speed accessing
It consist of two parts 4. key or tag :: like page number 5. value :: like frame number
It consist of few data that is { frequently/ recently used data}
If data not found in the TLB table then it will search in the page table for that data {TLB miss}
Advantages
Disadvantages
Terms 9. Hit Ratio{HR} –> successful search / total searches doen 10. Miss Ratio{MR} –> HR-total searches done 11. TLBT –> Time( complete TLB search ) 12. MAT –> TIme( time to acces memory ) 13. Effective Access Time 14. formula EAT = HR*( TLBT + MAT ) + MR*( TLBT + 2*MAT)