jmau111

XSS without alert

Practical security guide that contains useful links to learn Linux internals and security (attack/defense).

I tried to summarize what I've learned so far, but, of course, it's neither exhaustive nor suited for targeted attacks.

You clearly made your point but comparing this tool with my introduction seems a bit unfair ^^.

Indeed, I was not thinking about that level of attacks. However, if individuals and organizations do not understand the minimum required to secure their instances, they can't stand a chance against advanced threat actors and skilled adversaries.

Thanks for your detailed explanations.

To me, the comparison does not make sense and was definitely not my intention when I mentioned Linux in the guide.

It's just that privesc and kernel exploits is possible under some conditions on Linux.

indeed, but the point was this malicious scripts usually try to install programs, like droppers.

This tool looks sharp, but why do you say "HardeningKitty is a good start." It seems to be an all-in-one solution to harden your system, and not an introduction, like my guide.

> The biggest help with that has been uBlock origin

It seems that browsers and extensions handle a huge part of the global security for users, maybe even more than the OSes.

Nope. It's not a statement, it's just not in the guide.

Not to mention kernel exploits, local privesc, unmaintained or abandoned distros, and many other issues.

I've seen so many people relying on the OS and thinking themselves as power users just by using it with default settings. I think it's a mistake, hence my comparison.

Attacking a secured Windows system is not at everybody's reach. Doesn't mean it can't be done, but it's something I don't like to read in security news, like finding and exploiting 0days will be easy for attackers.

It's not and can take some time. There's even a huge market for initial access. In contrast, exploiting a vulnerable Linux system (e.g., unpatched) is documented everywhere.

?