Cyber Security Enthusiast/Learner

How to Set Up a Telegram Bot to Remotely Communicate with Your Hermes Agent A practical, step-by-step guide to wiring your Hermes Agent up to Telegram so you can message it from your phone — and get answers back. You've got a Hermes Agent running on your machine. You can chat with it in its own terminal or desktop app. But what if you want to ping it from your phone while you're away from your desk? Or have a scheduled task deliver its results straight into a Telegram chat? This guide walks you through setting up a Telegram bot that talks to your Hermes Agent — from creating the bot with @BotFather to configuring Hermes and sending your first message from Telegram. No prior Telegram Bot API experience needed. What You'll Need A running Hermes Agent installation (with the gateway active) A Telegram account (free — just the app on your phone) About 10 minutes Step 1: Create the Bot with @BotFather Open Telegram and search for @BotFather — it's Telegram'...

From Assets to Action: A Practical Risk Assessment Walkthrough (With Real Documents) Risk assessment is one of those things that sounds simple in theory—but once you actually sit down to do it for a real environment, it quickly becomes clear how much structure and discipline it requires. Instead of just explaining concepts, I recently completed a full sample risk assessment for a small business environment and documented every step. You can explore the full project here: GitHub: https://github.com/saadibabar/riskassessmentsample Portfolio: https://starstorm.netlify.app In this post, I’ll walk through the entire process , the documents I created , and the key lessons from doing this hands-on. 🏢 The Scenario: XYZ Limited To make this practical, I created a realistic environment: XYZ Limited — a small café that offers: Public Wi-Fi for customers A gaming zone (PS5s + PCs) Reception systems for billing An online ordering web application This setup is simple—but surprisingly rich from a...

  As part of my GRC studies with Inegben Academy, I'm applying the OCEG Red Book framework to real-world challenges. 1. Third Party Risk Management TPRM  Why this topic? It's one of the hottest, most tangible, and highest-impact areas in modern GRC. It sits at the intersection of cybersecurity, compliance, operational resilience, and reputation. The OCEG "Red Book" (GRC Capability Model) addresses this under components like "Manage Risk" (PRC Module) and "Objectively Verify & Review" (VV Module) concerning vendor assurance.    2. GRC Work Environment Project: "Implementing a Risk-Based Tiered Approach to Vendor Due Diligence" This isn't just a policy document; it's an operational project. Project Objectives: Categorize Vendors: Develop a methodology to tier all third parties (Tier 1 - Critical/High Risk, Tier 2 - Medium, Tier 3 - Low). Criteria include: data access, financial impact, integration with core systems, a...

Regulatory Compliance and SOC 2: Which Industries and Regulatory Standards Require SOC 2? SOC 2 compliance has become a critical benchmark for organizations handling sensitive data, especially those offering services in sectors that must adhere to strict regulatory and legal requirements regarding data protection. While SOC 2 itself is not a law, many industries have incorporated SOC 2 compliance as a necessary standard for meeting their data security and privacy obligations. Below, we explore which industries and regulatory standards require or strongly encourage SOC 2 compliance. 1. Healthcare Industry (HIPAA Compliance) In the healthcare sector, the Health Insurance Portability and Accountability Act (HIPAA) governs how healthcare organizations should manage, store, and share patient data. HIPAA mandates strict guidelines for maintaining the privacy and security of personal health information (PHI), and organizations that handle PHI are required to implement specific controls to s...

Understanding SOC 2: Types, Importance, Timeframe, TSCs, and Controls In today's highly digitized world, data security and privacy are of paramount importance. Organizations handling sensitive customer data must demonstrate their commitment to safeguarding this information. This is where SOC 2 comes into play. SOC 2 (System and Organization Controls 2) is a framework that helps service organizations demonstrate their adherence to security, availability, processing integrity, confidentiality, and privacy principles. In this blog post, we'll dive deep into what SOC 2 is, its types, the importance of achieving SOC 2 compliance, the time it takes, and the Trust Services Criteria (TSCs) along with the necessary controls for each criterion. What is SOC 2? SOC 2 is an auditing standard that was developed by the American Institute of Certified Public Accountants (AICPA). It focuses on the security, availability, confidentiality, integrity, and privacy of customer data stored in the clo...

**My Experience Earning the CRTA (Certified Red Team Analyst) Certification** I’m thrilled to share that I’ve recently earned the *Certified Red Team Analyst (CRTA)* certification from Cyber Warfare Labs (CWLabs), and I wanted to take a moment to reflect on my experience and share some insights into what the certification entails. The CRTA is a beginner-level red team certification, but don’t let the term “beginner” fool you—it’s incredibly valuable for those just starting in the world of offensive security. The certification process involves completing the *CyberWarFare Labs Red Team Analyst Course* and successfully passing a 24-hour practical exam that mimics real-world red team operations. This exam is designed to test your ability to think and act like an adversary in a highly realistic, simulated environment. **What You Learn in the CRTA Course** The CRTA course covers a comprehensive set of skills that are essential for red team analysts. Here are some of the key areas that are i...

To send a message on Skype at a scheduled time, you can use the schedule library in Python along with the skype4py library to interact with the Skype API. Here is an example of how you can schedule a message to be sent on Skype: import schedule import time import skype4py def send_message (): # Create a new Skype object skype = skype4py.Skype() # Connect to the Skype API skype.Attach() # Send the message to the desired recipient skype.SendMessage( "skype_username" , "Hello, this is a scheduled message." ) # Schedule the send_message function to run at a specific time schedule.every().day.at( "22:30" ).do(send_message) while True : schedule.run_pending() time.sleep( 1 ) This code will send a message "Hello, this is a scheduled message." to the skype user 'skype_username' every day at 22:30. You can change the schedule time and message as per your requirements. Note: In order to use this code,...

Python Scapy is a powerful packet manipulation tool that allows users to send, sniff, dissect, and forge network packets. It is written in Python and can be used for a wide range of purposes, including network security and testing, packet capture and analysis, and network protocol development. One of the primary uses of Scapy is network security testing. It allows users to create and send custom packets over the network, sniff and analyze packets, and perform various types of scans and tests to identify vulnerabilities and potential security threats. Scapy can be used to perform tasks such as port scanning, network discovery, and vulnerability assessment, as well as more advanced tasks such as packet injection and spoofing. In addition to security testing, Scapy is also commonly used for packet capture and analysis. It provides a rich set of functions and classes that allow users to dissect packets and extract specific fields and payloads. This can be useful for tasks such as analyzing...

  A Basic Java Program to print "Hello World".

OSWE, or the Offensive Security Web Expert, is a certification that demonstrates a high level of expertise in the field of web application security. To prepare for the OSWE exam, it is important to have a strong foundation in the following areas: Web application architecture: Understanding the various components and technologies that make up a web application, such as the client-side (e.g., HTML, CSS, JavaScript), the server-side (e.g., databases, servers), and the communication between them (e.g., HTTP). Web application vulnerabilities: Familiarity with common web application vulnerabilities, such as cross-site scripting (XSS), SQL injection, and cross-site request forgery (CSRF), and how to exploit and mitigate them. Web application testing: Knowledge of the various tools and techniques used to test and assess the security of web applications, such as manual testing, automated testing, and penetration testing. Web application frameworks: Experience with common web application framewo...

Static code analysis is the process of analyzing code for potential issues or vulnerabilities without actually executing it. It is a valuable technique for identifying issues early in the development process, as it can help identify problems before they become more costly or difficult to fix. Here are some steps you can follow to learn static code analysis: Familiarize yourself with the basics: It is important to understand the principles and concepts of static code analysis before diving into specific tools and techniques. This may include understanding the types of issues that static code analysis can identify, such as security vulnerabilities, performance issues, and coding standards violations. Choose a static code analysis tool: There are many different static code analysis tools available, each with its own features and capabilities. Some popular options include SonarQube, Fortify, and Checkmarx. Consider your specific needs and the languages and frameworks you will be working wi...

OWASP, or the Open Web Application Security Project, is a non-profit organization that aims to improve the security of software and the web. One of their most well-known initiatives is the OWASP Top 10, a list of the most common and most critical web application security risks. The OWASP Top 10 is regularly updated to reflect the current state of the threat landscape and to provide guidance on how to address these risks. Here is an overview of the OWASP Top 10 for web applications: Injection: This occurs when an attacker is able to send malicious code to a web application, which is then executed by the application or the underlying database. Examples include SQL injection, where malicious SQL code is injected into a database query, and cross-site scripting (XSS), where malicious JavaScript code is injected into a web page. Broken authentication and session management: This risk occurs when an attacker is able to gain unauthorized access to a user's account or to manipulate the sess...

ChatGPT is a variant of the popular language generation model GPT-3 (short for "Generative Pre-training Transformer 3"), developed by OpenAI. It is designed to be able to engage in conversations with humans in a natural and intuitive way, using language processing and machine learning techniques. One of the main benefits of ChatGPT is its ability to understand and respond to a wide range of topics and prompts. This makes it useful for various IT careers where clear and effective communication is crucial. For example, a software developer may use ChatGPT to help document their code or create technical guides and tutorials. A customer support representative could use it to answer common questions and troubleshoot issues more efficiently. A project manager could use it to facilitate team communication and keep track of project progress. In addition to its language processing capabilities, ChatGPT also has access to a vast amount of knowledge on various subjects, thanks to its tr...

WALKTHROUGH (spoiler) OF PRINTER HACKING 101 by swafox in Try Hack Me   (tryhackme.com)   Unit 1 introduction   In This section the creator of the room shared some quick info about the famous Pewdiepie hacking. Where the hacker hacked about 50,000 printers and printed a page asking for subscribing to pewdiepie youtube channel 😊     Unit 2 ipp port   The cause of pewdiepie hacking was the open IPP port. An open IPP port can expose a lot of sensitive information such as printer name, location, model, firmware version, or even printer wifi SSID. What port does IPP run on? 631     Unit 3# Targeting and exploitation In this section we have the deploy button to Deploy the machine A handy tool for printer exploitation is shared. Github: https://github.com/RUB-NDS/PRET The Printer Exploitation Toolkit is a handy tool that is used for both local targeting and exploitation. There are exactly three options you nee...