{"componentChunkName":"component---src-templates-blog-list-template-js","path":"/engineering/22","result":{"data":{"allMarkdownRemark":{"edges":[{"node":{"excerpt":"Hello everybody, in this article, we will learn how to make a beautiful accordion with HTML and CSS only! Yes! You heard that right, plain…","fields":{"slug":"/engineering/css3-accordion/"},"html":"

Hello everybody, in this article, we will learn how to make a beautiful accordion with HTML and CSS only! Yes! You heard that right, plain HTML, and CSS with no Javascript at all!

\n

Let's Begin

\n

Firstly, let's make some markup with HTML. We are going to create a div and give it a class of accordion like so:

\n
<div class="accordion">\n\n</div>
\n

Next, inside the accordion div, we will create another div, this time without a class.

\n
<div class="accordion">\n  <div>\n  \n  </div>\n</div>
\n

Next up, we will create a checkbox or a radio button. We are creating a checkbox or a radio button so that we can make their checked states open or close the accordion. So if you want to be able to open all accordions at the same time, you will use checkbox, otherwise you will use radio buttons. But in this article, I've chosen to use checkbox.\nWe will give the checkbox an id of section1 and a class of accordion__input.

\n
<div class="accordion">\n  <div>\n    <input type="checkbox" id="section1" class="accordion__input">\n  </div>\n</div>
\n

Under the checkbox, we are going to create a label for the checkbox. This label will later on become the head of the accordion tab.

\n
<div class="accordion">\n  <div>\n    <input type="checkbox" id="section1" class="accordion__input">\n    <label for="section1" class="accordion__label">Section #1</label>\n  </div>\n</div>
\n

Next, we will create a new div and give it a class of accordion__content because it will hold the content of the accordion. In this example, we will make the content of the accordion a paragraph.

\n
<div class="accordion">\n  <div>\n    <input type="checkbox" id="section1" class="accordion__input">\n    <label for="section1" class="accordion__label">Section #1</label>\n    <div class="accordion__content">\n      <p>\n        Lorem ipsum dolor sit amet, consectetur adipisicing elit. Culpa, earum, magnam? Alias error, placeat! Accusamus accusantium alias eum iure laborum odit porro quaerat? Animi enim id labore officiis quam sint.\n      </p>\n    </div>\n  </div>\n</div>
\n

Repeat the div without a class for as many as you want depending on how many accordion tabs you want. In this example, we will use only three of them.

\n
<div class="accordion">\n  <div>\n    <input type="checkbox" id="section1" class="accordion__input">\n    <label for="section1" class="accordion__label">Section #1</label>\n    <div class="accordion__content">\n      <p>\n        Lorem ipsum dolor sit amet, consectetur adipisicing elit. Culpa, earum, magnam? Alias error, placeat! Accusamus accusantium alias eum iure laborum odit porro quaerat? Animi enim id labore officiis quam sint.\n      </p>\n    </div>\n  </div>\n  <div>\n    <input type="checkbox" id="section1" class="accordion__input">\n    <label for="section1" class="accordion__label">Section #1</label>\n    <div class="accordion__content">\n      <p>\n        Lorem ipsum dolor sit amet, consectetur adipisicing elit. Culpa, earum, magnam? Alias error, placeat! Accusamus accusantium alias eum iure laborum odit porro quaerat? Animi enim id labore officiis quam sint.\n      </p>\n    </div>\n  </div>\n  <div>\n    <input type="checkbox" id="section1" class="accordion__input">\n    <label for="section1" class="accordion__label">Section #1</label>\n    <div class="accordion__content">\n      <p>\n        Lorem ipsum dolor sit amet, consectetur adipisicing elit. Culpa, earum, magnam? Alias error, placeat! Accusamus accusantium alias eum iure laborum odit porro quaerat? Animi enim id labore officiis quam sint.\n      </p>\n    </div>\n  </div>\n</div>
\n

That's it with the HTML, and it should be looking like this:\n\n div with the class of accordion.\nWe will give it a:

\n\n

So now we have:

\n
.accordion{\n    max-width: 400px;\n    box-shadow: 0 0 10px rgba(0, 0, 0, 0.2);\n    border-radius: 15px;\n    overflow: hidden;\n    background-color: purple;\n}
\n

Now we will set some padding to the label and content so that there is some space between them and their borders.

\n
.accordion__label, .accordion__content{\n    padding: 14px 20px;\n}
\n

Next, we will style the accordion label and set the following properties:

\n\n

So it looks like this when combined:

\n
.accordion__label{\n    display: block;\n    color: white;\n    font-weight: bold;\n    cursor: pointer;\n    position: relative;\n    transition: background-color 0.1s;\n}
\n

Now, we will make the color of the label darker when the user hovers on it. This is also to make the user know that he/she has placed the cursor on something that can be clicked.

\n
.accordion__label:hover{\n    background-color: rgba(0, 0, 0, 0.1);\n}
\n

Next up, we will style the content of the accordion and set the following properties:

\n\n

So when we put it together, we have this:

\n
.accordion__content{\n    background: white;\n    line-height: 1.6;\n    font-size: 0.85em;\n    display: none;\n}
\n

Now we have to hide the checkbox from showing. To do that, we set the display property of it to none

\n
.accordion__input{\n    display: none;\n}
\n

The next thing to do is to show the accordion tab's content if the label is clicked. To do this, we have to set the display property of it to block when the label is clicked. We can know that the label is clicked using the check-state of the checkbox that we hid earlier.

\n
.accordion__input:checked ~ .accordion__content{\n    display: block;\n}
\n

Hurray🎉, we now have a lovely and functioning accordion that looks like this\n\n toolbox, it was a key asset for the well-known WannaCry ransomware to wreak havoc on the world. Some will even argue that it led to a full-on \"Cyber War\"...

\n

Before we start, this story is way too complex to fully cover in a short blog. We are skipping a lot, so go out and read more if you are interested.

\n

The beginning

\n

From 2016 to 2017, the InfoSec community was turned upside down by the so-called \"Shadow Brokers\". This unknown, mysterious group was responsible for five major leaks containing classified hacking tools, collected and archived by the NSA. The NSA has an unprecedented catalog of unknown exploits and backdoors due to decades of hoarding. But instead of notifying the software vendor about these vulnerabilities, they keep these to themselves. These exploits are valuable weapons for the NSA to protect the United States of America and its citizens (controversial, but a topic for another day).

\n

On April 14, 2017, the Shadow Brokers released their fifth leak containing multiple exploits. Infamous EternalBlue was one of them.

\n

So what does EternalBlue do exactly?

\n

Great question! EternalBlue takes advantage of a vulnerability seen in Microsoft's implementation of the SMB protocol. SMB stands for Server Message Block. It is primarily used in Windows for shared folders. Like most of these protocols, it makes communication between two nodes on a network possible via request-response messages (gross over-simplification).

\n

However, Microsoft made a critical error in the way these request messages where handled. By sending a carefully made request to port 445 (which was by default open) containing more data than expected, an attacker was able to set a \"buffer overflow\" in motion. Making the execution of unsigned (and thus malicious) code possible.

\n

MS17-010

\n

A month before the leak, something remarkable happened. The NSA contacted Microsoft to inform them about EternalBlue, presumably because the NSA knew something was about to go down. Microsoft got to work immediately and mysteriously delayed its Patch Tuesday because of a \"last-minute issue\". They eventually released a security bulletin on March 14, the now infamous: MS17-010. Unfortunately, such a wide-spread piece of software like Windows has a prolonged update adaption rate. This proved, once again, to be true...

\n

WannaCry

\n

On May 12, 2017, the WannaCry (powered by EternalBlue) ransomware attack took the world by storm, infecting and encrypting 230,000 computers in over 150 countries. Russia, Ukraine, India, and Taiwan where affected the most, according to Kaspersky Lab. Huge factories from Nissan and Renault came to a screeching halt. NHS hospitals in the UK where severely affected by the attack and where locked out of essential medical equipment. Some estimated that economic losses could be in the hundreds of millions. North Korea is the main suspect for the attack. Two North Korean hackers have been expedited.

\n

NotPetya

\n

Not much later, on June 27, 2017, Ukraine got stomped by another vicious cyberattack. Armed with EternalBlue, the malware called \"NotPetya\" was able to cause significant damage. The attack was mainly targeted towards Ukrainian banks, government bodies, and state-owned organizations. Think of airports, railways, and telecom companies. Even the radiation monitoring system at the Chernobyl Nuclear Power Plant went offline. Because the attack seemed to be aimed at paralyzing the Ukrainian state rather than for monetary motives, Russia is the main suspect. Although Ukrainian authorities and the CIA spoke out, Russia denies any involvement.

\n

Present day

\n

Scary stuff, right? Should you still be worried about EternalBlue in 2020? Well, the exploit indeed lives up to its name. According to Trend Micro, in 2019, two years after WannaCry broke loose, 73,763 detections were made of specific malware samples known to use EternalBlue. Luckily, Microsoft's MS17-010 patch has reached most home users. But organizations are notoriously slow with updating their hardware. Therefore, EternalBlue is still a famous attack today.

\n

But what can you do, you might ask? If we can take one thing from all of this, we should stop using SMB over the internet. EternalBlue is undoubtedly not the last SMB related exploit. Blue's younger brother, SMBleed (CVE-2020-1206), is a new vulnerability and works very similar. It was only patched by Microsoft in June of this year.

\n

Used Sources

\n

https://arstechnica.com/information-technology/2017/04/nsa-leaking-shadow-brokers-just-dumped-its-most-damaging-release-yet/

\n

https://research.checkpoint.com/2017/eternalblue-everything-know/

\n

https://docs.microsoft.com/nl-nl/security-updates/securitybulletins/2010/ms10-017

\n

https://www.independent.co.uk/news/uk/home-news/nissan-sunderland-cyber-attack-ransomware-nhs-malware-wannacry-car-factory-a7733936.html

\n

https://www.cbsnews.com/news/hospitals-across-britain-hit-by-ransomware-cyberattack/

\n

https://www.bbc.com/news/world-europe-39907965

\n

https://www.bbc.com/news/technology-40706093

\n

https://www.nytimes.com/2017/06/28/world/europe/ukraine-ransomware-cyberbomb-accountants-russia.html

\n

https://www.independent.co.uk/news/world/europe/chernobyl-ukraine-petya-cyber-attack-hack-nuclear-power-plant-danger-latest-a7810941.html

\n

https://www.securityweek.com/smbleed-vulnerability-impacts-windows-smb-protocol

\n

https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/putting-the-eternal-in-eternalblue-mapping-the-use-of-the-infamous-exploit

\n

https://www.darkreading.com/vulnerabilities---threats/eternalblue-longevity-underscores-patching-problem/d/d-id/1337233

\n","frontmatter":{"date":"October 27, 2020","updated_date":null,"description":"It's been more than three years since EternalBlue; let's do a recap.","title":"EternalBlue: A retrospective on one of the biggest Windows exploits ever","tags":["Cyber Security","Exploits","Virus"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/579582de5b60f995b00553dd02616f3c/ee604/etbluecover.png","srcSet":"/static/579582de5b60f995b00553dd02616f3c/69585/etbluecover.png 200w,\n/static/579582de5b60f995b00553dd02616f3c/497c6/etbluecover.png 400w,\n/static/579582de5b60f995b00553dd02616f3c/ee604/etbluecover.png 800w,\n/static/579582de5b60f995b00553dd02616f3c/f3583/etbluecover.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Anonymous","github":null,"avatar":null}}}},{"node":{"excerpt":"A blog lets a person express his/her thoughts, and everyone craves to have his/her blog. Creating a blog is quite simple as of today. Open…","fields":{"slug":"/engineering/setup-blog-in-minutes-with-jekyll/"},"html":"

A blog lets a person express his/her thoughts, and everyone craves to have his/her blog. Creating a blog is quite simple as of today. Open-source software such as wordpress, jekyll, hugo can help you create & set up your blog. In this post, we will see about Jekyll and how to host it in Github for free.

\n

Create a brand new Jekyll blog

\n

Install Jekyll using the instructions provided here. You mainly need ruby, ruby gems, gcc, make as pre-requisite. Run the below commands to get a new blog up and running.

\n
gem install jekyll bundler\njekyll new my-new-blog\ncd my-new-blog\nbundle exec jekyll serve
\n

That's it. You can navigate to http://localhost:8080 and see your blog up and running like this

\n

\n \n \n

\n

Customizing the blog

\n

As you see, the blog is a bare minimum, and the default values mentioned in the config file (_config.yml) are used. You can use the _config.yml file to add new plugins, provide metadata about the blog, add your social media profiles, modify themes, etc.

\n

Plugins

\n

Some well-known plugins, to name a few are,

\n\n

You can know about other useful plugins here.

\n

Themes

\n

Minima is the default theme for Jekyll. There are many other themes that you can use too. It is possible to customize the minima theme by adding your CSS and Html. Adding support for comments using Disqus is in-built. Also, there is a provision to enable Google Analytics.

\n

Liquid templating

\n

It need not be that all the contents in the blog have to be static. You can add dynamic content using Liquid templating. Jekyll provides tag and filter options on top of liquid.

\n

Using the custom domain name for the blog

\n

You can specify your custom domain by adding a file CNAME in the git repo, as mentioned here.

\n

Hosting & deploying the blog with Github pages

\n

Using your GitHub account, create a new repository. Push the contents of the jekyll blog created above to the new repository. Go to the github project settings page, generally available in the url\nhttps://github.com/<github-id>/my-new-blog/settings.\nIn the settings page, under the Github pages section, specify the branch to use for the github source. This can be the main branch or some other branch in the repository.

\n

\n \n \n

\n

As soon as the github page is enabled on a branch, github automatically creates actions to build the jeyll blog on a new commit to the branch.

\n

\n \n \n

\n

Advantages of using Jekyll & Github pages

\n\n

When not to use Jekyll

\n\n

Let's get started with blogging using Jekyll & Github pages. Happy blogging!!

\n","frontmatter":{"date":"October 26, 2020","updated_date":null,"description":"Getting started with Jekyll & Github pages","title":"Setup a blog in minutes with Jekyll & Github","tags":["jekyll","blogging","blog","github-pages"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/9fbd82ab49f5445a4a179ab4b9c886ee/ee604/jekyll-github-pages.png","srcSet":"/static/9fbd82ab49f5445a4a179ab4b9c886ee/69585/jekyll-github-pages.png 200w,\n/static/9fbd82ab49f5445a4a179ab4b9c886ee/497c6/jekyll-github-pages.png 400w,\n/static/9fbd82ab49f5445a4a179ab4b9c886ee/ee604/jekyll-github-pages.png 800w,\n/static/9fbd82ab49f5445a4a179ab4b9c886ee/db955/jekyll-github-pages.png 900w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Malathi T","github":"malathit","avatar":null}}}},{"node":{"excerpt":"Kubernetes is a standard container orchestration open-source platform, that is, for managing applications constructed from several, often…","fields":{"slug":"/engineering/understanding-kubernetes/"},"html":"

Kubernetes is a standard container orchestration open-source platform, that is, for managing applications constructed from several, often self-contained runtimes called containers.

\n

Since the Docker containerization project launched in 2013, containers have become increasingly common, but massive distributed containerized apps can become increasingly difficult to coordinate.

\n

Kubernetes became a central part of the container revolution by making containerized systems significantly more straightforward to handle at scale.

\n

This blog targets the way modern applications are deployed and consumed. It introduces the importance of Kubernetes, a container Orchestration tool on a basic level, and how it is making Developers more convenient.

\n

What is Kubernetes

\n

Kubernetes (also known as k8s) is a container orchestration tool widely used to deploy and update the application without any downtime. It enables auto-scaling of resources in case of an increase/decrease in requests to the server.\nAlso, it provides intelligent management, allocation of resources, and services, which saves a lot of money for us.

\n

Benefits of Kubernetes

\n

By using Kubernetes, developers can build cloud-native applications with Kubernetes as a runtime framework. Patterns are the tools a developer of Kubernetes requires to construct applications and services based on containers.

\n

Here are a few benefits of Kubernetes:

\n\n

Kubernetes vs. Docker

\n

Often mistaken as a choice between one or the other, Kubernetes and Docker for running containerized applications are different but complementary technologies.

\n

Docker lets you put everything you need into a box that can be stored and opened when and where it is required to run your application. It would help if you had a way to handle them once you start boxing up your applications, and that's what Kubernetes does.

\n
    \n
  1. With or without the Docker, Kubernetes can be used.
    2. \n
  2. The distinction between Docker and Kubernetes refers to the role each plays in your applications' containerization and execution.
    3. \n
  3. Docker is an open industry standard to package and distribute container applications.
    4. \n
  4. To deploy, manage, and scale containerized software, Kubernetes uses Docker.
    5. \n
\n

Why do you need Kubernetes?

\n

Kubernetes will assist you in deploying and managing containerized, legacy, and cloud-native applications, as well as microservice, refactors.

\n

To meet evolving business demands, the development team needs to build new products and services rapidly. The cloud-native architecture starts with container microservices, allowing faster development and making it easier to transform and optimize existing software.

\n\n

That is where Kubernetes comes into the picture. It handles all the above requirements effectively and reduces a lot of burden from the developer's shoulders.

\n

\n \n \n

\n

Technical Aspect

\n

Kubernetes was designed as a highly available cluster of computers connected to work as a single unit. This abstraction level allows us to deploy the application without thinking much about the machines on which the application would run. Kubernetes' role is to automate the distribution of application containers on computer clusters efficiently.

\n

A typical computer cluster in Kubernetes consists of:

\n\n
\n

The Master is responsible for managing the cluster. The master nodes will coordinate all the activities in your cluster, such as scheduling applications, maintaining their desired state, scaling applications, and rolling new updates. Whereas a Node is a VM or a physical computer that is used as a worker machine in a Kubernetes cluster to actually, run the application

\n
\n

\n \n \n

\n

A master node contains processes that continuously watch the deployment for any CPU or Memory requirement and smartly allocated it in the form of new pods to auto-scale the application, which handles the vast amount of requests coming to the server.

\n

Most of the current cloud services like Amazon Web Service(AWS), Microsoft Azure, and Google Cloud come with automatic support for Kubernetes to provide ease in deploying and maintaining application containers.

\n

A Kubernetes cluster can be deployed on either virtual or physical machines. A software named Minikube can be installed on your local machine that creates a VM on your local machine and deploys a simple cluster containing only one node.\nMinikube provides a CLI through which we can execute commands & simulate a small-scale Kubernetes cluster.

\n

\n \n \n

\n

Some of the basic Kubernetes CLI commands are:

\n\n

Conclusion

\n

There are many benefits of learning Kubernetes as it releases a lot of deployment stress from the developer's shoulders. It helps in auto-scaling, intelligent utilization of available resources, and enables low downtime for maintenance.

\n

Without k8s, a lot of human effort and money is gone into these things, but with the help of k8s, everything can be automated.

\n

Since K8s is a vast technology, it is impossible to wrap all things in just one blog. To simplify things, I will be publishing more blogs soon related to k8s Deployments, ReplicaSets, Services, Ingress Controller, Master and Worker Processes, Kubectl, etc. Stay connected and keep learning.

\n","frontmatter":{"date":"October 26, 2020","updated_date":null,"description":"Learn about the Kubernetes. A container Orchestration tool on a basic level, and how it is making the job of Developers simpler.","title":"What is Kubernetes? - A Basic Guide","tags":["Kubernetes","Deployment","Distributed Systems"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/c0eaad61b9cb15dfe35f7a6d2d0f665a/ee604/image3.png","srcSet":"/static/c0eaad61b9cb15dfe35f7a6d2d0f665a/69585/image3.png 200w,\n/static/c0eaad61b9cb15dfe35f7a6d2d0f665a/497c6/image3.png 400w,\n/static/c0eaad61b9cb15dfe35f7a6d2d0f665a/ee604/image3.png 800w,\n/static/c0eaad61b9cb15dfe35f7a6d2d0f665a/f3583/image3.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Prabhat Kumar","github":"prabhatkgupta","avatar":null}}}},{"node":{"excerpt":"Robotic process automation(RPA) process to get the repetitive tasks done through bots and reduce manual efforts. In definitive words, we can…","fields":{"slug":"/engineering/importance-of-rpa/"},"html":"

Robotic process automation(RPA) process to get the repetitive tasks done through bots and reduce manual efforts.

\n

In definitive words, we can say ** \"Impersonating human activities in a sequential fashion to achieve a designated result without any manual intervention is known as Robotic Process Automation.\"**

\n

Why is RPA becoming an essential part of every business?

\n

There are many benefits of robotic process automation, depending on the industries. I have listed a few common benefits across all the business domains and industries.

\n

A Desideratum

\n

Any business's success depends on how deep they understand the customers, or rather, I should say targeted customers. And this is one of the fundamental challenges for companies.

\n

Intelligent automation through RPA can be implemented to understand user behavior, helping companies in decision making for their targeted customers and growth.

\n

Cost Effective

\n

RPA is the most sought after solution in this technology-driven era to reduce the investment being done on manual tasks and get the best of the employees by allowing them to innovate rather than doing monotonous work. Multiple studies say that rolling out RPA, and thoughtful implementation can save approx 30-35% of companies' costs being spent on non-productive and repetitive tasks.

\n

Undefeatable Accuracy

\n

A report by ICO (Information Commissioner's office) says that 90% of a data breach between 2017 and 2018 happened due to human error. Human minds have certain limitations. We can't always be attentive 100%. And the moment we lose attention, we become vulnerable to make mistakes.\nBut Robots, once defined/built, can have unlimited attention and can work endlessly without any distractions. And that gives the ability to make no mistakes.

\n

Raising the Bar On Productivity

\n

Humans have their limitations, capacity to work. But robots, on the other hand, have no measure of capacity. If developed smartly, they can work for every millisecond. And this gives unlimited possibilities for any company to run their businesses without worrying about productivity.

\n

Use cases in different industries/domains

\n

RPA in Business Process Outsourcing

\n

Business process outsourcing(BPO) always strives for heftiness in productivity with minimal cost. With the efficient use of RPA, the BPO's can eventually reduce a lot of operating expenses and make more effective utilization of their workforce. As robots can work 24/7, productivity can be increased tremendously. Apart from repetitive work automation, the industry also has a lot of back-office work, which is purely rule-based, and the same can be achieved with better security and audits. Report generation, data analysis are the other tasks that can also be done through RPA. Some more examples can be

\n\n

RPA in Banking

\n

Most innovations, along with technological advancement, have been seen in the banking sector. As per the reports, the BFSI domain holds the largest share in the year 2019 to apply RPA.

\n

RPA has a surfeit of applications in banking covering from customer service to compliance nearly everything. The following are a few examples.

\n\n

RPA in Medical Industry

\n

The medical industry across the globe has always been a sector that is continuously striving for improvement. Providing the best health care services for a broad range of population is a real challenge in both operational and organizational. There are numerous use-cases in the medical industry where patients and hospitals can leverage the benefits.\nSuch as :

\n\n

RPA in Insurance

\n

Insurance is an industry which deals with vast amounts of data and processes. With the help, RPA insurance providers are now capable of merging front-end and back-end operations resulting in reducing cost and manual intervention.\nLeslie Willcocks professor at LSE, said that * \"In an insurer we studied, there was a particular process where it used to take two days to handle 500 premium advice notes. It now takes 30 minutes\"*\nThis much processing was made by implementing RPA. Apart from the front-end or back-end automation, there can be many other use-cases, for example

\n\n

Conclusion

\n

There are many more benefits of robotic process automation, depending on the industries.\nA survey by Deloitte says that RPA continues to meet and exceed expectations across multiple dimensions, including :\n92% on Improved Compliance\n90% Improved quality and accuracy\n86% improvement in productivity and\n59% cost reduction.

\n

They say that with the current pace, RPA will have achieved near-universal adoption within the next five years.

\n","frontmatter":{"date":"October 23, 2020","updated_date":null,"description":"It's very important for every business to evolve with technologies, understand their customers needs and and market senitment to sustain and grow.This article will give you some insights that how RPA can help in that with different industries/domain.","title":"Why RPA is important for businesses","tags":["Engineering","RPA","Automation"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/f2993d36b93dfde7b755c69581762a74/14b42/RPA.jpg","srcSet":"/static/f2993d36b93dfde7b755c69581762a74/f836f/RPA.jpg 200w,\n/static/f2993d36b93dfde7b755c69581762a74/2244e/RPA.jpg 400w,\n/static/f2993d36b93dfde7b755c69581762a74/14b42/RPA.jpg 800w,\n/static/f2993d36b93dfde7b755c69581762a74/9a763/RPA.jpg 1050w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Vikram Jain","github":null,"avatar":null}}}},{"node":{"excerpt":"Ever since you enter the sphere of ethical Hacking, you usually need to get your hand on most of the Hacking Tools. The more tools you…","fields":{"slug":"/engineering/best-hacking-tools/"},"html":"

Ever since you enter the sphere of ethical Hacking, you usually need to get your hand on most of the Hacking Tools. The more tools you recognize, the more your hacking career is getting ready to fly off. Therefore let's discuss some of the necessary hacking tools.\n

\n

1.) Nmap

\n

\n \n \n \n

\n

It is a free and open-source tool that's used for network discovery and security auditing.\nNmap is a powerful tool because it is often used to scan vast networks having thousands of machines. It's a command-line tool. Nmap suite additionally includes a complicated GUI that's referred to as \"ZenMap\".\nIt supports a large variety of OS that is:

\n\n

It uses raw IP packets to determine

\n\n

Nmap download link\n

\n

2.) Metasploit

\n

\n \n \n \n

\n

It is essentially a Security Assessment and Penetration Testing tool. Metasploit is often used to launch an attack on alternative systems with it.\nIt uses a vulnerable system on that security testing may be conducted to use the failings within the system.\n

\n

Metasploit may enforce as follows:

\n\n

Metasploit download link\n

\n

3.) Wireshark

\n

\n \n \n \n

\n

It is an open-source tool that's used to capture traffic on the network. It's essentially a network protocol analyzer tool.\n

\n

Wireshark helps in:

\n\n

It additionally captures HTTP packet transmission over the network. Click on \"Follow protocol connection\" within the HTTP packet. Currently, you'll be able to see the username and passwords that are captures over the network.\n

\n

Wireshark download link\n

\n

4.) John the Ripper

\n

\n \n \n \n

\n

JTR is free and open-source software that's wide employed by hackers for password cracking. It uses the varied cryptanalytics attacks like \"Dictionary Attack\" and \"Brute-Force Attack\".\nIt additionally comes with the business version moreover, i.e., \"John the Ripper Professional.\" It's a lot of accessible versions providing a lot of practicality in password cracking at the enterprise level.\n

\n

John the Ripper working:

\n\n

The rate at which the password is going to be cracked depends utterly on the password's strength and offered wordlist. It keeps attempting to break the password continuously till the termination command isn't given.\n

\n

John the ripper download link\n

\n

5.) Burp Suite

\n

\n \n \n \n

\n

It is an integrated platform that's used for activity a check on net application security.\nIt provides a large variety of tools that are used from initial mapping to exploiting the applications' vulnerabilities. Once the issues are detected, hackers will use it to break into the security of the system.\n

\n

Burp Suite comes in 3 editions:

\n
    \n
  1. Community Edition: It is available free of charge for downloading.
    2. \n
  2. Professional Edition: Penetration testers and bug bounty hunters utilize it.
    3. \n
  3. Enterprise Edition: An organization utilizes it.\n
    4. \n
\n

Burp Suite features:

\n\n

Burp Suite download link\n

\n

6.) Angry IP Scanner

\n

\n \n \n \n

\n

It is one of the quickest IP addresses and port scanner. By exploitation, this hacker will gather data concerning open ports within the target system.\nIt pings every IP address within the target system to see whether it's active or not. Further, it resolves the hostnames and determines the MAC address.\n

\n

Features:

\n\n

Angry IP Scanner download link\n

\n

7.) Nikto

\n

\n \n \n \n

\n

It is a web-server assessment tool. It is an open-source platform that performs tests against web servers to seek multiple vulnerable files, misconfigurations, out-of-date servers, and programs on its web server.\nIt depends on HTTP response to seeing whether or not a page or script exists on the target.\n

\n

Features:

\n\n

Nikto download link

\n","frontmatter":{"date":"October 22, 2020","updated_date":null,"description":"Learn about the basic hacking tools.","title":"Best Hacking Tools","tags":["Ethical Hacking","Security","Testing"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/a4a0d680486ac0198559443631be72bc/14b42/cover1.jpg","srcSet":"/static/a4a0d680486ac0198559443631be72bc/f836f/cover1.jpg 200w,\n/static/a4a0d680486ac0198559443631be72bc/2244e/cover1.jpg 400w,\n/static/a4a0d680486ac0198559443631be72bc/14b42/cover1.jpg 800w,\n/static/a4a0d680486ac0198559443631be72bc/47498/cover1.jpg 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Akshay Nagle","github":"Akshay-Nagle","avatar":null}}}}]},"markdownRemark":{"excerpt":"Google has prepared a roadmap to restrict third-party cookies in Chrome. Since 04 January 2024, Chrome has rolled out third-party cookie…","fields":{"slug":"/engineering/identity-impact-of-google-chrome-thirdparty-cookie-restrictions/"},"html":"

Google has prepared a roadmap to restrict third-party cookies in Chrome. Since 04 January 2024, Chrome has rolled out third-party cookie restrictions for 1% of stable clients and 20% of Canary, Dev, and Beta clients.

\n

What does it mean for user authentication?

\n

On one hand, Google believes third-party cookies are widely used for cross-site tracking, greatly affecting user privacy. Hence, Google wants to phase out (or restrict) supporting third-party cookies in Chrome by early Q2 2025 (subject to regulatory processes).

\n

On the other hand, Google introduced Privacy Sandbox to support the use cases (other than cross-site tracking and advertising) previously implemented using third-party cookies.

\n

In this article, we’ll discuss:

\n\n

How is User Authentication Affected?

\n

Third-party cookie restrictions affect user authentication in three ways, as follows.

\n

External Identity Providers

\n

If your website or app uses an external Identity Provider (IdP) — like LoginRadius, the IdP sets a third-party cookie when the user authenticates on your app.

\n

Web SSO

\n

If you have multiple apps across domains within your organization and authentication is handled using an IdP (internal or external) with web SSO, you already use third-party cookies to facilitate seamless access for each user using a single set of credentials.

\n

If you have implemented web SSO with one primary domain and multiple sub-domains of the primary domain, third-party cookie restrictions may not apply. For now, Google doesn’t consider the cookies set by sub-domains as third-party cookies, although this stance may change in the future.

\n

For example, you have apps at example.com, travel.example.com, stay.example.com, and web SSO is handled by auth.example.com. In this case, third-party cookie restrictions don’t apply.

\n

Federated SSO

\n

Federated SSO is similar to, albeit different from, web SSO. It can handle multiple IdPs and applications—aka., Service Providers (SPs)—spanning multiple organizations. It can also implement authentication scenarios that are usually implemented through web SSO.

\n

Usually, authentication is handled on a separate pop-up or page when the user wants to authenticate rather than on the application or website a user visits.

\n

For example, you already use federated SSO if you facilitate authentication for a set of apps through multiple social identity providers as well as traditional usernames and passwords.

\n
\n

Note: It is also possible to store tokens locally, not within cookies. In this case, third-party cookie restrictions won’t affect token-based authentication. However, the restrictions still affect authentication where tokens are stored within third-party cookies (a common and secure method).

\n
\n

Chrome’s Alternatives for Third-Party Cookies

\n

Google has been developing alternative features and capabilities for Chrome to replace third-party cookies as part of its Privacy Sandbox for Web initiative.

\n

Specific to authentication, Google recommends the following:

\n
    \n
  1. Cookies Having Independent Partitioned State (CHIPS)
    2. \n
  2. Storage Access API
    3. \n
  3. Related Website Sets
    4. \n
  4. Federated Credential Management (FedCM) API
    5. \n
\n

Cookies Having Independent Partitioned State (CHIPS)

\n

CHIPS are a restricted way of setting third-party cookies on a top-level site without making them accessible on other top-level sites. Thus, they limit cross-site tracking and enable specific cross-site functionalities, such as maps, chat, and payment embeds.

\n

For example, a user visits a.com with a map embed from map-example.com, which can set a partitioned cookie that is only accessible on a.com.

\n

If the user visits b.com with a map embed from map-example.com, it cannot access the partitioned cookie set on a.com. It has to create a separate partitioned cookie specific to b.com, thus blocking cross-site tracking yet allowing limited cross-site functionality.

\n

You should specifically opt for partitioned cookies (CHIPS), which are set with partitioned and secure cookie attributes.

\n

If you’re using an external identity provider for your application, CHIPS is a good option to supplant third-party cookie restrictions.

\n

However, CHIPS may not be ideal if you have a web SSO or federated SSO implementation. It creates separate partitioned cookies for each application with a separate domain, which can increase complexity and create compatibility issues.

\n

Storage Access API

\n

With Storage Access API, you can access the local storage in a third-party context through iframes, similar to when users visit it as a top-level site in a first-party context. That is, it gives access to unpartitioned cookies and storage.

\n

Storage Access API requires explicit user approval to grant access, similar to locations, camera, and microphone permissions. If the user denies access, unpartitioned cookies and storage won’t be accessible in a third-party context.

\n

It is most suitable when loading cross-site resources and interactions, such as:

\n

Verifying user sessions when allowing interactions on an embedded social post or providing personalization for an embedded video.\nEmbedded documents requiring user verification status to be accessible.

\n

As it requires explicit user approval, it is advisable to use Storage Access API when you can’t implement an identity use case with the other options.

\n

Related Website Sets

\n

With Related Website Sets, you can declare a primary website and associatedSites for limited purposes to grant third-party cookie access and local storage for a limited number of sites.

\n

Chrome automatically recognizes related website sets declared, accepted, and maintained in this open-source GitHub repository: Related Website Sets

\n

It provides access through Storage Access API directly without prompting for user approval, but only after the user interacts with the relevant iframe.

\n

It is important to declare a limited number of domains in related website sets that are meaningful and used for specific purposes. Google may block or suspend any exploitative use of this feature.

\n

The top-level site can also request approval for specific cross-site resources and scripts to Storage Access API using resuestStorageAccessFor() API.

\n

If you’re using an external identity provider for your web application, you can declare the domain of the identity provider in the related set to ensure limited third-party cookies and storage access to the identity provider, thus ensuring seamless user authentication.

\n

Related Website Sets can also work to supplement third-party cookie restrictions in web SSO and federated SSO if the number of web applications (or domains) is limited.

\n

Federated Credential Management (FedCM) API

\n

FedCM API enables federated SSO without third-party cookies.

\n

With FedCM API, a user follows these steps for authentication:

\n
    \n
  1. The User navigates to a Service Provider (SP) — aka., Relying Party (RP)
    2. \n
  2. As the user requests to authenticate, the SP requests the browser through FedCM API to initiate authentication.
    3. \n
  3. The browser displays a list of available identity providers (supported by the RP), such as social IdPs like Google, Apple, LinkedIn, and Facebook, or other OAuth IdPs like LoginRadius.
    4. \n
  4. Once the user selects an IdP, the browser communicates with the IdP. Upon valid authentication, the IdP generates a secure token.\nThe browser delivers this secure token to the RP to facilitate user authorization.
    5. \n
\n

You can access a user demo of FedCM here: FedCM.

\n

For more information about implementing federated SSO with FedCM API, go through the FedCM developer guide.

\n\n

Firstly, we’re committed to solving our customers' user identity pain points — and preparing for the third-party cookies phase-out is no different.

\n

We’ll implement the most relevant and widely useful solutions to facilitate a smooth transition for our customers.

\n

Please subscribe to our blog for more information. We’ll update you on how we help with the third-party cookie phase-out.

\n

In Conclusion

\n

The proposed changes to phase out third-party cookies and suggested alternatives are evolving as Google has been actively collaborating and discussing changes with the border community.

\n

Moreover, browsers like Firefox, Safari, and Edge may approach restricting third-party cookies differently than Google does.

\n

From LoginRadius, we’ll keep you updated on what we’re doing as a leading Customer Identity and Access Management (CIAM) vendor to prepare for the third-party cookie phase-out.

\n

Glossary

\n

Top-level site: It is the primary site a user has visited.

\n

First-party cookie: A cookie set by the top-level site.

\n

Third-party cookie: A cookie set by a domain other than the top-level site. For example, let’s assume that a user has visited a.com, which might use an embed from loginradius.com to facilitate authentication. If loginradius.com sets a cookie when the user visits a.com, it is called a third-party cookie as the user hasn’t directly visited loginradius.com.

\n

References

\n\n","frontmatter":{"date":"July 08, 2024","updated_date":null,"description":"Google Chrome has planned to phase out third-party cookies, which will affect different website functionalities depending on third-party cookies. This blog focuses on how this phase-out affects identity and user authentication and discusses alternatives for overcoming challenges.","title":"How Chrome’s Third-Party Cookie Restrictions Affect User Authentication?","tags":["Identity","Cookies","Chrome"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/eb7396060c0adc430dbed2d04b63d431/ee604/third-party-cookies-phaseout-chrome.png","srcSet":"/static/eb7396060c0adc430dbed2d04b63d431/69585/third-party-cookies-phaseout-chrome.png 200w,\n/static/eb7396060c0adc430dbed2d04b63d431/497c6/third-party-cookies-phaseout-chrome.png 400w,\n/static/eb7396060c0adc430dbed2d04b63d431/ee604/third-party-cookies-phaseout-chrome.png 800w,\n/static/eb7396060c0adc430dbed2d04b63d431/f3583/third-party-cookies-phaseout-chrome.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Raghunath Reddy","github":"raghunath-r-a","avatar":null}}}},"pageContext":{"limit":6,"skip":126,"currentPage":22,"type":"//engineering//","numPages":52,"pinned":"17fa0d7b-34c8-51c4-b047-df5e2bbaeedb"}},"staticQueryHashes":["1171199041","1384082988","2100481360","23180105","528864852"]}