2 min read
JavaScript Source Map Vulnerabilities
Source maps hand an attacker your original, unminified code including comments and endpoints. How to check whether yours are public, and what to do next.
Read the post →Blog — page 6
Research and analysis
The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
116 posts
- 2 min read
Penetration Testing Findings: Exposed Non-Production Environments
Staging and QA environments hold production data and get a fraction of the hardening. Why they keep appearing in findings, and how to get them off the internet.
Read the post → - 5 min read
IoT Penetration Testing Part 1
IoT testing starts with a screwdriver. Part one covers the hardware toolkit — SOIC clips, jumper wires, pin headers — needed before any device comes apart.
Read the post → - 4 min read
MouseJacking (With Flipper Zero): Tales from Pen Testing Trenches
We compromised a network through a wireless mouse dongle using a Flipper Zero. An old attack vector, still unpatched, still sitting on plenty of desks.
Read the post → - 3 min read
The Ultimate Guide to Protecting Your Business from Phishing Scams
Phishing works on people, not systems, which is why filters alone never finish the job. Training, technical controls, and testing that reflects real attacks.
Read the post → - 2 min read
Tales from Pen Testing Trenches: MAC Address Whitelisting Failure
MAC address whitelisting is treated as a control. On a recent wireless engagement we were past it in minutes, and here is exactly how that went.
Read the post → - 2 min read
Different Types of Penetration Testing: A Comprehensive Guide
Network, web, mobile, API, IoT, wireless, physical, and social engineering. What each type of penetration testing covers, and when you need which one.
Read the post → - 3 min read
Penetration Testing 101: What Every Business Owner Should Know
A plain-language introduction for business owners: what a penetration test is, how it is run, and what you should expect to receive when it is finished.
Read the post → - 3 min read
Risks of Storing Passwords in BitBucket Repositories
Secrets committed to Bitbucket stay in the history long after the file is deleted. Why repositories leak credentials, and how to scan for them properly.
Read the post → - 3 min read
The Risks of Storing Passwords in SharePoint
SharePoint is a credential goldmine on internal engagements, because somebody always uploaded the spreadsheet. How we find them, and how to clear them out.
Read the post →