2 min read
Common IoT Device Vulnerabilities in 2023
The same weaknesses turn up in connected device after connected device. Default credentials, exposed debug interfaces, unsigned firmware, and plaintext traffic.
Read the post →Blog — page 7
Research and analysis
The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
113 posts
- 4 min read
The Importance of Comprehensive IoT Penetration Testing in Modern Cybersecurity
A connected device is a network host, a radio, a mobile app, and a cloud API at once. Why partial IoT testing misses the paths that actually get exploited.
Read the post → - 3 min read
Shodan Series Part 2: The Untraditional Web Ports
Moving a service off port 443 hides it from nobody. Why non-standard web ports are indexed anyway, and what to do about the ones you did not know were open.
Read the post → - 3 min read
The Power of Password Complexity
Password complexity rules help, right up to the point they push people into predictable patterns. What actually resists cracking, and how to prove it.
Read the post → - 3 min read
Not All Penetration Tests Are Created Equally
Two engagements with the same name can differ enormously in depth. What separates a real penetration test from an automated scan with a report attached.
Read the post → - 2 min read
IIS Short File Name Enumeration
A twenty-year-old IIS quirk still leaks file and directory names to anyone who asks. How the enumeration works, whether it still matters, and how to stop it.
Read the post → - 4 min read
Shodan Series Part 1: The Accidental Open Door
Port 3389 exposed to the internet is remote desktop left unlocked. What Shodan shows an attacker about your network before a single packet is sent to it.
Read the post → - 8 min read
Even More MobSF – Mobile Application Penetration Testing #4
The last of our MobSF coverage: browsable activities, network security config, certificate analysis, and where the automated report stops being useful.
Read the post → - 3 min read
Penetration Testing for Small Businesses: Why It’s Crucial and How to Get Started
Being small is not protection; it makes you a cheaper target. Why smaller organizations get tested less, and a practical route to a first engagement.
Read the post → - 4 min read
Software and Data Integrity Failures – OWASP Top Ten
Trusting an update, a package, or a pipeline you cannot verify is its own vulnerability class. Integrity controls, with the supply chain breaches that prove it.
Read the post →