Search • Page 2/9

103 results for "unauthorized access"

Year in review: 2024 on Pentest-Tools.com

🚀 2024 was one for the books at Pentest-Tools.com! Here are our customers' favorites and what made our year!

Author(s)

Andra Zaharia

Published at: 24 Dec 2024

Cross-site WebSocket hijacking: understanding and exploiting CSWSH

This is an example of why it's worth taking a look in all the "boring" places (think RFC). They just might help you find the vulnerability you've been searching for!

Author(s)

Sacha Iakovenko

Published at: 30 Oct 2024

How and why we built the Kubernetes Vulnerability Scanner

We began developing the Kubernetes Scanner with a focus on black and gray box remote scanning scenarios, as these are the most common among bug bounty hunters, pentesters, and red-teamers. We believe our Kubernetes Vulnerability Scanner is a state of the art improvement for its category of tools, but we don’t plan to stop here. We have a range of improvements in mind, from new detections and exploits to better integrations with other tools that will make this scanner an even more important asset for our customers.

Author(s)

David Bors

Published at: 27 Sep 2024

70+ hacking books to level up your skills and thinking

What you feed your mind gets reflected in your choices. We curated a list of books that can get focus your energy on your next big challenge, get you out of a rut, or give you the space you need to tinker with your next project.

Author(s)

Published at: 08 Jul 2024

12 essential ethical hacking newsletters to read

To help you find the signal in the noise, I’ve curated the top 12 ethical hacking newsletters to fuel your personal and career growth. Dig into what makes them special and the top 3 resources we cherry-picked from each.

Author(s)

Ioana Rijnetu

Published at: 06 Jun 2024

How these vulnerabilities pushed offensive security forward

Not all vulnerabilities are alike. Some are true game-changers, uncovering new possibilities, and more layers of complexity to explore. Let’s look at what five of the most notorious vulnerabilities from the past decade taught us - and how they shaped the infosec community.

Author(s)

Kelyan Yesil

Published at: 04 Jun 2024

web app vulnerability scanners benchmark

Benchmarking our Website Vulnerability Scanner and 5 others

In February 2024, we set out to compare our Website Vulnerability Scanner against some of the established names in Dynamic Web Application Security Testing, both commercial and open-source: Burp Scanner, Acunetix, Qualys, Rapid7 InsightAppSec, and ZAP.

Author(s)

Alexandru Postolache

Published at: 30 May 2024

Network vulnerability scanners benchmark

Benchmarking our Network Vulnerability Scanner and 6 others

In January 2024, we decided to evaluate the most used network vulnerability scanners - Nessus Professional, Qualys, Rapid7 Nexpose, Nuclei, OpenVAS, and Nmap vulnerability scripts - including our own, which industry peers can validate independently. Here’s why we did it, what results we got, and how you can verify them (there’s a white paper you can download with access to all the results behind this benchmark).

Author(s)

Daniel Bechenea

Published at: 23 May 2024

8 effective strategies for building trust in ethical hacking engagements

What does it take to build authentic trust and have a collaborative relationship with your customers? How do you help them create meaningful change in their organization? Which specific actions do you take to make an impact in how they tackle security issues? If you’ve wrestled with these questions, we created this educational guide to help you get more clarity and cultivate meaningful relationships with your customers. Empathy, honesty, clear communication, and understanding clients’ specific needs are some of the most effective strategies offensive security pros use to nurture these relationships with intent.

Author(s)

Ioana Rijnetu

Published at: 11 Apr 2024

We think we know hackers thrive on deep environment knowledge

“Not everything works as configured. Not everyone behaves as trained.” The reality of this statement makes it possible for us, the people in offensive security, to have a job. It also highlights how unpredictable our work can be and how never-ending our learning process is. We work in a space where things are so complex that we need to combine big-picture, higher-level thinking with boost-on-the-ground practice. And our guest today is brilliant at doing just that.

Author(s)

Published at: 09 Apr 2024

CVE-2024-3094 - The XZ Utils Backdoor, a critical SSH vulnerability in Linux

The SSH backdoor would allow remote unauthenticated attackers to achieve remote code execution on the infected systems bypassing the authentication in place. From the information available at the time of writing, the backdoor seems to work only on GNU Linux x86/64 when the SSH server is run as a service by Systemd. Moreover, the library should have been installed by a packet manager. For the exploit to work, one should also expose the SSH server to the Internet so the attacker can interact remotely with it.

Author(s)

David Bors

Published at: 02 Apr 2024

Gabrielle Botbol guest for We think we know

We think we know you can't attack what you don't understand

Gabrielle isn't just a pentester; she's a powerhouse of knowledge, an advocate for cyber education, and a mentor shaping the future of ethical hacking. With 9+ years of experience in cybersecurity, she focuses on sharing it with her community members through practical and valuable resources. In this episode, we continue to ask the meaningful questions: What makes a great pentester? How can you balance the art of manual testing with the efficiency of automation? What is the unique value that pentesters bring to offensive security? And what can't be commoditized in this craft?

Author(s)

Published at: 26 Mar 2024