101010.pl

Parrot SecurityParrotOS 6.4 is out now! 🔔This release sets the stage for Parrot 7 with upgraded tools, security fixes, and system improvements 🐦💻Upgrade via sudo parrot-upgrade or grab a fresh install from the official site 💡Click the link down below and read more on the changelog 🔗<a href="https://parrotsec.org/blog/2025-07-07-parrot-6.4-release-notes" rel="nofollow noopener" translate="no" target="_blank">https://parrotsec.org/blog/2025-07-07-parrot-6.4-release-notes</a><a href="https://mastodon.social/tags/ParrotSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#ParrotSec</a> <a href="https://mastodon.social/tags/ParrotOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#ParrotOS</a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://mastodon.social/tags/CybersecurityNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#CybersecurityNews</a> <a href="https://mastodon.social/tags/Hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hacking</a> <a href="https://mastodon.social/tags/PenTest" class="mention hashtag" rel="nofollow noopener" target="_blank">#PenTest</a> <a href="https://mastodon.social/tags/Pentesting" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pentesting</a> <a href="https://mastodon.social/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a> <a href="https://mastodon.social/tags/linuxdistro" class="mention hashtag" rel="nofollow noopener" target="_blank">#linuxdistro</a>

Jack RendorHi everyone! I recently released 3 blog posts! All of them are writeups on CTFs where I make some scripts and tools in bash and golang!I'll leave you the link of the blog posts and if you have any suggestions or interact with me, don't hesitate to comment or DM me! I hope you all can enjoy reading them!<a href="https://blog.jackrendor.dev/posts/tryhackme-securityfootage/" rel="nofollow noopener" translate="no" target="_blank">https://blog.jackrendor.dev/posts/tryhackme-securityfootage/</a><a href="https://blog.jackrendor.dev/posts/tryhackme-bugged/" rel="nofollow noopener" translate="no" target="_blank">https://blog.jackrendor.dev/posts/tryhackme-bugged/</a><a href="https://blog.jackrendor.dev/posts/tryhackme-eavesdropper/" rel="nofollow noopener" translate="no" target="_blank">https://blog.jackrendor.dev/posts/tryhackme-eavesdropper/</a><a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://infosec.exchange/tags/penetrationtest" class="mention hashtag" rel="nofollow noopener" target="_blank">#penetrationtest</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/informationsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#informationsecurity</a> <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#redteam</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/bash" class="mention hashtag" rel="nofollow noopener" target="_blank">#bash</a> <a href="https://infosec.exchange/tags/golang" class="mention hashtag" rel="nofollow noopener" target="_blank">#golang</a>

LMG SecurityHundreds of Brother printer models are affected by a critical, unpatchable vulnerability (CVE-2024-51978) that allows attackers to generate the default admin password using the device’s serial number—information that’s easily discoverable via other flaws.748 total models across Brother, Fujifilm, Ricoh, Toshiba, and Konica Minolta are impacted, with millions of devices at risk globally.Attackers can: • Gain unauthenticated admin access • Pivot to full remote code execution • Exfiltrate credentials for LDAP, FTP, and more • Move laterally through your networkBrother says the vulnerability cannot be fixed in firmware and requires a change in manufacturing. For now, mitigation = change the default admin password immediately.Our pentest team regularly highlights printer security as a critical path to system compromise—and today’s news is another example that underscores this risk. This is your reminder: Printers are not “set-and-forget” devices. Treat them like any other endpoint—monitor, patch, and lock them down.Need help testing your network for exploitable print devices? Contact us and our pentest team can help!Read the Dark Reading article for more details on the Brother Printers vulnerability: <a href="https://www.darkreading.com/endpoint-security/millions-brother-printers-critical-unpatchable-bug" rel="nofollow noopener" translate="no" target="_blank">https://www.darkreading.com/endpoint-security/millions-brother-printers-critical-unpatchable-bug</a><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/PenetrationTesting" class="mention hashtag" rel="nofollow noopener" target="_blank">#PenetrationTesting</a> <a href="https://infosec.exchange/tags/Pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pentest</a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pentesting</a> <a href="https://infosec.exchange/tags/PrinterSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#PrinterSecurity</a> <a href="https://infosec.exchange/tags/BrotherPrinters" class="mention hashtag" rel="nofollow noopener" target="_blank">#BrotherPrinters</a> <a href="https://infosec.exchange/tags/CVE202451978" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE202451978</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/IT" class="mention hashtag" rel="nofollow noopener" target="_blank">#IT</a> <a href="https://infosec.exchange/tags/SMB" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMB</a> <a href="https://infosec.exchange/tags/CISO" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISO</a> <a href="https://infosec.exchange/tags/Cyberaware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cyberaware</a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#ITSecurity</a> <a href="https://infosec.exchange/tags/ZeroTrust" class="mention hashtag" rel="nofollow noopener" target="_blank">#ZeroTrust</a> <a href="https://infosec.exchange/tags/PatchNow" class="mention hashtag" rel="nofollow noopener" target="_blank">#PatchNow</a> <a href="https://infosec.exchange/tags/Pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pentest</a>

Who Let The Dogs Out 🐾Discover 12 AI Tools to automate your pentest and cybersecurity audits-3 🧠⚔ <a href="https://mastodon.ml/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://mastodon.ml/tags/tool" class="mention hashtag" rel="nofollow noopener" target="_blank">#tool</a> <a href="https://mastodon.ml/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://mastodon.ml/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://mastodon.ml/tags/audit" class="mention hashtag" rel="nofollow noopener" target="_blank">#audit</a>11. 📉 Garak (<a href="https://github.com/NVIDIA/garak" rel="nofollow noopener" translate="no" target="_blank">https://github.com/NVIDIA/garak</a>) NVIDIA’s tool for red-teaming and probing LLMs, designed to test model safety, robustness, and leakage. 12. 🧭 Auto Recon LLM (<a href="https://github.com/CyberSecurityUP/auto-recon-llm" rel="nofollow noopener" translate="no" target="_blank">https://github.com/CyberSecurityUP/auto-recon-llm</a>) Automates the reconnaissance phase using LLMs to interpret recon output and make tactical decisions.

Who Let The Dogs Out 🐾Discover 12 AI Tools to automate your pentest and cybersecurity audits-2 🧠⚔ <a href="https://mastodon.ml/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://mastodon.ml/tags/tool" class="mention hashtag" rel="nofollow noopener" target="_blank">#tool</a> <a href="https://mastodon.ml/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://mastodon.ml/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://mastodon.ml/tags/audit" class="mention hashtag" rel="nofollow noopener" target="_blank">#audit</a>6. 🧩 Nuclei AI Extension (<a href="https://github.com/projectdiscovery/nuclei-ai-extension" rel="nofollow noopener" translate="no" target="_blank">https://github.com/projectdiscovery/nuclei-ai-extension</a>) Official extension for Nuclei that uses AI to suggest and create new detection templates from HTTP responses. 7. 💣 HackGPT (<a href="https://github.com/NoDataFound/hackGPT" rel="nofollow noopener" translate="no" target="_blank">https://github.com/NoDataFound/hackGPT</a>) A GPT-powered hacking CLI to assist with payload crafting, bypass techniques, and offensive scripting. 8. 🛡 AutorizePro (<a href="https://github.com/WuliRuler/AutorizePro" rel="nofollow noopener" translate="no" target="_blank">https://github.com/WuliRuler/AutorizePro</a>) Authorization fuzzing tool with GPT integration to generate smarter test cases and detect access control issues. 9. ☁ CloudGPT (<a href="https://github.com/ustayready/cloudgpt" rel="nofollow noopener" translate="no" target="_blank">https://github.com/ustayready/cloudgpt</a>) Uses GPT to identify misconfigurations and vulnerabilities in cloud environments like AWS, GCP, and Azure. 10. 📦 K8sGPT (<a href="https://github.com/k8sgpt-ai/k8sgpt/" rel="nofollow noopener" translate="no" target="_blank">https://github.com/k8sgpt-ai/k8sgpt/</a>) Diagnoses misconfigurations and vulnerabilities in Kubernetes clusters, explained in natural language via LLMs.

Who Let The Dogs Out 🐾Discover 12 AI Tools to automate your pentest and cybersecurity audits-1 🧠⚔ <a href="https://mastodon.ml/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://mastodon.ml/tags/tool" class="mention hashtag" rel="nofollow noopener" target="_blank">#tool</a> <a href="https://mastodon.ml/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://mastodon.ml/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://mastodon.ml/tags/audit" class="mention hashtag" rel="nofollow noopener" target="_blank">#audit</a>1. 🧠 PentestGPT (<a href="https://github.com/GreyDGL/PentestGPT" rel="nofollow noopener" translate="no" target="_blank">https://github.com/GreyDGL/PentestGPT</a>) LLM-based tool that simulates a step-by-step penetration testing process, emulating a realistic attack workflow. 2. 🤖 Auto-Pentest-GPT-AI (<a href="https://github.com/Armur-Ai/Auto-Pentest-GPT-AI" rel="nofollow noopener" translate="no" target="_blank">https://github.com/Armur-Ai/Auto-Pentest-GPT-AI</a>) An AI-powered framework using GPT-4 to perform automated pentests with logical, chain-of-thought exploration. 3. 🔍 BurpGPT (<a href="https://github.com/aress31/burpgpt" rel="nofollow noopener" translate="no" target="_blank">https://github.com/aress31/burpgpt</a>) A Burp Suite extension that integrates GPT to analyze requests/responses and suggest payloads or detect vulnerabilities. 4. 🌐 ReconAIzer (<a href="https://github.com/hisxo/ReconAIzer" rel="nofollow noopener" translate="no" target="_blank">https://github.com/hisxo/ReconAIzer</a>) An AI-driven reconnaissance assistant using GPT-4 to interpret recon tool results and recommend next steps. 5. 🔐 PassGAN (<a href="https://github.com/brannondorsey/PassGAN" rel="nofollow noopener" translate="no" target="_blank">https://github.com/brannondorsey/PassGAN</a>) A generative adversarial network trained to generate real-world passwords based on leaked data — a smart brute-force ally.

r1cksecA collection of over 1000 Git repositories with tools for IT security/infosec. Caution, there will be malware🕵️‍♂️ <a href="https://github.com/r1cksec/cheatsheets/blob/main/url/git-tools" rel="nofollow noopener" translate="no" target="_blank">https://github.com/r1cksec/cheatsheets/blob/main/url/git-tools</a><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#redteam</a> <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a>

dan_nanniPython offers a rich set of libraries for penetration testing, enabling tasks like network scanning, exploit development, web vulnerability analysis, and payload generationHere are useful <a href="https://mastodon.social/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a> libraries for pentesters 😎👇 <a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://mastodon.social/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a>Find high-res pdf books with all my <a href="https://mastodon.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> related infographics at <a href="https://study-notes.org" rel="nofollow noopener" translate="no" target="_blank">https://study-notes.org</a>

LMG SecurityAI-powered features are the new attack surface! Check out our new blog in which LMG Security’s Senior Penetration Tester Emily Gosney <a href="https://infosec.exchange/@baybedoll" class="u-url mention" rel="nofollow noopener" target="_blank">@baybedoll</a> shares real-world strategies for testing AI-driven web apps against the latest prompt injection threats.From content smuggling to prompt splitting, attackers are using natural language to manipulate AI systems. Learn the top techniques—and why your web app pen test must include prompt injection testing to defend against today’s AI-driven threats.Read now: <a href="https://www.lmgsecurity.com/are-your-ai-backed-web-apps-secure-why-prompt-injection-testing-belongs-in-every-web-app-pen-test/" rel="nofollow noopener" translate="no" target="_blank">https://www.lmgsecurity.com/are-your-ai-backed-web-apps-secure-why-prompt-injection-testing-belongs-in-every-web-app-pen-test/</a><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/PromptInjection" class="mention hashtag" rel="nofollow noopener" target="_blank">#PromptInjection</a> <a href="https://infosec.exchange/tags/AIsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#AIsecurity</a> <a href="https://infosec.exchange/tags/WebAppSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebAppSecurity</a> <a href="https://infosec.exchange/tags/PenetrationTesting" class="mention hashtag" rel="nofollow noopener" target="_blank">#PenetrationTesting</a> <a href="https://infosec.exchange/tags/LLMvulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#LLMvulnerabilities</a> <a href="https://infosec.exchange/tags/Pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pentest</a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://infosec.exchange/tags/CISO" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISO</a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pentesting</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/ITsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#ITsecurity</a>

Mike ShewardMini Pen Test Diaries Story:During the open source enumeration phase of an external footprint test, I found a virtual machine that bore the name of the client in its NetBIOS response in Shodan.Connecting to the machine over HTTP, I found a web app that was very relevant to the industry of the client - so I knew it was likely related.The strange thing, however, was that Shodan was telling me NetBIOS and SMB were open (that’s how I found the machine in the first place), but I was unable to connect to it over SMB. Port scan showed closed.I needed to figure out why Shodan was telling me one thing, but my reality was different.The machine was hosted in Azure, so I figured I’d try rerunning my port scan from a source IP in my own Azure account, to see if I’d get a different result.Sure enough, SMB was open when scanned from an Azure machine. They’d opened it up to any IP in Azure. No auth. Just an open file share accessible to anyone who was connecting to it from an Azure public source IP.I reported it, and it turned out that the machine was hosted by a vendor on behalf of the client.The vendor was insistent that my description of “public access to SMB share” was wrong, since technically it wasn’t open to the internet - just to Azure.I then pointed out that hey, Azure is a famous example of a “public” cloud for a reason.They fixed it.Lesson: always try from different perspectives - such as from within the same providers IP space, you might find what I found.For more, slightly less mini stories like this ones check out <a href="https://infosecdiaries.com" rel="nofollow noopener" translate="no" target="_blank">https://infosecdiaries.com</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentesting</a>

dan_nanniExplore these free cybersecurity services to scan threats, check exposures, and boost your digital security—no login required 😎👇 <a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://mastodon.social/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://mastodon.social/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://mastodon.social/tags/securitybreach" class="mention hashtag" rel="nofollow noopener" target="_blank">#securitybreach</a> Find high-res pdf books with all my <a href="https://mastodon.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> infographics at <a href="https://study-notes.org" rel="nofollow noopener" translate="no" target="_blank">https://study-notes.org</a>

0x40kBrowser extensions... seriously? 🤯 Think of 'em like little backdoors straight into your systems.Sure, things like spellcheckers and handy AI tools seem convenient, right? But the permissions they often demand? Honestly, it's often insane. 😵‍💫Look, as a pentester, I strike gold with these *all the time*! 💰 We're talking cookies, passwords, browsing habits – sometimes it's all just wide open. And *then* people are shocked when they get hacked. 🤷‍♂️Yeah, security awareness training definitely matters. But here’s what’s even more critical: you absolutely *need* to know which extensions your team is actually using! Go on, check those permissions thoroughly! Otherwise, you're just asking for trouble down the line. 💥So, spill the beans: Which browser extension has given *you* a major headache before? Let's hear it!<a href="https://infosec.exchange/tags/ITSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#ITSec</a> <a href="https://infosec.exchange/tags/Pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pentest</a> <a href="https://infosec.exchange/tags/BrowserSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#BrowserSecurity</a> <a href="https://infosec.exchange/tags/SecurityFirst" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityFirst</a>

0x40kWhoa, just checked out the latest GitGuardian report. It's wild how many secrets popped up *again*! 😳 We're talking millions of credentials just floating around out there.And here's the kicker: it's not *only* about human slip-ups anymore. You've got more and more 'Non-Human Identities' (NHIs) – think bots, scripts, AI agents – churning out secrets too. And honestly? Those NHI secrets often get way less attention than the ones people handle.As a pentester, I bump into this constantly. Find an old, forgotten API key lying around, and *boom* – system's compromised. 🤦‍♂️ Yeah, automated scans are definitely helpful, but nothing beats having solid secrets management in place. It's absolutely crucial.So, how's everyone else keeping their secrets locked down? Got any killer best practices to share?<a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://infosec.exchange/tags/Pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pentest</a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#DevSecOps</a> <a href="https://infosec.exchange/tags/SecretsManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecretsManagement</a>

0x40kSeriously, the Outlaw botnet? Still pulling off SSH brute-force attacks in 2024?! Wild how that's *still* getting results. It really just hammers home the point: the fundamentals are absolutely crucial!You've gotta have solid password habits locked down. Things like key authentication, maybe changing the default SSH port, setting up Fail2ban... c'mon, it isn't exactly brain surgery, right?But yeah, setting it up takes a bit of effort, doesn't it? And we all know time equals money...Working as a pentester, I see it way too often – companies cutting corners precisely on these foundational steps. They'd rather splash out on flashy AI security tools, yet leave the digital front door practically wide open. Then, inevitably, everyone acts shocked when things go sideways.So, I gotta ask: What "basic" security measures do you see getting consistently overlooked where you work? 🤔<a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://infosec.exchange/tags/ssh" class="mention hashtag" rel="nofollow noopener" target="_blank">#ssh</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/basics" class="mention hashtag" rel="nofollow noopener" target="_blank">#basics</a>

0x40kWhoa, check this out! Head Mare and Twelve are teaming up! 🤯 Two threat groups joining forces... sounds like things are about to get real.And guess what? The WinRAR exploit (CVE-2023-38831) and Exchange (ProxyLogon) are *still* being used. Seriously, folks, patch your systems! 🤦♂️ Phishing and supply chain attacks are still a major problem too.This reminds me of a pentest where we almost missed the forest for the trees. You know, sometimes it's the simple stuff that makes all the difference.So, what's the takeaway here? 🤔 Patch everything, harden your systems, train your employees, and audit those supply chains! Oh, and network segmentation? It's worth its weight in gold! Don't overlook it!I'm curious, what's the craziest security blunder you've ever witnessed firsthand? Spill the beans! 👇<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a>

0ddj0bbHey <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#redteam</a> and <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> ers, what security controlsnon endpoints and servers make your life miserable on an engagement? App allow listing? DEP? Powershell execution policies? Hostbased firewall?<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/cyber" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyber</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#dfir</a>

0x40kAttack graphs, cool stuff, right? 😎 They basically map out potential attack pathways into your network. Think of it as an interactive GPS, but for cyber attackers navigating your system.A lot of folks figure a simple pentest is enough... Wrong! Attack graphs are way more dynamic. They show you the possible attack paths *before* an incident even happens. It’s preventative pentesting, essentially. 🤓Here's a crucial point: don't *just* look at CVSS scores! Attack graphs reveal which vulnerabilities are truly dangerous *because* they can be chained together. *That's* where the real value lies! 🔥So, are you already leveraging attack graphs? Or are you sticking with more traditional vulnerability scans? 🤔<a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://infosec.exchange/tags/attackgraph" class="mention hashtag" rel="nofollow noopener" target="_blank">#attackgraph</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a>

0x40kHey Android folks, listen up! 👀 Google just dropped a crucial security update that you seriously need to check out. It might just be relevant to your phone. Word on the street is, two of the patched vulnerabilities are already being exploited in the wild. Crazy, right? 😬This reminds me of those chats I have with clients: "So, Android's secure, yeah?" Well... Privilege Escalation basically means an attacker can snag more permissions on your device. In short: hackers can potentially grab your data! 😱They've squashed a whopping 44 vulnerabilities in this March update. CVE-2024-43093 & CVE-2024-50302 are seriously critical. Apparently, CVE-2024-50302 was even leveraged by Cellebrite to get into an activist's phone. Wild stuff! 😳Go ahead and check your Android version and smash that update button ASAP (look for 2025-03-01 or 2025-03-05)! Also, be extra careful with apps from sources you don't know. Regular security checks are a must, even on your smartphone.Have you already installed the update? Any thoughts or experiences with Android security? 🤔<a href="https://infosec.exchange/tags/AndroidSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#AndroidSecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a>

Shawn Hooper (he/him)Looking for a good Canadian pen tester for a web application. Specifically one who bills in CAD. Any recommendations? <a href="https://fosstodon.org/tags/appsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#appsec</a> <a href="https://fosstodon.org/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#pentest</a> <a href="https://fosstodon.org/tags/canada" class="mention hashtag" rel="nofollow noopener" target="_blank">#canada</a>

buheratorThis is a pretty good summary of <a class="hashtag" href="https://infosec.place/tag/pentest" rel="nofollow noopener" target="_blank">#pentest</a> as a profession: <a href="https://www.reddit.com/r/Pentesting/comments/1ixoq2g/pentesting_is_the_hardest_cybersecurity/" rel="nofollow noopener" target="_blank">https://www.reddit.com/r/Pentesting/comments/1ixoq2g/pentesting_is_the_hardest_cybersecurity/</a> (I don't think comparisons to other fields makes much sense though)

Recent searches

Search options

Administered by:

Server stats:

#pentest