ONSEC.io Pentesting blog

ONSEC: Boutique Penetration Testing Agency

Sign in Subscribe

Latest

Cyber Daily 2/21: Ghost Ransomware Threatens 70+ Nations, CISA Warns of SonicWall and Palo Alto Bugs, Europe's Cyber Vulnerability Exposed, Microsoft and NVIDIA Patch Critical Flaws

Cyber Daily 2/21: Ghost Ransomware Threatens 70+ Nations, CISA Warns of SonicWall and Palo Alto Bugs, Europe's Cyber Vulnerability Exposed, Microsoft and NVIDIA Patch Critical Flaws

Welcome to your daily dose of ONSEC Cyber Daily. Today, we're diving into the chilling world of Ghost Ransomware. The National Law Review has released a joint cybersecurity advisory on this menacing threat that's exploiting vulnerabilities in over 70 countries. The Cybersecurity and Infrastructure Security Agency

Cyber Daily 2/20: Ghost/Cring Ransomware Alert by FBI, CISA; Insight Partners Cyberattack; Palo Alto, SonicWall Vulnerabilities; Weak Passwords Warning; Cybersecurity Podcast Highlights

Cyber Daily 2/20: Ghost/Cring Ransomware Alert by FBI, CISA; Insight Partners Cyberattack; Palo Alto, SonicWall Vulnerabilities; Weak Passwords Warning; Cybersecurity Podcast Highlights

Cyber Daily 2/18: CISA Alerts on Apple iOS and Buffer Overflow Exploits, Android Follows iPhone's Security Steps, US Treasury Targeted via PostgreSQL, SonicWall Firewalls Under Attack

Cyber Daily 2/18: CISA Alerts on Apple iOS and Buffer Overflow Exploits, Android Follows iPhone's Security Steps, US Treasury Targeted via PostgreSQL, SonicWall Firewalls Under Attack

Cyber Daily 2/14: Palo Alto Networks Patches PAN-OS Exploit, CISA & FBI Alert on Buffer Overflow Vulnerabilities, US Coast Guard Urged to Strengthen Cybersecurity, FedEx Warns of New Scams

Cyber Daily 2/14: Palo Alto Networks Patches PAN-OS Exploit, CISA & FBI Alert on Buffer Overflow Vulnerabilities, US Coast Guard Urged to Strengthen Cybersecurity, FedEx Warns of New Scams

Cyber Daily 2/13: CISA, FBI Warn of Buffer Overflow Threats, Google Chrome's 'Syncjacking' Attack, Apple's Global Security Update, SonicWall VPN Hijacking Risk, US Ports Vulnerable to Cyber Attacks

Cyber Daily 2/13: CISA, FBI Warn of Buffer Overflow Threats, Google Chrome's 'Syncjacking' Attack, Apple's Global Security Update, SonicWall VPN Hijacking Risk, US Ports Vulnerable to Cyber Attacks

Cyber Daily 2/12: Fortinet's Zero-Day Warning, OpenSSL Vulnerability, Apple's iPhone Security Breach, Solar Power Cyberattacks, Microsoft's Urgent Patch

Cyber Daily 2/12: Fortinet's Zero-Day Warning, OpenSSL Vulnerability, Apple's iPhone Security Breach, Solar Power Cyberattacks, Microsoft's Urgent Patch

Cyber Daily 2/11: Ubuntu and Skibidi Vulnerabilities, UK's New Cyberattack Scale, Swiss Aviation Warnings, Apple and Trimble Patches, Podcast Insights

Cyber Daily 2/11: Ubuntu and Skibidi Vulnerabilities, UK's New Cyberattack Scale, Swiss Aviation Warnings, Apple and Trimble Patches, Podcast Insights

pentest

TCP Tarpit and Port Scanning. Barricades on Both Sides.

TCP Tarpit and Port Scanning. Barricades on Both Sides.

Introduction Thousands of articles have been written about port scanning, discussing techniques, methodologies, tools... Yet, even in such a seemingly straightforward topic, there are several less-covered nuances. If you regularly scan subnets, participate in bug bounties, perform penetration testing, or automate this process, then this article might be useful to

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

Sandbox escape or How to catch all servers of the company

Sandbox escape or How to catch all servers of the company

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Getting ready for your first pentest: startup founders guide

Getting ready for your first pentest: startup founders guide

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

rceexploit

Deep Dive into the CVE-2022-29464 RCE exploit

Deep Dive into the CVE-2022-29464 RCE exploit

WSO2 is the leading API Management solution company. It provides various software products for connecting, managing, and securing APIs (Application Programming Interfaces). Organizations in various industries, including financial services, healthcare, government, telecommunications, and retail, use WSO2 products. In April 2022, security researchers recently found a critical vulnerability in certain WSO2

compliance

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

The multitude of guidelines and regulations can be overwhelming, especially when it comes to understanding the penetration testing requirements for each. Determining what each compliance standard requires from a penetration test can be a headache, but it's crucial to get it right. To simplify the process, we'