ONSEC.io Pentesting blog

ONSEC: Boutique Penetration Testing Agency

Sign in Subscribe

Latest

Cyber Daily 11/20: Google's 20-Year-Old Flaw, Apple's Zero-Day Attack, Vulnerable Water Utilities, Oracle's Agile PLM Exploited

Cyber Daily 11/20: Google's 20-Year-Old Flaw, Apple's Zero-Day Attack, Vulnerable Water Utilities, Oracle's Agile PLM Exploited

Welcome to the ONSEC Cyber Daily for November 20th. Today, we're diving into a whirlwind of cyber threats and vulnerabilities that have been making headlines. First up, Google has confirmed a critical 20-year-old security flaw, which it's addressing using a new Fuzzy AI. This AI-powered fuzzing

Cyber Daily 11/19: Ionix's Cloud Exposure Validator, PTA's PHP Vulnerability Alert, VMware and Palo Alto's Critical Flaws, Czech Banks on Cyber Alert

Cyber Daily 11/19: Ionix's Cloud Exposure Validator, PTA's PHP Vulnerability Alert, VMware and Palo Alto's Critical Flaws, Czech Banks on Cyber Alert

Cyber Daily 11/18: Palo Alto's Zero-Day Firewall Bug, Hong Kong's Cybersecurity Drill, Arkansas' Cyber Insurance Need, Five Eyes Alliance's Top Vulnerabilities, MSSP Market Update, NCSC's Black Friday Warning

Cyber Daily 11/18: Palo Alto's Zero-Day Firewall Bug, Hong Kong's Cybersecurity Drill, Arkansas' Cyber Insurance Need, Five Eyes Alliance's Top Vulnerabilities, MSSP Market Update, NCSC's Black Friday Warning

Cyber Daily 11/16: Microsoft Halts Security Updates, DEEPDATA Malware Targets Fortinet, GeoVision Devices Exploited by Botnet, Palo Alto Faces Multiple Exploits

Cyber Daily 11/16: Microsoft Halts Security Updates, DEEPDATA Malware Targets Fortinet, GeoVision Devices Exploited by Botnet, Palo Alto Faces Multiple Exploits

Cyber Daily 11/15: US EPA Flags Cybersecurity Risks in Water Systems, CISA Reports Rising Zero-Days, Vietnam Strengthens Cybersecurity with CISA, Palo Alto and Cisco Face Critical Vulnerabilities

Cyber Daily 11/15: US EPA Flags Cybersecurity Risks in Water Systems, CISA Reports Rising Zero-Days, Vietnam Strengthens Cybersecurity with CISA, Palo Alto and Cisco Face Critical Vulnerabilities

Cyber Daily 11/14: UK, Five Eyes Warn of Rising Zero-Day Exploits, CyberFirst at Kunoichi Games, Microsoft Patches CVE-2024-43451, D-Link Refuses to Patch Older Modems

Cyber Daily 11/14: UK, Five Eyes Warn of Rising Zero-Day Exploits, CyberFirst at Kunoichi Games, Microsoft Patches CVE-2024-43451, D-Link Refuses to Patch Older Modems

Cyber Daily 11/13: Microsoft's Patch Tuesday Fixes 91 Flaws, Zero-Day Cyberattacks Surge, Chrome Warns 3.2B Users, UK and Allies Highlight Cyber Vulnerabilities

Cyber Daily 11/13: Microsoft's Patch Tuesday Fixes 91 Flaws, Zero-Day Cyberattacks Surge, Chrome Warns 3.2B Users, UK and Allies Highlight Cyber Vulnerabilities

pentest

TCP Tarpit and Port Scanning. Barricades on Both Sides.

TCP Tarpit and Port Scanning. Barricades on Both Sides.

Introduction Thousands of articles have been written about port scanning, discussing techniques, methodologies, tools... Yet, even in such a seemingly straightforward topic, there are several less-covered nuances. If you regularly scan subnets, participate in bug bounties, perform penetration testing, or automate this process, then this article might be useful to

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

Sandbox escape or How to catch all servers of the company

Sandbox escape or How to catch all servers of the company

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Getting ready for your first pentest: startup founders guide

Getting ready for your first pentest: startup founders guide

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

rceexploit

Deep Dive into the CVE-2022-29464 RCE exploit

Deep Dive into the CVE-2022-29464 RCE exploit

WSO2 is the leading API Management solution company. It provides various software products for connecting, managing, and securing APIs (Application Programming Interfaces). Organizations in various industries, including financial services, healthcare, government, telecommunications, and retail, use WSO2 products. In April 2022, security researchers recently found a critical vulnerability in certain WSO2

compliance

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

The multitude of guidelines and regulations can be overwhelming, especially when it comes to understanding the penetration testing requirements for each. Determining what each compliance standard requires from a penetration test can be a headache, but it's crucial to get it right. To simplify the process, we'