ONSEC.io Pentesting blog

ONSEC: Boutique Penetration Testing Agency

Sign in Subscribe

Latest

Cyber Daily 12/5: FBI and CISA Warn of Text Message Vulnerabilities, China's 'Salt Typhoon' Cyber Threat, CyberPanel and Zyxel Firewall Flaws, SAP and Mitel Software Vulnerabilities

Cyber Daily 12/5: FBI and CISA Warn of Text Message Vulnerabilities, China's 'Salt Typhoon' Cyber Threat, CyberPanel and Zyxel Firewall Flaws, SAP and Mitel Software Vulnerabilities

Welcome to the ONSEC Cyber Daily, your one-stop source for the latest in cybersecurity news. In today's issue, we dive into the alarming warnings issued by the FBI and CISA about the vulnerability of text message data and the urgent need to use encrypted apps. This comes in

Cyber Daily 12/4: Cisco's Decade-Old WebVPN Vulnerability Fuels Botnet, LastPass Dodges Deepfake CEO Scam, Google Chrome's Emergency Update, PRC Cyber Threats Tackled by CISA & FBI, EU's Cybersecurity Shield, Palo Alto Firewalls Breached

Cyber Daily 12/4: Cisco's Decade-Old WebVPN Vulnerability Fuels Botnet, LastPass Dodges Deepfake CEO Scam, Google Chrome's Emergency Update, PRC Cyber Threats Tackled by CISA & FBI, EU's Cybersecurity Shield, Palo Alto Firewalls Breached

Cyber Daily 12/3: Log4Shell Exploits in VMware, Cisco's Decade-Old ASA WebVPN Vulnerability, Australia's CISC Guidance, Samsung's Security Patch, Windows Driver Vulnerability

Cyber Daily 12/3: Log4Shell Exploits in VMware, Cisco's Decade-Old ASA WebVPN Vulnerability, Australia's CISC Guidance, Samsung's Security Patch, Windows Driver Vulnerability

Cyber Daily 11/30: Russian 0-Click Backdoor Attack on Windows, Bank of England's Cyber Threat Warning, Chinese Cyberespionage Impact on Gov Agencies, Microsoft and Oracle's Critical Patches

Cyber Daily 11/30: Russian 0-Click Backdoor Attack on Windows, Bank of England's Cyber Threat Warning, Chinese Cyberespionage Impact on Gov Agencies, Microsoft and Oracle's Critical Patches

Cyber Daily 11/29: Russian 0-Click Attack on Windows, Zyxel Firewalls Targeted by Helldown, India's Firefox Warning, Raspberry Pi Security, Advantech Wi-Fi Flaws, AI Cyber Warfare

Cyber Daily 11/29: Russian 0-Click Attack on Windows, Zyxel Firewalls Targeted by Helldown, India's Firefox Warning, Raspberry Pi Security, Advantech Wi-Fi Flaws, AI Cyber Warfare

Cyber Daily 11/28: Oracle Agile PLM Flaw, Africa's Cybercrime Crackdown, Google Chrome Security Risks, ProjectSend Exploitation, Australia's Cyber Security Act, Windows 11 Vulnerability, Firefox Zero-Day Flaws

Cyber Daily 11/28: Oracle Agile PLM Flaw, Africa's Cybercrime Crackdown, Google Chrome Security Risks, ProjectSend Exploitation, Australia's Cyber Security Act, Windows 11 Vulnerability, Firefox Zero-Day Flaws

Cyber Daily 11/27: PTA Warns of WordPress Plugin Flaw, England's Weather Vulnerability Mapped, Android and iPhone Users Alerted, Grafana and ProjectSend Exploits, Microsoft and QNAP Patch Critical Gaps

Cyber Daily 11/27: PTA Warns of WordPress Plugin Flaw, England's Weather Vulnerability Mapped, Android and iPhone Users Alerted, Grafana and ProjectSend Exploits, Microsoft and QNAP Patch Critical Gaps

pentest

TCP Tarpit and Port Scanning. Barricades on Both Sides.

TCP Tarpit and Port Scanning. Barricades on Both Sides.

Introduction Thousands of articles have been written about port scanning, discussing techniques, methodologies, tools... Yet, even in such a seemingly straightforward topic, there are several less-covered nuances. If you regularly scan subnets, participate in bug bounties, perform penetration testing, or automate this process, then this article might be useful to

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

Sandbox escape or How to catch all servers of the company

Sandbox escape or How to catch all servers of the company

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Getting ready for your first pentest: startup founders guide

Getting ready for your first pentest: startup founders guide

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

rceexploit

Deep Dive into the CVE-2022-29464 RCE exploit

Deep Dive into the CVE-2022-29464 RCE exploit

WSO2 is the leading API Management solution company. It provides various software products for connecting, managing, and securing APIs (Application Programming Interfaces). Organizations in various industries, including financial services, healthcare, government, telecommunications, and retail, use WSO2 products. In April 2022, security researchers recently found a critical vulnerability in certain WSO2

compliance

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

The multitude of guidelines and regulations can be overwhelming, especially when it comes to understanding the penetration testing requirements for each. Determining what each compliance standard requires from a penetration test can be a headache, but it's crucial to get it right. To simplify the process, we'