#pentesting

Kevin Karhan :verified:<a href="https://chaos.social/@HonkHase" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@HonkHase</a> ja, die <a href="https://infosec.space/tags/OpSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpSec</a> jener <a href="https://infosec.space/tags/KRITIS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KRITIS</a> ist quasi nichtexistent.<ul><li>Und nein, ich werde nicht in Details gehen.</li></ul>Nur soviel: Mich bezahlt keine*r die dazu authorisiert sind für's <a href="https://infosec.space/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentesting</a>!

5h15hwow .. this is amazing: A handheld <a href="https://techhub.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> terminal (running <a href="https://techhub.social/tags/kali_linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kali_linux</a>) using <a href="https://techhub.social/tags/RaspberryPi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RaspberryPi</a> Zero 2W as Core with 4" 720X720 TFT display and the original BlackBerry Keyboard <a href="https://github.com/ZitaoTech/Hackberry-Pi_Zero" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/ZitaoTech/Hackberry-Pi_Zero</a> <a href="https://techhub.social/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentesting</a> <a href="https://techhub.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://techhub.social/tags/ethicalhacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ethicalhacking</a> <a href="https://techhub.social/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://techhub.social/tags/kalilinux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kalilinux</a>

CyberEthical.MeI just pwned MisCloud on Hack The Box! <a href="https://labs.hackthebox.com/achievement/sherlock/555018/759" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://labs.hackthebox.com/achievement/sherlock/555018/759</a> <a href="https://infosec.exchange/tags/HackTheBox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HackTheBox</a> <a href="https://infosec.exchange/tags/htb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#htb</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/EthicalHacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EthicalHacking</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/PenTesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PenTesting</a>

0x40kYo, IT-Sec crowd! ✌️Anyone else noticing how *everyone* seems to be talking about AI-powered security tools these days? Yeah, it's everywhere. But let's be real for a sec – are they *truly* as amazing as the hype suggests? 🤔I mean, okay, AI can definitely be useful for spotting anomalies and patterns, no doubt about that. But here's a thought: what happens if the AI itself gets compromised? Or what about when it starts churning out false alarms simply because it doesn't *really* grasp the situation? 🤖Honestly, I've got my reservations. While automation is certainly nice to have, I'm convinced a skilled pentester, you know, one with actual brainpower and a strategic approach, still outsmarts any AI – at least for the time being. 😎 And look, if AI eventually *does* get significantly better, well, that just means it's time for us to add another skill to our toolkit. 🤷‍♂️So, what's your perspective on this? Do you see AI completely taking over the pentesting scene, or is that human touch going to remain irreplaceable? 🔥 Let the debate begin!<a href="https://infosec.exchange/tags/AISecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AISecurity</a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentesting</a> <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://infosec.exchange/tags/Hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hacking</a>

CyberEthical.MeI just pwned Compromised on Hack The Box! <a href="https://labs.hackthebox.com/achievement/sherlock/555018/758" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://labs.hackthebox.com/achievement/sherlock/555018/758</a> <a href="https://infosec.exchange/tags/HackTheBox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HackTheBox</a> <a href="https://infosec.exchange/tags/htb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#htb</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/EthicalHacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EthicalHacking</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/PenTesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PenTesting</a>

nickbeardedFrom day one, TShark has been an essential part of <a href="https://mastodon.social/tags/BashCore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BashCore</a>. It’s not just a substitute for Wireshark—it’s the same powerful engine, but fully command-line. If you’re serious about network analysis and pentesting, mastering TShark is a must.It has nothing less than Wireshark, just no GUI. Learn it, and you’ll have full control over packet capture and analysis, even on minimal systems.<a href="https://www.wireshark.org/docs/man-pages/tshark.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.wireshark.org/docs/man-pages/tshark.html</a><a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mastodon.social/tags/Networking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Networking</a> <a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://mastodon.social/tags/TShark" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TShark</a> <a href="https://mastodon.social/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentesting</a> <a href="https://mastodon.social/tags/NoGUI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NoGUI</a>

halil denizSQL Injection Cheat Sheet: A Comprehensive Guide <a href="https://denizhalil.com/2025/04/02/sql-injection-cheat-sheet/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://denizhalil.com/2025/04/02/sql-injection-cheat-sheet/</a><a href="https://mastodon.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.social/tags/websecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#websecurity</a> <a href="https://mastodon.social/tags/sql" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sql</a> <a href="https://mastodon.social/tags/sqlinjection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sqlinjection</a> <a href="https://mastodon.social/tags/webapplicationsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#webapplicationsecurity</a> <a href="https://mastodon.social/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://mastodon.social/tags/ethicalhacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ethicalhacking</a> <a href="https://mastodon.social/tags/blogger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blogger</a>

0x40kFIN7 *again*? Seriously, these guys just don't quit, do they? 🙄Heads up – they've cooked up an Anubis backdoor using Python. And nope, *it's not* the Android Trojan people know. It's pretty wild what this thing packs: we're talking remote shell capabilities, file uploads, messing with the registry... 🤯 Basically, the keys to the kingdom!And let me tell you from a pentester's perspective: Just relying on AV? That's *definitely* not gonna cut it anymore. We all know that, right?Looks like they're slipping in through compromised SharePoint sites now? Yikes. The nasty part? A Python script decrypts the payload *directly in memory*, making it incredibly tough to spot! 🥴 Plus, their command and control chats happen over a Base64-encoded TCP socket.So, keep a *sharp eye* on those ZIP attachments! Double-check your SharePoint sites' integrity. You'll also want to monitor network traffic closely (especially that TCP activity!). And make sure your endpoint security is actually up to snuff – remember, they love finding ways to bypass defenses!How are *you* tackling threats like this one? What are your go-to tools and strategies for defense? 🤔 Let's share some knowledge!<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/FIN7" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FIN7</a> <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#APT</a> <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://infosec.exchange/tags/SharePoint" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SharePoint</a> <a href="https://infosec.exchange/tags/WindowsSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsSecurity</a>

OWASP FoundationMaster Modern Web App Security at OWASP Global AppSec EU 2025 in Barcelona!2-Day Training | May 27-28, 2025 Level: Intermediate | Trainer: Abraham Aranguren Take a 100% hands-on deep dive into the OWASP Security Testing Guide and Application Security Verification Standard (ASVS) in this action-packed course. Register now ⬇️ <a href="https://owasp.glueup.com/event/123983/register/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://owasp.glueup.com/event/123983/register/</a><a href="https://infosec.exchange/tags/OWASP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OWASP</a> <a href="https://infosec.exchange/tags/AppSecEU2025" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppSecEU2025</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/PenTesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PenTesting</a> <a href="https://infosec.exchange/tags/WebSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebSecurity</a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DevSecOps</a> <a href="https://infosec.exchange/tags/NodeJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NodeJS</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/Barcelona" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Barcelona</a>

0x40kWhoa, talk about déjà vu! Seems like Firefox is playing catch-up right after Chrome dropped a fix for a sandbox escape. 🤯 Keep an eye out for CVE-2025-2857.So, what's the deal? In short, this nasty bug could let an attacker break right out of the browser's protective sandbox. And *that* means they could potentially gain full access to your system. Yeah, pretty scary stuff. 😱If you're running Firefox on Windows, heads up! This affects versions 136.0.4, ESR 115.21.1, and ESR 128.8.1. This whole situation feels familiar because Chrome *just* patched CVE-2025-2783, a similar issue that attackers were already actively exploiting out in the wild!Make no mistake, sandbox escapes are a huge deal. As a pentester, I can tell you: vulnerabilities like this get weaponized *fast*. Don't wait around.Seriously, update your Firefox ASAP! Trust me, you don't want to deal with the fallout if someone exploits this. It could get costly, fast.Ever seen a browser exploit do its thing live? Wild, right? Drop your stories below!<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://infosec.exchange/tags/firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#firefox</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/updateNOW" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#updateNOW</a>

LMG SecurityLearn how to pentest your own network in our new step-by-step guide from Senior Cybersecurity Consultant Bryan Bijonowski Jr. Bryan explains why penetration testing is crucial for identifying weaknesses before attackers do, then guides IT professionals through the process of pentesting their own networks to strengthen their organization's defenses and significantly reduce cybersecurity risks!Check it out: <a href="https://www.lmgsecurity.com/how-to-pentest-your-own-network-a-7-step-guide-for-it-pros/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.lmgsecurity.com/how-to-pentest-your-own-network-a-7-step-guide-for-it-pros/</a><a href="https://infosec.exchange/tags/Pentest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentest</a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://infosec.exchange/tags/riskmanagement" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#riskmanagement</a> <a href="https://infosec.exchange/tags/ITsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ITsecurity</a> <a href="https://infosec.exchange/tags/IT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IT</a> <a href="https://infosec.exchange/tags/CISO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CISO</a>

0x40kWhoa, just stumbled onto something pretty wild: "Atlantis AIO." Heard it called the Swiss Army knife for credential stuffing! 🔪Not sure what that is? Okay, picture this: hackers grab massive batches of leaked passwords. Then, they just systematically try those logins *everywhere*. Atlantis AIO basically automates that whole nasty process, making it super efficient for them.And yeah, that means your Netflix, your email, even your online banking could be in the crosshairs! 🎯Now, speaking from my experience as a pentester, it's frighteningly common to see how effective credential stuffing is, *especially* when people aren't using MFA. Sure, complex password rules are a start, but honestly, they often just aren't enough on their own.Multi-Factor Authentication (MFA)? *That's* the real gamechanger here. 🔑 Seriously, turning it on wherever you can makes a massive difference.Anyway, curious to hear from you all – have any of you run into attacks like this before, or seen the fallout? What happened? Drop your stories below!<a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentesting</a>

0x40kSeriously, Broadcom... what's the deal lately? 🤯First up, we've got CVE-2025-22230 hitting VMware Tools for Windows. This nasty bug basically lets standard users inside a VM escalate their privileges to admin level. Yikes! 😬 With a CVSS score of 7.8, you'll want to jump on this fix ASAP. It impacts versions 11.x.x and 12.x.x, so upgrading to 12.5.1 needs to be right at the top of your list!But wait, there's more. CrushFTP is also sounding the alarm about unauthenticated access vulnerabilities lurking on HTTP(S) ports in versions 10 and 11. It's definitely time to double-check those DMZ configurations. Rapid7 has confirmed that exploits are out there, allowing unauthorized access. Pretty intense, right?Stuff like this is a stark reminder: while automated scans have their place, they just don't cut it alone. Real-deal penetration testing is absolutely essential. Those manual checks are what uncover the sneaky issues that automated tools often breeze right past.What's your take on this recent wave? How are you keeping your own environments locked down tight? Let's talk 👇<a href="https://infosec.exchange/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ITSecurity</a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentesting</a> <a href="https://infosec.exchange/tags/VMware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VMware</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/VulnerabilityManagement" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VulnerabilityManagement</a>

IT NewsPhysical Key Copying Starts With a Flipper Zero - A moment’s inattention is all it takes to gather the information needed to make a ... - <a href="https://hackaday.com/2025/03/25/physical-key-copying-starts-with-a-flipper-zero/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://hackaday.com/2025/03/25/physical-key-copying-starts-with-a-flipper-zero/</a> <a href="https://schleuss.online/tags/lockpickinghacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#lockpickinghacks</a> <a href="https://schleuss.online/tags/duplicating" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#duplicating</a> <a href="https://schleuss.online/tags/flipperzero" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#flipperzero</a> <a href="https://schleuss.online/tags/lockpicking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#lockpicking</a> <a href="https://schleuss.online/tags/locksports" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#locksports</a> <a href="https://schleuss.online/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a>

FlorianWhen I started the IC_Null channel the idea was to cover topics primarily about <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>, <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a>, <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> etc. from a <a href="https://infosec.exchange/tags/blind" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blind</a> perspective. Blind as in <a href="https://infosec.exchange/tags/screenReader" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#screenReader</a> user, that is. But an overarching topic is showing off what jobs are (up to a point) doable for this demographic and where the obstacles are. Today's stream leans that way: we'll be looking at the premier <a href="https://infosec.exchange/tags/translation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#translation</a> and <a href="https://infosec.exchange/tags/localization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#localization</a> tool, Trados Studio. Supposedly they have upped their <a href="https://infosec.exchange/tags/accessibility" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#accessibility</a> as of late. I'll be the judge of that 💀 I'll see you all on <a href="https://infosec.exchange/tags/youtube" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#youtube</a> and <a href="https://infosec.exchange/tags/twitch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#twitch</a> just under 1.5 hours from now. https://twitch.tvic_null <a href="https://youtube.com/@blindlyCoding" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://youtube.com/@blindlyCoding</a> <a href="https://infosec.exchange/tags/selfPromo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfPromo</a> <a href="https://infosec.exchange/tags/stream" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#stream</a> <a href="https://infosec.exchange/tags/trados" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#trados</a>

0x40kWhoa, 112 SaaS apps per company? Seriously?! 🤯 Most folks don't even realize what's going on...SaaS security is a *huge* deal. I mean, who's actually patching Office 365 correctly? And are you really keeping an eye on permissions? Probably not.We've got Shadow IT, misconfigurations, and third-party risks – the whole shebang! Every app's different. One wrong setting? It is Jackpot time for attackers!As a pentester, I often see how much SaaS is underestimated. I had a client once tell me, "We've got a firewall!" Yeah, but that doesn't cover, well, *everything*.Your SaaS security needs a holistic approach. AI can help, sure, but it's not a magic bullet. Data is crucial for AI, as we know! And AI likes to, shall we say, make stuff up sometimes!So, go check your SaaS configs! Keep an eye out for Shadow IT and third-party vendors. AI tools are cool for monitoring. But, you know, keep it real! Don't forget about those penetration tests!How are *you* securing your SaaS environment? What red flags have you spotted? Let's hear it!<a href="https://infosec.exchange/tags/SaaS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SaaS</a> <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentesting</a> <a href="https://infosec.exchange/tags/CloudSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CloudSecurity</a>

0x40kWow, things are getting wild in the Kubernetes world! The name alone – "IngressNightmare" – gives me chills! 🤯 It's crucial to know this affects the Ingress NGINX Controller, *not* the NGINX Ingress Controller. That's a big difference!Wiz really uncovered something huge. We're talking over 6,500 vulnerable clusters, with the potential for some serious Remote Code Execution (RCE). Ouch! They found that a scary 43% of cloud environments are impacted.It appears, that these kinds of vulnerabilities often slip past standard scans. You really need manual penetration testing to catch them. And as a pentester myself, I can tell you, it's frequently like digging for buried treasure! 😅Here are the CVEs to watch out for: CVE-2025-24513, CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, CVE-2025-1974. These have a CVSS score of 9.8! So, you'll want to update to 1.12.1, 1.11.5, or 1.10.7 *immediately*. Another crucial step? See if your Admission Webhook Endpoint is exposed. Make sure you're limiting access. Don't need it? Then, turn it off!So, what are your experiences with K8s security? I'm curious, what tools do you swear by? 🤔<a href="https://infosec.exchange/tags/kubernetes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kubernetes</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://infosec.exchange/tags/devsecops" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devsecops</a> <a href="https://infosec.exchange/tags/cloudsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cloudsecurity</a>

0x40kWhoa, the IT security world was on FIRE this week! 🤯 Open source supply chain attacks, malware sneaking into the Play Store, ransomware bypassing EDR... and is AI just pouring gasoline on the phishing flames?! Seriously intense! 😳 Cloud security's getting a raw deal and let's be real, backups are only as good as their security.It's wild how rapidly the threat landscape's evolving, isn't it? Gotta stay sharp, folks! Automated vulnerability scans? They're definitely nice, but manual penetration tests are still essential. And AI? Awesome tech, but also seriously risky. Disinformation and manipulation are spiraling out of control. We've gotta stay vigilant!So, what are *your* biggest IT security pain points right now? Spill the beans!<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://infosec.exchange/tags/offensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#offensiveSecurity</a>

Konstantin :C_H:With <a href="https://infosec.exchange/tags/CVE_2025_29927" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE_2025_29927</a>, Next.js has now suffered its second major vulnerability in just three months, following <a href="https://infosec.exchange/tags/CVE_2024_51479" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE_2024_51479</a>.I originally built CVE Crowd with <a href="https://infosec.exchange/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NextJS</a>.However, as the application became more complex (especially with authentication), I decided to switch to a framework I was more familiar with.Honestly, I’m feeling a bit relieved about that right now...<a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pentesting</a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppSec</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/BugBounty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BugBounty</a> <a href="https://infosec.exchange/tags/Hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hacking</a> <a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a> <a href="https://infosec.exchange/tags/CVECrowd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVECrowd</a>

Teri RadichelSeeking signs of <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> posts on this platform. Or information on <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://infosec.exchange/tags/bugbounty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bugbounty</a> what’s causing <a href="https://infosec.exchange/tags/databreach" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#databreach</a> es and how to stop them.

Recent searches

Search options

Administered by:

Server stats: