Search • Page 2/12
In February 2024, we set out to compare our Website Vulnerability Scanner against some of the established names in Dynamic Web Application Security Testing, both commercial and open-source: Burp Scanner, Acunetix, Qualys, Rapid7 InsightAppSec, and ZAP.
In January 2024, we decided to evaluate the most used network vulnerability scanners - Nessus Professional, Qualys, Rapid7 Nexpose, Nuclei, OpenVAS, and Nmap vulnerability scripts - including our own, which industry peers can validate independently. Here’s why we did it, what results we got, and how you can verify them (there’s a white paper you can download with access to all the results behind this benchmark).
What does it take to build authentic trust and have a collaborative relationship with your customers? How do you help them create meaningful change in their organization? Which specific actions do you take to make an impact in how they tackle security issues? If you’ve wrestled with these questions, we created this educational guide to help you get more clarity and cultivate meaningful relationships with your customers. Empathy, honesty, clear communication, and understanding clients’ specific needs are some of the most effective strategies offensive security pros use to nurture these relationships with intent.
“Not everything works as configured. Not everyone behaves as trained.” The reality of this statement makes it possible for us, the people in offensive security, to have a job. It also highlights how unpredictable our work can be and how never-ending our learning process is. We work in a space where things are so complex that we need to combine big-picture, higher-level thinking with boost-on-the-ground practice. And our guest today is brilliant at doing just that.
The SSH backdoor would allow remote unauthenticated attackers to achieve remote code execution on the infected systems bypassing the authentication in place. From the information available at the time of writing, the backdoor seems to work only on GNU Linux x86/64 when the SSH server is run as a service by Systemd. Moreover, the library should have been installed by a packet manager. For the exploit to work, one should also expose the SSH server to the Internet so the attacker can interact remotely with it.
Gabrielle isn't just a pentester; she's a powerhouse of knowledge, an advocate for cyber education, and a mentor shaping the future of ethical hacking. With 9+ years of experience in cybersecurity, she focuses on sharing it with her community members through practical and valuable resources. In this episode, we continue to ask the meaningful questions: What makes a great pentester? How can you balance the art of manual testing with the efficiency of automation? What is the unique value that pentesters bring to offensive security? And what can't be commoditized in this craft?
Who or what shapes the perception of penetration testing? How do you step away from firefighting and develop a more systematic approach in your work as a pentester? These are some of the questions we’re answering in this new episode. Today’s guest is Tom Eston, an experienced security professional, team manager, and a true leader in offensive security.
Why would someone spend a lot of their time making penetration testing tools? Especially when it takes what it takes to maintain them. Today on We think we know, we're peeling back the layers of offensive security with the enigmatic Panagiotis Chartas, also known by his alias - Telemachus - a nod to his Greek heritage and the strategic depth of his expertise.
From his early days of script kiddie shenanigans to helping shape the landscape of bug bounty programs, Inti's story is a thrilling ride through the highs and lows of offensive security. It also serves as a statement of the transformative power of curiosity and ethical hacking.
When you hear about API (Application Programming Interface), do you get anxious because you don’t understand it very well? Do you feel like you can’t keep up with new technology? If you do, you’re not alone! Take a deep breath. Take another. Excellent! I’ll help you overcome your API security FOMO. In this guide, you’ll learn: how APIs work how to exploit the most common API vulnerabilities real-life examples of data breaches caused by API security issues API security best practices, and much more!
To deliver meaningful results as a pentester you have to be both patient and persistent. You have to love the process and strive for results for your clients. You also have to go in-depth and cultivate a broader understanding of all the pieces of the puzzle. Today’s guest, Willa Riggins, talks about how “every small piece contributes to the larger picture” in pentesting and explains why “it's about understanding the intricacies and appreciating the craftsmanship."
Could 2024 be a pivotal moment for AI in offensive security? We know it challenges us to explore new ways to simplify our work, but how will penetration testers use ChatGPT as a tool for meaningful change? And, most importantly, which new advancements in this space are worth keeping an eye on?
