Tags
CVE
How we detect and exploit Log4Shell to help you find targets using vulnerable Log4j versions
We’re breaking down our technique for detecting CVE-2021-44228 (Log4Shell) because we believe our users should understand what’s happening behind the scanners so they can avoid a false sense of security.
- Published at
- Updated at
How to detect the Zoho ManageEngine ADSelfService Plus RCE (CVE-2021-40539)
Overwhelmed by so many high-risk vulnerabilities that emerge? Thousands of them are disclosed every year and 2021 is no exception. Systems are complex, cyber attacks get more sophisticated, and patching is still a challenge for many organizations. As infosec pros, it’s our responsibility to help companies (and individuals) understand the real implications and impact of a critical vulnerability and help them find it before it gets worse.
- Published at
- Updated at
Detect and exploit Gitlab CE/EE RCE with Pentest-Tools.com (CVE-2021-22205)
“Just patch it!” is the usual advice when a vulnerability hits (and it’s not a zero-day). But it’s never that simple in organizations that have to manage layers upon layers of infrastructure. When you have to deal with a critical CVE like the latest unauthenticated RCE in Gitlab (CVSSv3 10.0), the tangled, messy process of patching bubbles to the surface.
- Published at
- Updated at
How to detect CVE-2021-22986 RCE with Pentest-Tools.com
As a pentester, when you see a major critical vulnerability persist for months in unpatched systems (like Log4Shell), you have a responsibility to help others understand its severity and how they can fix it. This is exactly why this article exists.
- Published at
- Updated at
Detect ProxyShell (pre-auth Microsoft Exchange RCE) with Pentest-Tools.com
On-prem Microsoft Exchange servers have created a lot of work for IT and security specialists in the past months. In March, ProxyLogon left servers vulnerable to Server-Side Request Forgery through CVE-2021-26855, so we launched a dedicated scanner for it. In May, #proxynotfound popped up, so we integrated detection for it into our Network Vulnerability Scanner to make detection and reporting faster.
- Published at
- Updated at
How to detect VMware vCenter RCE with Pentest-Tools.com (CVE-2021-21972)
The current, multi-layer setup big organizations run on is a challenge to manage and we both know that (it’s an understatement). And when a vulnerability like CVE-2021-21972 pops up, it reveals how messy the process of patching and mitigation can be.
- Published at
- Updated at
Discover how dangerous a ‘Bad Neighbor’ can be - TCP/IP Vulnerability (CVE-2020-16898)
Patching is never easy, but doing it imperfectly can come back to bite you. That’s why today we’re unpacking a vulnerability that can resurface when improperly mitigated.
- Published at
- Updated at
Why Zerologon is the silent threat in your network
No red flags. No alerts. Full-on compromise. The way cybercriminals are putting together various vulnerabilities within the Microsoft infrastructure, including Zerologon vulnerability (CVE-2020-1472), is more than a trending topic in the infosec community. It’s a massive threat for organizations small and large.
- Published at
- Updated at
[New scanner] Detect vulnerable F5 BIG-IP devices with Pentest-Tools.com
Vulnerability scanners are powerful pentesting tools that help you discover critical flaws in your systems quickly and effectively. The more specific the tools, the more useful!
- Published at
- Updated at