Automated API Protection with WAP

For those who use Web Application Protector from Akamai: "Your APIs just got an extra layer of protection". For everyone else, learn how easy a WAF can be. You protect your web applications, that's awesome, but what about all your APIs? Do you know how many you have, who accesses them and what...

Kaboom - Automatic Pentest

kaboom is a script that automates the penetration test. It performs several tasks for each phase of pentest: 1. Information gathering nmap-unicornscan TCP scan UDP scan 2. Vulnerability assessment nmap-nikto-dirb-searchsploit-msfconsole It tests several services: smb ssh snmp smtp ftp tftp ms-sql...

Pompem - Exploit and Vulnerability Finder

Pompem is an open source tool, designed to automate the search for Exploits and Vulnerability in the most important databases. Developed in Python, has a system of advanced search, that help the work of pentesters and ethical hackers. In the current version, it performs searches in PacketStorm...

Double-Stuffed: Dunkin’ Hit by Another Credential-Stuffing Attack

Dunkin’ Donuts may have just launched its first double-filled doughnut, but another doubling up is not quite as tasty. The chain has suffered its second credential-stuffing attack in three months. Like the first incident, the attack targeted pastry aficionados that have DD Perks accounts, which i...

ICSA-19-043-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: EN100 Ethernet Communication Module and SIPROTEC 5 Relays Vulnerability: Improper Input Validation 2. RISK EVALUATION The EN100 Ethernet communication module and SIPROTEC 5...

Threat Roundup for Feb. 1 to Feb. 8

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 01 and Feb. 08. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

Postmates: Web cache poisoning attack leads to user information and more

Hello, Your Web-Server is vulnerable to web cache poisoning attacks. This means, that the attacker are able to get another user informations. If you are logged in and visit this website For example: https://postmates.com/SomeRandomText.css Then the server will store the information in the cache,...

RHEL 7 : Red Hat Gluster Storage Web Administration (RHSA-2019:0265)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0265 advisory. Red Hat Gluster Storage Web Administration includes a fully automated setup based on Ansible and provides deep metrics and insights into...

Partner Perspectives: How SOAR Acts as a Force Multiplier in Incident Response

John Moran is a Senior Product Manager for DFLabs. As a recovering incident response consultant, I am familiar with many of the common challenges incident response teams are faced with on a daily basis. When an incident occurs, teams are immediately bombarded with a myriad of critical questions...

Prepare to Defend Your Network Against Swarm-as-a-Service

The digital world we now inhabit creates unprecedented opportunities – both for good and for ill. One of these possibilities is swarm-based tools that can be used to either attack or defend the network. This possibility, or set of possibilities, has arisen due to dramatic advances in swarm-based...

UPDATE: Cameradar v3.0.1

PenTestIT RSS Feed My initial post covering this open source Real Time Streaming Protocol RTSP surveillance camera access multi-tool was about an older version. A lot has happened since then and an update – Cameradar v3.0.1 was recently made available by the author. In actuality, this post...

Partner Perspectives: Beyond SIEM: Carbon Black + JASK Connected

Oren Arar is the Head of Alliances for JASK. The real-time integration of JASK & Carbon Black provides high-value alerts and extended contextual investigation insights to our joint customers, all within a cloud-native environment. Background The JASK Autonomous Security Operations Center ASOC...

ADAPT - Tool That Performs Automated Penetration Testing For WebApps

ADAPT is a tool that performs Automated Dynamic Application Penetration Testing for web applications. It is designed to increase accuracy, speed, and confidence in penetration testing efforts. ADAPT automatically tests for multiple industry standard OWASP Top 10 vulnerabilities, and outputs...

Sh00T - A Testing Environment for Manual Security Testers

A Testing Environment for Manual Security Testers. Sh00t is a task manager to let you focus on performing security testing provides To Do checklists of test cases helps to create bug reports with customizable bug templates Features: Dynamic Task Manager to replace simple editors or task managemen...

Commix v2.7 - Automated All-in-One OS Command Injection And Exploitation Tool

Commix short for command injection exploiter is an automated tool written by Anastasios Stasinopoulos @ancst that can be used from web developers, penetration testers or even security researchers in order to test web-based applications with the view to find bugs, errors or vulnerabilities related...

#OTTuesday: AI Destined for Big Role in Entertainment

After years of hype, AI is finally making headway in industries like manufacturing, medicine and transportation -- and it's beginning to play a supporting role in media & entertainment. AkamaiTV's Paul Jackson chatted with Peter Chave, Principal Architect here at Akamai, to learn how AI is steppi...

Guinea Pig and Vulnerability Management products

IMHO, security vendors use the term "Vulnerability Management" extremely inaccurate. Like a guinea pig, which is not a pig and is not related to Guinea, the current Vulnerability Management products are not about the actual practically exploitable vulnerabilities and not really about the...

Top 5 Threat Hunting Myths: “Threat Hunting Isn’t Worth My Time”

The cybersecurity landscape is in a constant state of change and, as many organizations have learned, it’s no longer a matter of if you’ll face a cyberattack, but when. In today’s world, attackers intentionally look normal to evade automated defenses. With the rise of ransomware, fileless and...

Defending Credentials From Automated Attack Tools

By Danny Wasserman The folks on the Akamai Professional Services team are the people who help implement, configure, and tune the cloud security products that protect our customers' web applications from the daily onslaught of bots blasting login attempts against their websites, mobile apps, and...

Top 5 Threat Hunting Myths: “Threat Hunting Is Too Complicated”

The cybersecurity landscape is in a constant state of change and, as many organizations have learned, it’s no longer a matter of if you’ll face a cyberattack, but when. In today’s world, attackers intentionally look normal to evade automated defenses. With the rise of ransomware, fileless and...