Today, we’re going to take a closer look at how network segmentation can be used to improve your organization’s security posture. Network segmentation is, very simply, creating subdivisions of your corporate network and then intelligently restricting traffic flows between them. This can take the form of VLANing, ACLs on routers or firewalls, host-based firewalls, physical […]
In today’s blog, we’ll discuss the differences between a CTF vs real, professional penetration testing, and the mindset required for each. We’re primarily aiming this article at aspiring and junior penetration testers, by highlighting some of the things to think about when transitioning from a CTF-style environment to that of a professional penetration testing firm. […]
Picking the brain of a seasoned penetration tester is always fun. Getting insights into what makes them tick, what keeps them up at night, their craziest find on a penetration test, and much more. Below is a Q&A with a senior engineer at Triaxiom Security. Q: How did you get into penetration testing?A: I started […]
Creating secure web applications is hard. There are a number of reasons for this, but one contributing factor is language-specific oddities. Specifically, different programming languages handle data differently and, in some cases, these differences can have a significant impact on security. Let’s take a look at one somewhat-exotic example of a language-specific idiosyncrasy within PHP, […]
An integral part of any company is the IT help desk. While some people have horror stories from working with help desks in the past, they play a very important role in your overall security program. They are often the targets of sophisticated social engineering attacks and, as such, need to have strong processes in […]
The Open Source Security Testing Methodology Manual, or OSSTMM, was created to: …provide a scientific methodology for the accurate characterization of operational security (OpSec) through examination and correlation of test results in a consistent and reliable way. This manual is adaptable to almost any audit type, including penetration tests, ethical hacking, security assessments, vulnerability assessments, […]
File upload filtering is an extremely important part of web application security that is also notoriously hard to get right. And unfortunately the stakes are high, as vulnerabilities associated with your file upload functionality can quickly turn into critical, exploitable issues with impacts that include remote code execution on the underlying web server. So let’s […]
Currently and going forward, many employees may find themselves working from home temporarily or permanently. Security is still extremely important to yourself and your employer and today, we will explore tips and tricks that will help you maintain your security posture while working remotely. Working From Home Security Tips & Tricks Leverage a VPN – […]
Today, we’re going to dig into the most common methods of API authentication out there and discuss some of the security implications associated with each of them, from the perspective of a penetration tester. As Application Programming Interfaces (APIs) continue to become a more prevalent tool used in website architecture, the security associated with them […]
We are often times asked “why did you become a penetration tester” or “why should I get into penetration testing”? There are many different reasons to get into penetration testing and everyone is motivated by different things. We took a poll in our office of why our team members got into penetration testing and today […]
