AI-Powered Application Penetration Testing—Scale Security Without Compromise Learn More

Technical Research

Technical Research

raink: Use LLMs for Document Ranking

raink: Use LLMs for Document Ranking

Jan 14, 2025

Learn how Bishop Fox's open-source ranking algorithm, raink, can be used to solve general ranking problems that are difficult for LLMs to process.

By Caleb Gross

Technical Research

Cyber Mirage: How AI is Shaping the Future of Social Engineering

Cyber Mirage: How AI is Shaping the Future of Social Engineering

Jan 8, 2025

Bishop Fox explores the escalating threat of AI-driven deepfakes in social engineering attacks, highlighting their potential to deceive individuals and organizations by impersonating trusted figures through hyper-realistic audio and video fabrications.

By Brandon Kovacs

Technical Research

Current State of SonicWall Exposure: Firmware Decryption Unlocks New Insights

Current State of SonicWall Exposure: Firmware Decryption Unlocks New Insights

Dec 13, 2024

Discover Bishop Fox's survey on the current state of SonicWall appliances on the public internet.

By Bishop Fox Researchers

Technical Research

Sonicwall Firmware Deep Dive - SWI Firmware Decryption

Sonicwall Firmware Deep Dive - SWI Firmware Decryption

Dec 2, 2024

Discover Bishop Fox in-depth analysis of SonicWall firewalls, revealing critical insights into firmware security and vulnerability.

By Bishop Fox Researchers

Technical Research

The Growing Concern of API Security

The Growing Concern of API Security

Nov 27, 2024

Explore concerns around API security, its unique vulnerabilities, and the need for tailored protection against evolving threats in an API-driven world.

By Robert Punnett, Nicholas Beacham

Technical Research

A Brief Look at FortiJump (FortiManager CVE-2024-47575)

A Brief Look at FortiJump (FortiManager CVE-2024-47575)

Nov 1, 2024

The recent discovery of FortiJump (CVE-2024-47575) highlights a critical vulnerability exploited in the wild, prompting an urgent need to understand its impact on centralized management devices. Take a deeper look with Bishop Fox experts.

By Bishop Fox Researchers

Technical Research

Broken Hill: A Productionized Greedy Coordinate Gradient Attack Tool for Use Against Large Language Models

Broken Hill: A Productionized Greedy Coordinate Gradient Attack Tool for Use Against Large Language Models

Sep 24, 2024

Walkthrough the GCG attack at a high level and be introduced to Broken Hill – Bishop Fox’s newly-released tool that can perform the GCG attack against a variety of popular LLMs.

By Ben Lincoln

Technical Research

Exploring Large Language Models: Local LLM CTF & Lab

Exploring Large Language Models: Local LLM CTF & Lab

Sep 11, 2024

Explore research on isolating functional expectations for LLMs using a controller to manage access between privileged and quarantined LLMs.

By Derek Rush

Technical Research

Product Security Review Methodology for Traeger Grill Hack

Product Security Review Methodology for Traeger Grill Hack

Jul 2, 2024

Read for an in-depth analysis of the Traeger Grill hack, uncovering the vulnerabilities that could compromise your grill's security and how they were addressed.

By Nick Cerne

Technical Research

The Unmask IAM Permission: API Gateway Access Logging

The Unmask IAM Permission: API Gateway Access Logging

Jun 6, 2024

Unlock the secrets to securing your AWS environment! Learn the intricacies of IAM permissions and how to protect your Amazon API Gateway access logs.

By Chris Scrivana

Technical Research

PAN-OS CVE-2024-3400: Patch Your Palo Alto Firewalls

PAN-OS CVE-2024-3400: Patch Your Palo Alto Firewalls

Apr 19, 2024

Bishop Fox shares limited details about mitigation bypasses for PAN-OS CVE-2024-3400 in an effort to be maximally useful for defenders, while minimally useful for opportunistic attackers.

By Bishop Fox Researchers

Technical Research

The iSOON Disclosure: Exploring the Integrated Operations Platform

The iSOON Disclosure: Exploring the Integrated Operations Platform

Mar 21, 2024

In this blog, examine the iSoon data disclosure from an offensive security perspective.

By Bishop Fox Researchers

Technical Research

Poisoned Pipeline Execution Attacks: A Look at CI-CD Environments

Poisoned Pipeline Execution Attacks: A Look at CI-CD Environments

Mar 19, 2024

In this blog, we examine three types of poisoned pipeline execution (PPE) attacks, methods to exploit these types of vulnerabilities, and recommended preventive measures.

By Sebastian Guerrero

Technical Research

Further Adventures in Fortinet Decryption

Further Adventures in Fortinet Decryption

Mar 8, 2024

In this blog, we examine how the new Fortinet encryption scheme works and provide a tool to decrypt the root filesystem for x86-based FortiOS images.

By Bishop Fox Researchers

Technical Research

CVE-2024-21762 Vulnerability Scanner for FortiGate Firewalls

CVE-2024-21762 Vulnerability Scanner for FortiGate Firewalls

Mar 1, 2024

Discover vulnerable FortiGate firewalls with the Bishop Fox CVE-2024-21762 vulnerability scanner.

By Bishop Fox Researchers

Technical Research

It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable

It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable

Jan 15, 2024

Learn about SonicWall NGFW series 6 and 7 impacted by unauthenticated denial-of-service vulnerabilities with the potential for remote code execution.

By Jon Williams

Technical Research

GWT: Unpatched, Unauthenticated Java Deserialization

GWT: Unpatched, Unauthenticated Java Deserialization

Dec 18, 2023

In this blog, learn about an eight year old unpatched and unauthenticated Java deserialization vulnerability in GWT.

By Ben Lincoln

Technical Research

Introducing Swagger Jacker: Auditing OpenAPI Definition Files

Introducing Swagger Jacker: Auditing OpenAPI Definition Files

Dec 12, 2023

Download Swagger Jacker, an open-source tool made for penetration testers that enables better auditing of OpenAPI definition files.

By Tony West

Technical Research

Cloud Security Podcast Featuring Seth Art: Network Pentest 2.0

Cloud Security Podcast Featuring Seth Art: Network Pentest 2.0

Nov 8, 2023

Learn about cloud security and cloud penetration testing in Part 2 of Seth Art's interview with Cloud Security Podcast.

By Seth Art

Technical Research

Cloud Security Podcast Featuring Seth Art: Cloud Pentest of AWS

Cloud Security Podcast Featuring Seth Art: Cloud Pentest of AWS

Nov 1, 2023

Hear insights from Seth Art on how AWS cloud penetration testing improves cloud security and why cloud configuration reviews are not always enough.

By Seth Art

Technical Research

Building an Exploit for FortiGate Vulnerability CVE-2023-27997

Building an Exploit for FortiGate Vulnerability CVE-2023-27997

Oct 27, 2023

Learn how Bishop Fox built a POC exploit for the pre-authentication remote code injection vulnerability in the Fortinet SSL VPN published by Lexfo.

By Bishop Fox Researchers

Technical Research

Celebrating One Year of CloudFox

Celebrating One Year of CloudFox

Sep 29, 2023

Celebrate CloudFox's one-year anniversary as we reflect on the updates and growth that have occurred over the year including the creation of CloudFoxable.

By Seth Art

Technical Research

Passing the OSEP Exam Using Sliver

Passing the OSEP Exam Using Sliver

Sep 21, 2023

Learn how Bishop Fox senior security expert, Jon Guild, passed the OSEP exam using Sliver.

By Jon Guild

Technical Research

Badge of Shame - Breaking Into Secure Facilities with OSDP

Badge of Shame - Breaking Into Secure Facilities with OSDP

Aug 9, 2023

Learn about five exploitable vulnerabilities we've identified in OSDP and share what defenders can do about them.

By Dan Petro

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.