Offensive Security Blog

In this advisory learn about the WP Coder plugin that is affected by a time-based SQL injection vulnerability via the the ‘id’ parameter in versions up to, and including, 2.5.3.

WP Coder, Version 2.5.3 Advisory

Apr 13, 2023

By Etan Castro Aldrete

Learn about CVE-2023-21541, a Windows Task Scheduler vulnerability discovered by Ben Lincoln.

Windows Task Scheduler Application, Version 19044.1706 Advisory

Apr 4, 2023

By Ben Lincoln

Learn about the latest Microsoft Intune vulnerability discovered by Ben Lincoln.

Microsoft Intune, Version 1.55.48.0 Advisory

Apr 4, 2023

By Ben Lincoln

Learn more about EDR bypass techniques with Lindsay Von Tish in the second blog of our What the Vuln series.

What the Vuln: EDR Bypass with LoLBins

Mar 23, 2023

By Lindsay Von Tish

Bank vault or screen door? Learn how FinServ attack surfaces appear to a hacker, how they prefer to exploit, and where they look for vulnerabilities.

Bank Vault or Screen Door? How Attackers View Financial Services

Mar 20, 2023

By Beth Robinson

Get highlights from our International Women's Day livestream roundtable, Defend Like a Girl: Hacking Your Way to Cyber Success.

Women of the Fox Den - A Unique Hacking Perspective

Mar 12, 2023

By Beth Robinson

Get to the know a few of the women behind the technical editorial team at Bishop Fox and learn about the criticality of clear, continuous, and consistent communication with customers.

The Women Behind the Writing

Mar 9, 2023

By Beth Robinson

Take a deep dive into Zimbra Zip Path Traversal vulnerability with Carlos Yanez in the first blog of our What the Vuln series.

What the Vuln: Zimbra

Feb 21, 2023

By Carlos Yanez

Learn how to take control of security program investments with Red Teaming.

Red Teaming: The Ultimate Sanity Check for Security Teams

Feb 16, 2023

By Trevin Edgeworth, Mark MacDonald

Check out this blog to learn about our favorite influencers to follow on the hacker scene.

The Top 12 Hacking Influencers to Follow

Feb 9, 2023

By Britt Kemp

In this blog, take a deep dive into Spoofy, an opensource tool that offers bulk domain lookup based on DMARC and SPF records.

Spoofy: An Email Domain Spoofing Tool

Feb 1, 2023

By Matt Keeley

Read this high risk advisory to learn how EzAdsPro "BlackBox" application allowed directory listing resulting in unauthorized information disclosure.

EzAdsPro BlackBox Advisory

Jan 25, 2023

By Dan Petro

Check out our recommendations for top network pen testing tools to level up your hacking skills.

8 Network Pen Testing Tools for Your Hacker Arsenal

Jan 17, 2023

By Britt Kemp

Learn what it is like to be a cloud penetration tester from our expert, Seth Art.

Cloud Penetration: Not Your Typical Internal Testing

Jan 10, 2023

By Seth Art

Get familiar with Bishop Fox's most important offensive security resolutions for 2023.

2023 Offensive Security Resolutions from the Fox Den

Jan 4, 2023

By Beth Robinson

Check out out favorite pen testing tools that we loved using in 2022!

Our Favorite Tools of the Year: 2022 Edition

Dec 27, 2022

By Britt Kemp

Need gift ideas for your favorite hackers? We've got you covered with our Hacker Holiday Gift Guide.

A Hacker Holiday Gift Guide

Dec 20, 2022

By Shanni Prutchi

In this advisory, read about a cross-site scripting (XSS) vulnerability in the FlowscreenComponents Basepack, Version 3.0.7.

FlowscreenComponents Basepack, Version 3.0.7 Advisory

Dec 15, 2022

By Matthew Rutledge

In this blog, we share a roundup of recent ransomware events, how ransomware continues to forge a path of destruction, and shed light on efforts to slow the pace of attacks.

The Latest in Ransomware: A Path of Cyber Destruction

Dec 12, 2022

By Beth Robinson

In this blog, learn how Bishop Fox discovered vulnerabilities in Kosovo's Avicena Medical Laboratory revealing patients' COVID-19 records.

160K COVID-19 Records: Vulnerability in Avicena Medical Laboratory

Dec 9, 2022

By Dardan Prebreza

Get a CISO's perspective on testing your security defenses against real-world ransomware playbooks.

A CISO's Approach to Ransomware Playbooks

Nov 29, 2022

By Beth Robinson

Read this medium risk advisory to learn details about CVE-2022-3402.

Log HTTP Requests, Version 1.3.1, Advisory

Nov 21, 2022

By Etan Castro Aldrete

In this blog, learn how veterans bridge the career gap between active duty service and civilian cybersecurity.

How to Go from Active Duty to Civilian Cybersecurity

Nov 17, 2022

By Beth Robinson