Offensive Security Blog

In this blog, we explore how offensive security solutions are implemented by mature organizations to proactively protect cloud environments.

Cloud Offensive Security: 2023 Insights From the Ponemon Institute

Jul 18, 2023

By Beth Robinson

Check out latest analysis for CVE-2023-27997, a heap overflow in FortiOS, the the operating system behind FortiGate firewalls, that allows remote code execution.

CVE-2023-27997 Is Exploitable, and 69% of FortiGate Firewalls Are Vulnerable

Jun 30, 2023

By Caleb Gross

Use our latest vulnerability assessment tool to check for CVE-2023-27997, a vulnerability in FortiGate firewalls.

CVE-2023-27997 Vulnerability Scanner for FortiGate Firewalls

Jun 20, 2023

By Caleb Gross

Learn about three vulnerabilities we discovered in TaskCafe Version 0.3.2 that result in improper access controls, stored cross-site scripting, and insecure file upload.

TaskCafe, Version 0.3.2 Advisory

Jun 20, 2023

By Joan Bono, Luis De la Rosa Hernandez

Learn how mature organizations are designing offensive security blueprints to defend forward against today's most advanced adversaries and threats.

Architecting An Offensive Security Blueprint: 2023 Insights From the Ponemon Institute

Jun 14, 2023

By Tom Eston

Introducing CloudFoxable, an intentionally vulnerable AWS environment created specifically to teach the art of AWS cloud penetration testing, while highlighting CloudFox to help find latent attack paths more effectively.

Introducing CloudFoxable: A Gamified Cloud Hacking Sandbox

Jun 13, 2023

By Seth Art

Check out our recommendations for technology museums to visit this summer.

Geek Out: Technology Museums to Visit This Summer

Jun 6, 2023

By Shanni Prutchi

Learn how to power up your pen tests by using the new Montoya API to create Burp Suite extensions from scratch.

Power Up Your Pen Tests: Creating Burp Suite Extensions with the New Montoya API

May 25, 2023

By Christopher Cerne

Learn about our unique research focused on CVE-2022-42475 and how an exploit can be built to target a single specific FortiGate appliance running a single specific version of FortiOSbug.

A More Complete Exploit for Fortinet CVE-2022-42475

May 17, 2023

By Carl Livitt, Jon Williams

Learn how to get recruiters' attention on LinkedIn with expert tips from a Bishop Fox recruiting manager.

Using LinkedIn to Land Your Dream Cybersecurity Job

Apr 18, 2023

By Kaitlin O'Neil

In this advisory learn about the WP Coder plugin that is affected by a time-based SQL injection vulnerability via the the ‘id’ parameter in versions up to, and including, 2.5.3.

WP Coder, Version 2.5.3 Advisory

Apr 13, 2023

By Etan Castro Aldrete

Learn about the latest Microsoft Intune vulnerability discovered by Ben Lincoln.

Microsoft Intune, Version 1.55.48.0 Advisory

Apr 4, 2023

By Ben Lincoln

Learn about CVE-2023-21541, a Windows Task Scheduler vulnerability discovered by Ben Lincoln.

Windows Task Scheduler Application, Version 19044.1706 Advisory

Apr 4, 2023

By Ben Lincoln

Learn more about EDR bypass techniques with Lindsay Von Tish in the second blog of our What the Vuln series.

What the Vuln: EDR Bypass with LoLBins

Mar 23, 2023

By Lindsay Von Tish

Bank vault or screen door? Learn how FinServ attack surfaces appear to a hacker, how they prefer to exploit, and where they look for vulnerabilities.

Bank Vault or Screen Door? How Attackers View Financial Services

Mar 20, 2023

By Beth Robinson

Get highlights from our International Women's Day livestream roundtable, Defend Like a Girl: Hacking Your Way to Cyber Success.

Women of the Fox Den - A Unique Hacking Perspective

Mar 12, 2023

By Beth Robinson

Get to the know a few of the women behind the technical editorial team at Bishop Fox and learn about the criticality of clear, continuous, and consistent communication with customers.

The Women Behind the Writing

Mar 9, 2023

By Beth Robinson

Take a deep dive into Zimbra Zip Path Traversal vulnerability with Carlos Yanez in the first blog of our What the Vuln series.

What the Vuln: Zimbra

Feb 21, 2023

By Carlos Yanez

Learn how to take control of security program investments with Red Teaming.

Red Teaming: The Ultimate Sanity Check for Security Teams

Feb 16, 2023

By Trevin Edgeworth, Mark MacDonald

Check out this blog to learn about our favorite influencers to follow on the hacker scene.

The Top 12 Hacking Influencers to Follow

Feb 9, 2023

By Britt Kemp

In this blog, take a deep dive into Spoofy, an opensource tool that offers bulk domain lookup based on DMARC and SPF records.

Spoofy: An Email Domain Spoofing Tool

Feb 1, 2023

By Matt Keeley

Read this high risk advisory to learn how EzAdsPro "BlackBox" application allowed directory listing resulting in unauthorized information disclosure.

EzAdsPro BlackBox Advisory

Jan 25, 2023

By Dan Petro

Check out our recommendations for top network pen testing tools to level up your hacking skills.

8 Network Pen Testing Tools for Your Hacker Arsenal

Jan 17, 2023

By Britt Kemp