AI-Powered Application Penetration Testing—Scale Security Without Compromise Learn More

bishopfox-logo-grey
Get Started
Customer header bg dark

Offensive
Security Blog

Expert insights on offensive security, AI vulnerabilities, and emerging threats from Bishop Fox's leading security researchers and penetration testers.

Advisories Culture Security Perspectives Product Technical Research View All
Advisory

eCatcher Desktop, Version 6.6.4 Advisory

eCatcher Desktop, Version 6.6.4 Advisory

Aug 17, 2021

An insecure filesystem permissions vulnerability was identified in eCatcher version 6.6.4 and earlier. To exploit this vulnerability, an attacker must have a user account on the same machine as the victim and have access to the machine during an active VPN connection.

By Priyank Nigam
Advisory

Wodify

Wodify

Aug 13, 2021

The Bishop Fox team discovered three vulnerabilities that could have a severe business and reputational risk for Wodify.

By Dardan Prebreza
Technical Research

You're Doing IoT RNG

You're Doing IoT RNG

Aug 5, 2021

Learn why hardware random number generators (RNG) used by billions of IoT devices to create encryption keys don't always generate random numbers.

By Dan Petro, Allan Cecil
Culture

10 DEF CON 29 Security Talks to Watch

10 DEF CON 29 Security Talks to Watch

Jul 27, 2021

A look at DEF CON 29 security talks featuring Ian Coldwater, Chad Rikansrud, and Matt Bryant, plus Bishop Fox's own Dan Petro, and Allan Cecil.

By Britt Kemp
Security Perspective

9 Post-Exploitation Tools for Your Next Penetration Test

9 Post-Exploitation Tools for Your Next Penetration Test

Jul 15, 2021

Nine tools we’ve found useful for our post-exploitation efforts including GhostPack, Metasploit, PowerHub, LOLBAS, Mimikatz, PHPSploit, and more.

By Britt Kemp
Culture

Spark Your Curiosity With These Security Podcasts

Spark Your Curiosity With These Security Podcasts

Jun 27, 2021

Bishop Fox shares our favorite security podcasts.

By Britt Kemp
Security Perspective

Free Tools and Add-Ons to Explore for Applying DevSecOps in Your Organization

Free Tools and Add-Ons to Explore for Applying DevSecOps in Your Organization

Jun 24, 2021

List of free, built-in, or open-source tools & reference material when planning a move to DevSecOps. It’s a starting point to try within your environment. 

By Tom Eston
Security Perspective

Our Position on the Digital Millennium Copyright Act (DMCA) and the Need to Safeguard Tools for Responsible Security Researchers

Our Position on the Digital Millennium Copyright Act (DMCA) and the Need to Safeguard Tools for Responsible Security Researchers

Jun 23, 2021

Bishop Fox is joining our peers in the security industry in cautioning against Section 1201 of the Digital Millennium Copyright Act (DMCA).

By Bishop Fox
Technical Research

LEXSS: Bypassing Lexical Parsing Security Controls

LEXSS: Bypassing Lexical Parsing Security Controls

Jun 22, 2021

Technical details of achieving cross-site scripting (XSS) attacks by using HTML parsing logic where lexical parsers are used to nullify dangerous content.

By Chris Davis
Security Perspective

Why You Need Continuous Testing to Detect Emerging Threats and Discover the Unknowns

Why You Need Continuous Testing to Detect Emerging Threats and Discover the Unknowns

Jun 16, 2021

Learn why continuous testing will become a requirement for most organizations in the near future.

By Bishop Fox
Advisory

RetroArch for Windows, Versions 1.9.0 - 1.9.4 Advisory

RetroArch for Windows, Versions 1.9.0 - 1.9.4 Advisory

Jun 15, 2021

One high risk XSS vulnerability was identified within the the RetroArch for Windows application version 1.9.0.

By Daniel Fulford
Security Perspective

Applying DevSecOps in Your Organization

Applying DevSecOps in Your Organization

Jun 10, 2021

Tom Eston describes the entire DevSecOps lifecycle and what aspects of tooling and testing you can build into the way your organization develops applications.

By Tom Eston
Security Perspective

New Insights on Supply Chain and Ransomware Attacks From Our Chat With Alex Stamos and Charles Carmakal

New Insights on Supply Chain and Ransomware Attacks From Our Chat With Alex Stamos and Charles Carmakal

Jun 10, 2021

Alex Stamos, Charles Carmakal, & Vinnie Liu discussed the challenges facing supply chain post Solarwinds & Colonial Pipeline attacks. Read their takeaways.

By Bishop Fox, Vincent Liu
Security Perspective

SCOTUS CFAA Ruling: What does it mean for pen testers and security?

SCOTUS CFAA Ruling: What does it mean for pen testers and security?

Jun 4, 2021

Bishop Fox Lead Researcher Dan Petro provides his insights into how the latest CFAA Supreme Court ruling impacts pen testers and security research.

By Dan Petro
Advisory

Froala Editor, Version 3.2.6 Advisory

Froala Editor, Version 3.2.6 Advisory

Jun 2, 2021

One high risk XSS vulnerability was identified within the Froala application.

By Chris Davis
Security Perspective

Prepare for Scoping: The Technical Side

Prepare for Scoping: The Technical Side

May 25, 2021

Scoping is an important precursor to a successful security test. Explore the technical considerations needed when choosing a vendor for a network pen test.

By Claire Tills
Culture

Security Certifications: Choose Your Own Adventure

Security Certifications: Choose Your Own Adventure

May 20, 2021

This Bishop Fox resource will help security professionals understand the pros and cons of obtaining an OSCP, CISSP, SANS GIAC, or other security cert.

By Britt Kemp
Security Perspective

CVE Digest for March and April 2021: Exploits Gone Wild

CVE Digest for March and April 2021: Exploits Gone Wild

May 6, 2021

In this CVE recap of March and April 2021, we review more notable unpatched security vulnerabilities attackers are continuing to target in the wild.

By Britt Kemp
Security Perspective

Ham Hacks: Breaking Into Software-defined Radio

Ham Hacks: Breaking Into Software-defined Radio

Apr 29, 2021

Expand hacking skills for software defined radio (SDR), learn radio basics and hardware/software setup, perform demos, and reverse engineer radio signals.

By Kelly Albrink
Security Perspective

9 Red Team Tools For a Successful Red Teaming Engagement

9 Red Team Tools For a Successful Red Teaming Engagement

Apr 13, 2021

Nine tools we’ve found useful for our red teaming engagements including CursedChrome, Sliver, Githound, Stormspotter, DumpsterFire, Overlord, and more.

By Britt Kemp
Security Perspective

Don’t Shortchange Your Organization’s Security With URL Shortener Services

Don’t Shortchange Your Organization’s Security With URL Shortener Services

Apr 6, 2021

URL shortening services can compromise system security and weaken the attack surface. Protect infrastructure and critical data by not using these services.

By Ori Zigindere
Culture

Selections From the Fox Den: Security and Tech Books We Recommend (and Enjoy!)

Selections From the Fox Den: Security and Tech Books We Recommend (and Enjoy!)

Apr 2, 2021

Hone your hacking, and soft skills with a Bishop Fox curated list of fiction and non-fiction cybersecurity, pen testing, and tech books to keep learning.

By Britt Kemp
Culture

How to Write a CFP That Actually Gets Read

How to Write a CFP That Actually Gets Read

Mar 25, 2021

Learn to write a winning abstract that gets selected when competitive calls for presentations open for conferences like DEF CON, BSides and Black Hat.

By Britt Kemp
Security Perspective

If Your Scope Is Bad, Your Pen Test Will Be Bad

If Your Scope Is Bad, Your Pen Test Will Be Bad

Mar 23, 2021

The quality of an engagement is entirely dependent on the quality of the scoping. If a penetration test doesn’t start with goals, it won't be as successful

By Jessica La Bouve
Load More

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.