Offensive Security Blog

While investigating our clients’ attack surfaces, I find myself repeating tasks frequently enough to demonstrate a need for automation, yet not frequently enough to justify the time needed to develop an automated solution.

A Snapshot of CAST in Action: Automating API Token Testing

Oct 21, 2021

By Zach Zeitlin

Chris Bush provides a review of why secure code review should be an integral part of every DevSecOps lifecycle and the strategies teams should adopt.

The Code Reveals All: Why Secure Code Review Should be an Integral Part of DevSecOps

Oct 12, 2021

By Chris Bush

I am happy to announce that the PDF version of that CTF guide is now available for download!

Behind The CTF Guide “Breaking & Entering: A Pocket Guide for Friendly Remote Admins"

Oct 6, 2021

By Andy Doering

Learn everything you need to know about fuzzing, including who should fuzz, what types of fuzzers exist, how to write a good harness, and more.

An Intro to Fuzzing (AKA Fuzz Testing)

Sep 28, 2021

By Matt Keeley

In a follow up to his IAM Vulnerable tool, Seth Art examines the identification aspect of IAM privilege escalation and reviews IAM privesc assessment tools

IAM Vulnerable - Assessing the AWS Assessment Tools

Sep 23, 2021

By Seth Art

A review of the 2021 CISA and MITRE Vulnerability Lists to understand their similarities and differences, and share our takeaways.

A Review of the 2021 CISA and MITRE Vulnerability Lists

Sep 21, 2021

By Britt Kemp

The IAM Vulnerable tool helps you learn how to identify and then exploit intentionally vulnerable IAM configurations that allow for privilege escalation.

IAM Vulnerable - An AWS IAM Privilege Escalation Playground

Sep 9, 2021

By Seth Art

A recap of some of our favorite DEF CON 29 security talks featuring Patrick Wardle, James Kettle, and Bishop Fox's own Hector Cuevas Cruz.

DEF CON 29 Recap: 9 Talks You May Have Missed

Aug 19, 2021

By Britt Kemp

An insecure filesystem permissions vulnerability was identified in eCatcher version 6.6.4 and earlier. To exploit this vulnerability, an attacker must have a user account on the same machine as the victim and have access to the machine during an active VPN connection.

eCatcher Desktop, Version 6.6.4 Advisory

Aug 17, 2021

By Priyank Nigam

The Bishop Fox team discovered three vulnerabilities that could have a severe business and reputational risk for Wodify.

Wodify

Aug 13, 2021

By Dardan Prebreza

Learn why hardware random number generators (RNG) used by billions of IoT devices to create encryption keys don't always generate random numbers.

You're Doing IoT RNG

Aug 5, 2021

By Dan Petro, Allan Cecil

Culture

10 DEF CON 29 Security Talks to Watch

Jul 27, 2021

A look at DEF CON 29 security talks featuring Ian Coldwater, Chad Rikansrud, and Matt Bryant, plus Bishop Fox's own Dan Petro, and Allan Cecil.

By Britt Kemp

Nine tools we’ve found useful for our post-exploitation efforts including GhostPack, Metasploit, PowerHub, LOLBAS, Mimikatz, PHPSploit, and more.

9 Post-Exploitation Tools for Your Next Penetration Test

Jul 15, 2021

By Britt Kemp

Culture

Spark Your Curiosity With These Security Podcasts

Jun 27, 2021

Bishop Fox shares our favorite security podcasts.

By Britt Kemp

List of free, built-in, or open-source tools & reference material when planning a move to DevSecOps. It’s a starting point to try within your environment.

Free Tools and Add-Ons to Explore for Applying DevSecOps in Your Organization

Jun 24, 2021

By Tom Eston

Bishop Fox is joining our peers in the security industry in cautioning against Section 1201 of the Digital Millennium Copyright Act (DMCA).

Our Position on the Digital Millennium Copyright Act (DMCA) and the Need to Safeguard Tools for Responsible Security Researchers

Jun 23, 2021

By Bishop Fox

Technical details of achieving cross-site scripting (XSS) attacks by using HTML parsing logic where lexical parsers are used to nullify dangerous content.

LEXSS: Bypassing Lexical Parsing Security Controls

Jun 22, 2021

By Chris Davis

Learn why continuous testing will become a requirement for most organizations in the near future.

Why You Need Continuous Testing to Detect Emerging Threats and Discover the Unknowns

Jun 16, 2021

By Bishop Fox

One high risk XSS vulnerability was identified within the the RetroArch for Windows application version 1.9.0.

RetroArch for Windows, Versions 1.9.0 - 1.9.4 Advisory

Jun 15, 2021

By Daniel Fulford

Tom Eston describes the entire DevSecOps lifecycle and what aspects of tooling and testing you can build into the way your organization develops applications.

Applying DevSecOps in Your Organization

Jun 10, 2021

By Tom Eston

Alex Stamos, Charles Carmakal, & Vinnie Liu discussed the challenges facing supply chain post Solarwinds & Colonial Pipeline attacks. Read their takeaways.

New Insights on Supply Chain and Ransomware Attacks From Our Chat With Alex Stamos and Charles Carmakal

Jun 10, 2021

By Bishop Fox, Vincent Liu

Bishop Fox Lead Researcher Dan Petro provides his insights into how the latest CFAA Supreme Court ruling impacts pen testers and security research.

SCOTUS CFAA Ruling: What does it mean for pen testers and security?

Jun 4, 2021

By Dan Petro

One high risk XSS vulnerability was identified within the Froala application.

Froala Editor, Version 3.2.6 Advisory

Jun 2, 2021

By Chris Davis