Offensive
Security Blog

Technical Research

A How-To Guide for Using Sliver

Aug 5, 2019

Sliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS.

By Joe DeMesy, Ronan Kervella

Technical Research

A Need for Vigilance in Open Source Software: Dolibarr CRM Advisory Release

Jul 31, 2019

Bishop Fox researcher Priyank Nigam highlights the need for vigilance in open source security. He provides an overview of the vulnerabilities he found in Dolibarr ERP CRM.

By Priyank Nigam

Advisory

AeroGarden Version 1.3.1 - Multiple Vulnerabilities

Jul 30, 2019

Vulnerabilities in the Aerogarden mobile app would allow an attacker to inflict damage to plant life and/or capture traffic to access the users’ account information.

By Jason Gay

Advisory

Dolibarr Version 9.0.1 — Multiple Vulnerabilities

Jul 25, 2019

Bishop Fox researcher Priyank Nigam identified 3 high-risk security vulnerabilities in Dolibarr version 9.0.1. These vulnerabilities include RCE + XSS.

By Priyank Nigam

Advisory

InterSystems Cache 2017.2.2.865.0 and 2018.1.2 Multiple Vulnerabilities

Jul 24, 2019

Chris Davis identified several high-risk security vulnerabilities in the Intersystem Cache. This security advisory details the exploits and the solutions.

By Chris Davis

Technical Research

GitGot Tool Release

Jul 18, 2019

GitGot is a Bishop Fox tool that browses GitHub for sensitive secrets. It's the brainchild of Jake Miller, and you can learn how to use it in this write-up.

By Jake Miller

Technical Research

Going Semi-Automated in an Automated World: Using Human-in-the-Loop Workflows to Improve Our Security Tools

Jul 18, 2019

GitGot is a Bishop Fox tool that browses GitHub for sensitive secrets. It's the brainchild of Jake Miller, and you can read more about it in this blog post.

By Jake Miller

Advisory

Tegile Intelliflash OS Version 3.7.0.8.180413 (GA) - Password Disclosure

May 14, 2019

The Tegile IntelliFlash OS was affected by a password disclosure vulnerability, which is explained in Thiago Campos' advisory.

By Thiago Campos

Advisory

Greyhound Critical Vulnerabilities - Road Rewards Program

Apr 11, 2019

Critical vulnerabilities were identified in the Greyhound APIs primarily due to insufficient authentication controls. Exploitation of these could result in the exposure of personally identifiable information.

By Priyank Nigam

Industry

My Path to Security - How Christie Terrill Got Into Security

Mar 25, 2019

VP of Customer Success Christie Terrill shares her cybersecurity career journey and her life at Bishop Fox in this blog post.

By Bishop Fox

Advisory

Cantemo Portal Version 3.8.4 - Cross-Site Scripting

Mar 8, 2019

Cantemo AB is a software systems and technology vendor for major media outlets. Chris Davis identified a high-risk vulnerability in it.

By Chris Davis

Advisory

Simple – Better Banking (Android) v. 2.45.0 – 2.45.3 - Sensitive Information Disclosure

Feb 21, 2019

The Simple – Better Banking Android application was affected by an information disclosure vulnerability, which you can read about in this advisory.

By Matt Hamilton

Advisory

Amtrak Mobile APIs - Multiple Vulnerabilities

Feb 19, 2019

The Amtrak mobile APIs are affected by vulnerabilities that can lead to exposed PII and partial payment data for Amtrak guests.

By Priyank Nigam

Advisory

OpenMRS - Insecure Object Deserialization

Feb 4, 2019

This write-up details a critical Bishop Fox-identified vulnerability in OpenMRS, a collaborative open-source healthcare project.

By Nicolas Serra

Industry

My Path to Security - How Tom Wilhelm Got Into Security

Jan 21, 2019

See how Bishop Fox Practice Director Tom Wilhelm has enjoyed a long and rewarding career in cybersecurity in this blog post.

By Bishop Fox

Advisory

Silverpeas 5.15 To 6.0.2: Path Traversal

Jan 15, 2019

A Bishop Fox researcher discovered a critical vulnerability in the Silverpeas application, a popular open source WEB platform that services multiple high-profile French organizations.

By Bastien Faure

Advisory

PhpSpreadsheet Versions<=1.5.0 - XXE injection

Nov 30, 2018

Bishop Fox researcher Alex Leahu found an XML External Entity (XXE) Injection vulnerability in the PhpSpreadsheet library.

By Alex Leahu

Advisory

YunoHost 2.7.2 to 2.7.14 - Multiple Vulnerabilities

Oct 30, 2018

YunoHost is an application that is used to manage applications hosted on a Linux server; Florian Nivette identified several vulnerabilities in it.

By Florian Nivette

Advisory

Eaton UPS 9PX 8000 SP - Multiple Vulnerabilities

Oct 19, 2018

Bishop Fox researchers identified three security vulnerabilities in the Eaton power management appliance manufactured by Eaton Corporation Plc.

By Kelly Albrink

Advisory

SV3C L-Series HD Camera – Multiple Vulnerabilities

Oct 16, 2018

This security advisory describes several vulnerabilities found in the SV3C L-Series HD Camera, version 2.3.4.2103-S50-NTD-B20170823B and below.

By Jefferino Siqueria

Industry

My Path to Security - How Gerben Kleijn Got Into Security

Oct 11, 2018

Learn how Gerben Kleijn - a Bishop Fox Managing Consultant - got his start in an infosec career, which ultimately took him to his current job at Bishop Fox.

By Bishop Fox

Advisory

Wallabag 2.2.3 to 2.3.2 - Stored Cross-Site Scripting

Sep 17, 2018

Wallabag is an open source RSS reader application, distributed under an MIT license. A Bishop Fox researcher identified a stored cross-site scripting vulnerability in it.

By Florian Nivette

Advisory

Subsonic 6.1.1 - Multiple Vulnerabilities

Sep 17, 2018

Florian Nivette identified several vulnerabilities in Subsonic, an open source web media server that enables the management of media resources.

By Florian Nivette

Advisory

CremeCRM 1.6.12 - Multiple Vulnerabilities

Aug 30, 2018

Two vulnerabilities were identified in CremeCRM: 29 instances of stored cross-site scripting and one instance of reflected link manipulation.

By Florian Nivette