Offensive Security Blog

CVE-2017-11779 could lead to takeover of user’s device - this technical write-up covers implications, the actual exploit, and remediation steps.

Windows DNS Client – Memory Corruption Vulnerabilities

Oct 10, 2017

By Nick Freeman

Culture

My Life at Bishop Fox

Sep 15, 2017

I’m picky about where I work. I don’t like companies that seem to run an internship program simply because everyone else has one. Bishop Fox proved to me that it’s possible to find an impactful, rewarding, and fun internship outside of the traditional options.

By Alex Lynch

CORS is not obsolete as feared - but rather, it's become part of a larger standard known as FETCH.

Is CORS Becoming Obsolete?

Sep 6, 2017

By Tim Sapio

Sarahah, the chat app marketed as being "anonymous," has a disturbing secret - a Sarahah leak may endanger the contact info of possibly millions of users.

Hot New ‘Anonymous’ Chat App Hijacks Millions of Contact Data

Aug 28, 2017

By Zach Julian

In this Marten Mickos interview, Vincent Liu chats with HackerOne's CEO on his beliefs in transparency and the changing face of the security industry.

Bug Bounties & Beyond: An Interview With HackerOne's Mårten Mickos

Aug 23, 2017

By Vincent Liu

Breaking Drone Defenses: Using Chicken Wire to Defeat Net Projectile-Based Products

Breaking Drone Defenses: Using Chicken Wire to Defeat Net Projectile-Based Products

Aug 3, 2017

By Francis Brown

Read an account of creating an XSS worm on a popular email hosting service provider.

How I Built An XSS Worm On Atmail

Jun 23, 2017

By Zach Julian

A stored XSS vulnerability was identified in the webmail component of atmail 7. This security advisory by Zach Julian discusses it in detail.

atmail 7 Stored XSS Vulnerability

Jun 23, 2017

By Zach Julian

Nathan Elendt breaks down implications of the newly drafted NIST password guidelines in this post. Learn how your organization can best harness them.

What the Newly Drafted NIST Password Guidelines Mean to You

May 30, 2017

By Nathan Elendt

Email spoofing is an antiquated attack that 98 percent of the internet is vulnerable to - even in the modern age. Defend yourself with our tool, SpoofCheck.

How We Can Stop Email Spoofing

May 23, 2017

By Alex DeFreese

An improper access control vulnerability was discovered by Baker Hamilton in the SolarWinds’ Log & Event Manager (LEM) management console (CMC).

SolarWinds Log & Event Manager - Improper Access Control

May 12, 2017

By Baker Hamilton

The Bishop Fox assessment team discovered an arbitrary command injection vulnerability within the SolarWinds’ Log & Event Manager (LEM) management console (CMC).

SolarWinds Log & Event Manager - Arbitrary Command Injection

May 12, 2017

By Baker Hamilton

Read Bishop Fox's VPN guide before making a VPN choice for the privacy of your browsing experience.

A Guide to Choosing the Right VPN

Apr 6, 2017

By Kevin Sugihara

A closer examination of the CIA Leak: Don’t get lost in the hype. There is a bright side to strife...

The CIA Leak: A Look On the Bright Side...

Mar 8, 2017

By Dan Petro

BGP hijacking was utilized by the Iranian government in early January 2016. In this microblog, Zach Julian analyzes the technical implications of the event.

In the News: A BGP Hijacking Technical Post-Mortem

Jan 18, 2017

By Zach Julian

A vulnerability in the Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to initiate connections to arbitrary hosts.

Cisco Jabber Guest Server HTTP URL Redirection Vulnerability

Dec 21, 2016

By Jake Miller

Was a lack of network segmentation what foiled the Empire? According to Fran Brown, it was. Right in time for "Star Wars: Rogue One," here is his take.

Star Wars: I Find Your Lack of Segmentation Disturbing

Dec 4, 2016

By Francis Brown

Want to keep your network secure? Working with a shoestring budget? Check out our do-it-yourself network segmentation guide.

A Guide to Do-It-Yourself Network Segmentation

Nov 30, 2016

By Cory Johnson

Josh Koplik is the CISO for IAC as well as the subject of Vincent Liu's latest cybersecurity expert interview. Read their conversation here.

Telling the Security Story: An Interview with Josh Koplik

Nov 10, 2016

By Vincent Liu

Three vulnerabilities were discovered in the Accellion Kiteworks appliance. The three vulnerabilities are described in this Bishop Fox security advisory.

Accellion Kiteworks Multiple Vulnerabilities

Sep 8, 2016

By Shubham Shah

In our latest cybersecurity leaders feature, Richard Seiersen from GE Healthcare shares his decision making philosophy with Bishop Fox's Vincent Liu.

What Security Leaders Can Learn About Decision-Making

Aug 24, 2016

By Vincent Liu

Bishop Fox's Dan Petro explains the creation of his SmashBot AI character and how he implemented time-honored hacker techniques in the development process.

Game Over, Man! Reversing Video Games to Create an Unbeatable AI Player

Aug 10, 2016

By Dan Petro

Internet of Things security often is an afterthought. Nathan Elendt chronicles the do's and do nots of how engineers can create secure connected devices.

How to Engineer Secure Things: Past Mistakes and Future Advice

Jun 15, 2016

By Nathan Elendt