Tool Talk is a one-of-a-kind series where we shed light on tools and research that could help protect your organization – specifically from an offensive security perspective. Each episode features our offensive security experts as they break down and demo one specific tool. Insights include the origins and technical components of the tool, how pen testers can leverage them to find and exploit vulnerabilities, and how to integrate them in their tool box.
"My message to companies that think they haven't been attacked is: ‘You're not looking hard enough.’ ”
— James Snook, Deputy Director, UK Office for Cyber Securityaa
Subscribe to the Tool Talk Series
By submitting this form, you indicate that you have read and agree to the terms of our Privacy Policy.
Thank you for your interest. Watch your mailbox for the next Tool Talk episode!
Learn how to power up web application security testing with tips on creating customized extensions featuring BurpCage, an extension that replaces any image proxied through Burp Suite leveraging the Montoya API.
Watch to see security expert Matt Keeley share why Spoofy was developed, how Spoofy enables security professionals, and a Spoofy demo to find out if your domain is spoofable.
Related Blog Post
Spoofy: An Email Domain Spoofing Tool
Related Blog Post
Our Favorite Tools of the Year: 2022 Edition
Watch about asminject.py
, a Bishop Fox code injection tool that tampers with trusted Linux processes to capture sensitive data and change program behavior. We explore why the tool was developed and how it interacts with the target process to capture sensitive data.
Watch as we explore CloudFox, a Bishop Fox command line tool that helps offensive security practitioners navigate unfamiliar cloud environments and find exploitable attack paths in cloud infrastructure.
Learn a new test harness for debugging Ruby exploits, why this technique improves hacking prowess, and how to use this application for attack emulation.
Watch to see ripgen, a Bishop Fox open-source tool, in action and learn how to stretch your knowledge of subdomain permutations.
Related Blog Post
Taking the Guesswork Out of Subdomain Discovery
Related Slide Deck
Ferris Bueller's Guide to Abuse Domain Permutations
Tune in as we cover best practices for redacting sensitive text - and why pixelation isn't one of them. Deep dive into the basics of Unredacter – what it is and how it works, why it is tricky to beat redaction, how to make sure redacted text is hidden, and a demo showcasing the tool in action.
Related Blog Post
Never, Ever, Ever Use Pixelation for Redacting Text
Related Blog Post
Solving the Unredacter Challenge
Research & Tool Page
Unredacter: How to Unredact Pixelized Text
Join Bishop Fox as we dive into ProjectDiscorery's open-source tool Nuclei, a fast and customizable vulnerability scanner based on simple YAML-based DSL.
Related Blog Post
Nuclei: Packing a Punch with Vulnerability Scanning
Related Video
The Mind Behind Nuclei, Demo with Sandeep Singh
Watch how fuzzing is a great way to spot vulnerabilities and bugs in your software. Learn more about fuzzing, see it in action, and start using it.
Related Research
An Intro to Fuzzing (AKA Fuzz Testing)
Related Blog Post
Our Top 9 Favorite Fuzzers
Watch Dan Petro give a demonstration of Eyeballer, a Bishop Fox open-source penetration testing tool powered by artificial intelligence that assesses a repository of screenshots for indications of potential vulnerabilities, supplements automated scanning methods to close gaps in coverage, and improves testing times and accuracy.
Are you ready to uncover your digital footprint and get a real-time, attacker’s view of your perimeter? Request a demo to see the Cosmos platform in action.
This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.