Sprocket Security

Resources

Explore resources found within the and categories.

Follow & Subscribe

Browse Classifications

Browse Categories

Browse Topics

Browse Tags

Latest Resources

  • 11 min read

One Proxy to Rule Them All

Bypass WAFs with gigaproxy: an HTTP proxy that rotates IPs using mitmproxy, AWS API Gateway, and Lambda. Read the blog to learn more. read more →

  • 9 min read

Exploring Modern Password Spraying: Introduction to Entra Smart Lockout

Delve into the modern techniques and security controls surrounding password spraying. This series will explore the current techniques, tactics, and procedures (TTPs) for password spraying. read more →

  • 7 min read

Pwning SPA’s With Semgrep

Semgrep, or Semantic Grep (For Code) should be a part of your pentesting toolkit. If you think otherwise, read on to see why. read more →

  • 6 min read

PCI DSS 4.0 and a Continuous Offensive Security Strategy

In the ever-evolving landscape of cybersecurity, organizations are constantly challenged to protect their sensitive data. The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 is the latest iteration of… read more →

  • 4 min read

From Twitter to Exploit: The Sprocket Security Lifecycle of Exploitation

Our approach to mass exploitation of the latest and greatest vulnerability. On the chopping block, this time around: CVE-2024-3400. read more →

  • 3 min read

Zip Slip Exploitation in File Uploads with Hackvertor

Learn how to perform Zip Slip testing using custom Hackvertor tags in Burp Suite requests. read more →

  • 3 min read

Patch Diffing CVE-2024-3400 from a Palo Alto NGFW Marketplace AMI

One of the needs during CVE-2024-3400 testing was the ability to test against a live non-production vulnerable instance. We opted for the Palo Alto NGFW AWS Marketplace AMI. read more →

  • 8 min read

Introduction to the Ticketing SaaS Landscape

The shift to remote work has led to significant changes in organizational dynamics and technology infrastructure, particularly in ticketing, help desk, and management platforms. Sprocket pentesters focus on evaluating… read more →

  • 5 min read

Maximize Security with Attack Surface Management and Continuous Penetration Testing

Change Detection is the cog that turns it all for our continuous penetration testing solution. Sprocket’s attack surface management gives your organization deep visibility into the very same shadow IT assets our testers… read more →

  • 7 min read

I Love Lucee: Building Lucee Extensions for Remote Code Execution

During the past few assessments, Sprocket has encountered improperly configured instances of Lucee 5 and 4. This blog post will detail a straightforward method to execute remote code after acquiring administrative… read more →

  • 7 min read

Subdomain Takeovers - It’s Always DNS

In this article, we will look at a few different takeover methods, detail how we find them, show how they are exploited, and the easy solution to fixing this potentially severe vulnerability. read more →

  • 8 min read

Directory Brute-forcing at Scale

Tools such as dirbuster, gobuster, feroxbuster, dirb, and ffuf have been instrumental in uncovering hidden content on websites. These tools and wordlists designed to discover files and directories have become staples in… read more →

Continuous Human & Automated Security

The Expert-Driven Offensive
Security Platform

Continuously monitor your attack surface with advanced change detection. Upon change, testers and systems perform security testing. You are alerted and assisted in remediation efforts all contained in a single security application, the Sprocket Platform.

Watch Demo Request Quote

Expert-Driven Offensive Security Platform

  • Attack Surface Management
  • Continuous Penetration Testing
  • Adversary Simulations