Author
Juan Pablo Gomez Postigo
Explore the author's collection.
Resources by Juan Pablo Gomez Postigo
Exploiting N-Day Vulnerabilities at Scale with CPT
A basic guide on how Sprocket utilizes Continuous Penetration Testing to rapidly identify and exploit vulnerabilities. read more →
Password spraying and MFA bypasses in the modern security landscape
Any offensive security operator will tell you that guessing employee credentials is key to compromising your customer’s network – and therefore highlighting vulnerabilities – during a cyber-security engagement. The… read more →
Crossing the Log4j Horizon - A Vulnerability With No Return
A vulnerability was recently disclosed for the Java logging library, Log4j. The vulnerability is wide-reaching and affects both open-source projects and enterprise software. VMWare announced shortly after the release of… read more →
Another Log4j on the fire: Unifi
By now, you’re probably well aware of a recently disclosed vulnerability for the Java logging library, Log4j. The vulnerability is wide-reaching and affects Ubiquiti's Unifi Network Application. In this article, we’re… read more →
How to exploit Log4j vulnerabilities in VMWare vCenter
A vulnerability was recently disclosed for the Java logging library, Log4j. The vulnerability is wide-reaching and affects both open source projects and enterprise software, meaning we need to understand how to ID and… read more →
Traditional vs. Continuous Pentesting: A Comparison Checklist
We get a lot of questions about what makes continuous penetration testing more valuable than traditional timebox testing. Seriously, A LOT of questions – all of which are warranted. Take a look below, and we’re pretty… read more →
Never Stop Frontin’: Redirector and Proxy Setup Made Easy
Protecting your infrastructure from prying eyes is an important part of landing a phish and maintaining access to a client’s network. The process of setting up redirectors and reverse proxies has traditionally been… read more →
CPT in the wild: 3 real-world examples that prove its value
We get it, regular ol’ once-a-year penetration testing is the norm. It’s what your company has budgeted for, what you’re IT team is used to, and in many cases, what your expected to do. But that doesn’t mean it’s the… read more →
The ultimate tag team: PetitPotam and ADCS pwnage from Linux
PetitPotam and ADCS exploitation are nothing short of amazing. Exploitation is a breeze and results in full domain admin access. With these two TTPs, an attacker can hop on a network, exploit the vulnerability, do some… read more →
#PrintNightmare: Print Spooler Vulnerability Check
Hey, you love printers right? They’re that reliable, steadfast piece of technology that always seems to work and never gives you any headaches ... right? Well, buckle up. Microsoft is releasing emergency security… read more →
Fix Cleartext Password Issues in Your Organization
The key to our engagements often and unfortunately involve the discovery of credentials on internal network file shares. We’re going to show you how we find cleartext password storage problems and how to address them. read more →
Never had a bad day phishing. How to set up GoPhish to evade security controls.
I’m going to quickly go through the process of setting up GoPhish and show you how we evade defenders to increase the success rate of our phishing campaigns. read more →
Continuous Human & Automated Security
The Expert-Driven Offensive
Security Platform
Continuously monitor your attack surface with advanced change detection. Upon change, testers and systems perform security testing. You are alerted and assisted in remediation efforts all contained in a single security application, the Sprocket Platform.
Expert-Driven Offensive Security Platform
- Attack Surface Management
- Continuous Penetration Testing
- Adversary Simulations