Technical Resources

Technical

Latest Technical Resources

Patch Diffing CVE-2024-3400 from a Palo Alto NGFW Marketplace AMI
Apr 19, 2024 Will Vandevanter

Patch Diffing CVE-2024-3400 from a Palo Alto NGFW Marketplace AMI

One of the needs during CVE-2024-3400 testing was the ability to test against a live non-production vulnerable instance. We opted for the Palo Alto NGFW AWS Marketplace AMI.
Introduction to the Ticketing SaaS Landscape
Apr 17, 2024 Nate Fair

Introduction to the Ticketing SaaS Landscape

The shift to remote work has led to significant changes in organizational dynamics and technology infrastructure, particularly in ticketing, help desk, and management platforms. Sprocket pentesters focus on evaluating the security risks associated with these evolving systems, especially in external SaaS environments where the impact can be substantial.
I Love Lucee: Building Lucee Extensions for Remote Code Execution
Mar 15, 2024 Juan Pablo Gomez Postigo

I Love Lucee: Building Lucee Extensions for Remote Code Execution

During the past few assessments, Sprocket has encountered improperly configured instances of Lucee 5 and 4. This blog post will detail a straightforward method to execute remote code after acquiring administrative access to a Lucee login panel.
Subdomain Takeovers - It’s Always DNS
Mar 07, 2024 Justin Wise

Subdomain Takeovers - It’s Always DNS

In this article, we will look at a few different takeover methods, detail how we find them, show how they are exploited, and the easy solution to fixing this potentially severe vulnerability.
Directory Brute-forcing at Scale
Feb 15, 2024 Nicholas Anastasi

Directory Brute-forcing at Scale

Tools such as dirbuster, gobuster, feroxbuster, dirb, and ffuf have been instrumental in uncovering hidden content on websites. These tools and wordlists designed to discover files and directories have become staples in the toolkits of penetration testers and bug bounty hunters. Now more than ever, technology plays a vital role in cybersecurity practices.
Introducing Security Testing in QA
Jan 10, 2024 Sprocket Security

Introducing Security Testing in QA

Fixing these vulnerabilities in production is more expensive than finding and fixing them earlier in the SDLC. One way that organizations can drive down the cost of vulnerability management is by integrating security testing into software quality assurance (QA) testing.
« 2 3 4 5 6 »