TL;DR I deployed canary tokens in various public places on the Internet, logged all access attempts, and discovered intriguing patterns on credential discovery and attack methodologies of threat actors. Canary Tokens Primer Canary tokens are a type of digital tripwire designed to detect unauthorized access or activity within a system. They work by embedding seemingly […]

In today’s cloud-centric world, managing your AWS infrastructure efficiently is paramount. One of the most powerful tools for this purpose is the AWS Command Line Interface (CLI). The AWS CLI is a unified tool to manage your AWS services. With just one tool to download and configure, you can control multiple AWS services from the […]

In the bustling city of Philadelphia during the 18th century, fire was a constant and terrifying threat. Wooden structures, open flames, and a lack of organized firefighting resources made the city vulnerable to devastating blazes. It was in this environment that Benjamin Franklin, a man of foresight and innovation, took action. In 1736, Franklin observed […]

What are Honeypots? A honeypot, in its simplest form, is a decoy system or network designed to attract hackers. By mimicking the vulnerabilities and data of real systems, honeypots serve as a trap to lure attackers, allowing security teams to study their methods, monitor their activities, and alert in case of breach. Traditionally, Web Honeypots […]

Google’s Threat Analysis Group (TAG) just released a very interesting analysis of the offensive cyber activities between Israel, Iran and Hamas-Linked groups. The research covers offensive activities both leading to Oct 7th and after Oct 7th. In a recent in-depth analysis by Google’s Threat Analysis Group (TAG), the intricate web of cyber operations involving Israel, […]

Remote Code Execution (RCE) is considered the holy grail in web application security. As a seasoned penetration tester, I’ve uncovered various techniques over the years to achieve RCE. In this blog post, I’ll share seven of these methods in more detail. Remote Code Execution (RCE) is a security vulnerability that allows an attacker to execute […]

Your organization is a castle, and in this modern age, cyber threats are the besieging army at your gates. The ladders are up, the catapults are drawn back, and a breach is only a matter of time. Sounds dramatic? Maybe, but the world of cybersecurity is a high-stakes game that commands the same level of […]

The Secure Development Life Cycle (SDLC) is an approach to software development that incorporates security measures into each phase, from planning to deployment. Traditional software development life cycles often treat security as an afterthought, focusing more on feature development and functionality. The purpose of the Secure SDLC is to build security into every aspect of […]

In recent years, the world of cybersecurity has witnessed a dramatic rise in the sophistication and maturity of bug bounty programs. With tech giants and startups alike offering enticing rewards to those who can discover vulnerabilities in their systems, a new generation of security researchers and bug hunters has emerged. But how has this rise […]

In today’s digital age, penetration testing isn’t just a luxury; it’s an absolute necessity. But let’s face it: diving into the world of cybersecurity and choosing a penetration testing service can feel like you’re walking through a maze blindfolded. Everywhere you turn, companies dazzle with jargon, testimonials, and shiny credentials. So, how do you separate […]