TL;DR I deployed canary tokens in various public places on the Internet, logged all access attempts, and discovered intriguing patterns on credential discovery and attack methodologies of threat actors. Canary Tokens Primer Canary tokens are a type of digital tripwire…
In today’s cloud-centric world, managing your AWS infrastructure efficiently is paramount. One of the most powerful tools for this purpose is the AWS Command Line Interface (CLI). The AWS CLI is a unified tool to manage your AWS services. With…
In the bustling city of Philadelphia during the 18th century, fire was a constant and terrifying threat. Wooden structures, open flames, and a lack of organized firefighting resources made the city vulnerable to devastating blazes. It was in this environment…
What are Honeypots? A honeypot, in its simplest form, is a decoy system or network designed to attract hackers. By mimicking the vulnerabilities and data of real systems, honeypots serve as a trap to lure attackers, allowing security teams to…
Google’s Threat Analysis Group (TAG) just released a very interesting analysis of the offensive cyber activities between Israel, Iran and Hamas-Linked groups. The research covers offensive activities both leading to Oct 7th and after Oct 7th. In a recent in-depth…
Remote Code Execution (RCE) is considered the holy grail in web application security. As a seasoned penetration tester, I’ve uncovered various techniques over the years to achieve RCE. In this blog post, I’ll share seven of these methods in more…
Your organization is a castle, and in this modern age, cyber threats are the besieging army at your gates. The ladders are up, the catapults are drawn back, and a breach is only a matter of time. Sounds dramatic? Maybe,…
The Secure Development Life Cycle (SDLC) is an approach to software development that incorporates security measures into each phase, from planning to deployment. Traditional software development life cycles often treat security as an afterthought, focusing more on feature development and…
In recent years, the world of cybersecurity has witnessed a dramatic rise in the sophistication and maturity of bug bounty programs. With tech giants and startups alike offering enticing rewards to those who can discover vulnerabilities in their systems, a…
In today’s digital age, penetration testing isn’t just a luxury; it’s an absolute necessity. But let’s face it: diving into the world of cybersecurity and choosing a penetration testing service can feel like you’re walking through a maze blindfolded. Everywhere…