Technical Blog

Learn from our experienced security professionals through technical how-to guides, disclosures, and more. 

Read our most recent blog posts, articles, case studies, news, announcements, and more from our Cyber Advisors business blog.

    Oct 28, 2024 10:04:18 AM | Sneaking Past the Bouncer:Identifying Web Servers Behind WAFs

    Learn techniques to identify web servers behind Web Application Firewalls (WAFs), bypass middleman s...

    Oct 28, 2024 9:57:55 AM | Server Compromise Through Report Generation: A Case Study

    Discover how a web application vulnerability in an outdated PDF generator led to a server compromise...

    Oct 28, 2024 9:54:06 AM | Manage Burp Suite Display Settings with DisplaySwitcher

    Optimize your Burp Suite display settings effortlessly with the new DisplaySwitcher extension, enabl...

    Oct 28, 2024 9:51:36 AM | Learning A Language By Learning To Speak To Machines

    Learn how to build fundamental understanding in Rust by creating a simple API server and client appl...

    Oct 28, 2024 9:49:29 AM | From Hello World API to Simple Command and Control Server

    Learn how to transform a simple Rust API into a command-and-control server with step-by-step guidanc...

    Oct 28, 2024 9:46:46 AM | Using Fiddler for Burp Suite Windows Native Authentication (Kerberos)

    Learn how to use Fiddler to enable Kerberos authentication for Burp Suite on Windows, ensuring seaml...

    Oct 28, 2024 9:43:54 AM | Juggling Application Tokens Using Burp Suite’s CSRF Token Tracker Extension

    Master CSRF token handling in Burp Suite using the CSRF Token Tracker extension to ensure accurate a...

    Oct 28, 2024 9:40:26 AM | Bulk Send To Repeater Burp Suite Extension

    Streamline your API and web application penetration testing with Burp Suite's Bulk Send To Repeater ...

    Oct 15, 2024 6:00:00 AM | how to become a penetration tester, exploitation, exploit, how to pentest, PDF, SSRF, Local File Inclusion, PDF injection PDF Server-Side Request Forgery | Cyber Advisors Technical Blog

    Justin Benjamin from Cyber Advisors demonstrates a recent penetration testing case study of a PDF Se...

    Oct 14, 2024 2:50:27 PM | how to lock pick, how to, how to pick a lock, pentesting,, pentesting tools How To Pick A Tubular Lock

    Expert Cyber Advisor penetration tester, Brett DeWall, demonstrates how to pick a tubular lock in th...

    Oct 14, 2024 2:50:22 PM | AMA, Adversarial Simulation, how to lock pick, how to, how to pick a lock, tools, pentesting tools, social engineering, lockpicking Lockpicking: Wafer Lock, AMA – Part 2

    Cyber Advisors lockpicking guide & AMA on wafer locks! Continue to learn how to master lock pick...

    Oct 14, 2024 2:50:17 PM | AMA, Adversarial Simulation, ford fleet keys, check pins, how to lock pick, how to, door lock picking, how to pick a lock, lockpicking Lockpicking: Legal Whims & Tumbling Pins – AMA Part 1

    Learn the basics of lockpicking, legal aspects of owning/using tools in the US, & what you need ...

    Oct 11, 2024 1:02:14 PM | coding, Boo Programming Language, Boo Language, Boo Language Dead, how to, How to be a pentester, interactive interpreter Boo Language

    Knock, knock! Who’s there? Boo! Boo who? It’s Boo language, the spooky dead language that you may no...

    Oct 11, 2024 1:01:55 PM | Adversarial Simulation, Alternative Execution Macro Saga, ActiveX Alternative Execution Macro Saga: Performance Monitor – Part 3

    In the last few blogs in our Alternative Execution Macro Saga: (part 1 – InkPicture & part 2 – W...

    Oct 11, 2024 1:01:38 PM | My Xbox Live 1.0 for Android – Cleartext Storage of Sensitive Information

    Summary=======My Xbox Live application for Android (version 1.0) stores sensitive information in cle...

    Oct 11, 2024 1:01:29 PM | Adversarial Simulation, application penetration testing, application security, Disclosures, Frevvo, Frevvo disclosure Frevvo Vulnerability Disclosure

    White Oak Security discovered a “Zip Slip” Authenticated Remote Code Execution vulnerability in Frev...

    Oct 11, 2024 1:01:18 PM | application security, EyeWitness, Jenkins servers, authentication risks, authentication vulnerabilities, Gowitness, Jenkins Unauthenticated: Jenkins Edition

    A pentester at White Oak Security accesses an unauthenticated Jenkins server, an interesting target ...

    Oct 11, 2024 1:01:06 PM | Bloodhound, active directory Enhance, Enhance, Enhance…

    Modifying Security Focus With Bloodhound Prerequisite viewing: Let’s Enhance At a very basic level, ...

    Oct 11, 2024 1:00:57 PM | application penetration testing, Dockerizing A Web App Testing Environment, application security, golang, cloud penetration testing, application pentesting, docker, dockerizing test environment, building a test environment, cloud pentesting Dockerizing A Web Testing Environment: Part 3

    In the previous posts, part 1 and part 2, for this blog series we created an environment where we ca...

    Oct 11, 2024 1:00:40 PM | DNS tool, Dns Attack, DNS Recon, DNSscope DNSscope: Tool for Automating DNS Recon

    White Oak Security Introduces DNSscope Tool White Oak Security’s experts created a tool to make perf...

    Oct 11, 2024 12:59:54 PM | burp, fingerprinting Service Fingerprinting Through External Interaction – Part 1

    External Service Interaction through DNS or HTTP is one way to identify out-of-band server interacti...

    Oct 11, 2024 12:59:42 PM | Leadership, interview, application security, application security program roadmap, Christopher Emerson, building an application security program, Application security program Building An Application Security Program

    Our CEO and founder, Christopher Emerson, is regularly asked to provide his expertise, opinion, and ...

    Oct 11, 2024 12:59:18 PM | CLSID, Adversarial Simulation, Alternative Execution Macro Saga, ActiveX, COM, ActiveMovie Control Alternative Execution Macro Saga: ActiveMovie Control – Part 6

    Over the past five blogs (part 1, part 2, part 3, part 4, part 5) of the Alternative Execution Macro...

    Oct 11, 2024 12:58:49 PM | Adversarial Simulation, bruteforce Social Engineers Best Friend – Part 2: Bruteforcing RFIDs

    In a previous blog post, I talked about downloading, installing, and using the Proxmark3 for social ...

    Oct 11, 2024 12:58:34 PM | Leadership, interview, how to become a penetration tester, Advice for Pentesters, becoming pentester, How to be a pentester What Is A Penetration Tester

    Welcome to this post in the Interview With A Pentester blog series! We will interview a White Oak Se...

    Oct 11, 2024 12:58:14 PM | CBSSports.com Cross-Site Request Forgery

    Summary=========The CBSSports.com fantasy sports sites do not prevent unauthorized execution of sens...

    Oct 11, 2024 12:58:05 PM | CVE-2023-34060, CVE, Disclosures, 0-day VMware Authentication Bypass Zero Day Alert

    VMware has issued an advisory (VMSA-2023-0026) for an authentication bypass vulnerability (CVE-2023-...

    Oct 11, 2024 12:57:53 PM | Adversarial Simulation, email scams Phishing Attack: A Modest Email Investigation

    Ever get a weird scam email and wonder why? Here is a White Oak Security blog about phishing attacks...

    Oct 11, 2024 12:57:32 PM | Adversarial Simulation Take Over Situations: Part 1 – Zabbix Vulnerability

    In this blog series, we will be performing a walkthrough of interesting domain takeovers that have o...

    Oct 11, 2024 12:57:19 PM | Leadership, 2024, CCDC, Defense, cyber security events CCDC 2024

    Each year, hundreds of students compete in the Collegiate Cyber Defense Competition. Starting off th...

    Oct 11, 2024 12:56:46 PM | Leadership, interview, cybersecurity industry, how to become a penetration tester, becoming pentester, How to be a pentester, cyber security mentor, cyber security education Cyber Security Mentor

    Today in our Interview With A Pentester blog series, we deep dive into the mind of White Oak Securit...

    Oct 11, 2024 12:56:12 PM | CBSSports.com Horizontal Access Control Bypass (Scoreboard Chat)

    Summary=========The CBSSports.com fantasy sports sites did not properly enforce access control betwe...

    Oct 11, 2024 12:56:03 PM | Adversarial Simulation, bluetooth, Exfiltration, Defense, cars Vehicle Personal Information & Exfiltration

    I recently purchased a used vehicle from a local dealership, and so far, so good! My Chevy Cruze wor...

    Oct 11, 2024 12:55:21 PM | egress filtering, Defense, External Network penetration testing, egress The Importance of Egress Filtering

    “Egress filtering is the practice of monitoring and potentially restricting the flow of information ...

    Oct 11, 2024 12:55:06 PM | Hack challenge, Google map data, gralhix, geolocation, how to, Challenge 005 OSINT Challenge: Gralhix Challenge 005

    This blog will focus on solving an OSINT (Open-Source Intelligence) challenge put out by Sofia Santo...

    Oct 11, 2024 12:54:37 PM | Guest Blog, Strategic Insight Guest Blog: Attracting & Retaining Women in Security – Part Two

    In my last post, I talked about how the shortage of security professionals and the fact that women m...

    Oct 11, 2024 12:54:27 PM | UFC on Xbox LIVE for Android – Cleartext Storage of Sensitive Information

    Summary=======The UFC on Xbox LIVE application for Android (version 1.0) stores sensitive informatio...

    Oct 11, 2024 12:54:10 PM | Leadership, cybersecurity industry, cybersecurity opportunities, executive pov, cyber security summit, cyber security events, cyber security education Maximizing Red Team Engagement Potential

    Red Team, Take Two: Insights From Both The Consultant & The Executive – Presentation Join us at ...

    Oct 11, 2024 12:53:52 PM | android pentesting, how to, android penetration testing Mobile Security Framework (MobSF) Overview: Part 1

    Kurt begins a mobile security framework, or MobSF, overview White Oak Security blog series by gettin...

    Oct 11, 2024 12:53:40 PM | adb, android pentesting, how to, android debug bridge, android penetration testing Android Debug Bridge (ADB) Guide

    Learn the mobile app testing tool Android Debug Bridge, or ADB. White Oak’s guide covers installatio...

    Oct 11, 2024 12:53:26 PM | Disclosures Extensis Portfolio Vulnerability Disclosure

    During an external penetration test, White Oak Security discovered an instance of the Extensis Portf...

    Oct 11, 2024 12:53:01 PM | exploitation, Disclosures, exploit, CVE-2022-30190 Microsoft Office Zero Day: Mitigate NOW

    Microsoft has acknowledged a remote code execution vulnerability, CVE-2022-30190, which is possible ...

    Oct 11, 2024 12:51:38 PM | White Oak Security Case Study: ProcessBolt

    ABOUT PROCESSBOLT ProcessBolt is a purpose-built third-party risk assessment platform that simplifie...

    Oct 11, 2024 12:50:34 PM | Leadership, Advice for Pentesters, becoming pentester, Defense, How to be a pentester, behind the scenes Penetration Testing Partner

    Your Penetration Testing PARTNER, Not Your Adversary This blog post is intended to help organization...

    Oct 11, 2024 12:50:00 PM | HelpBridge for Android – Cleartext Storage of Sensitive Information

    Summary=======HelpBridge application for Android (version 1.0.2) stores sensitive information in cle...

    Oct 11, 2024 12:49:50 PM | Adversarial Simulation, Alternative Execution Macro Saga, ActiveX, COM, Alternative Execution Alternative Execution Macro Saga: Windows Media Player – Part 2

    In the previous blog in this Alternative Execution Macro Saga: part 1 – InkPicture, (this is part 2 ...

    Oct 11, 2024 12:49:15 PM | AWS pentesting, AWS security, Cloud Security, AWS, cloud penetration testing, AWS password policy, AWS console, GoAWSConsoleSpray, cloud pentesting, AWS penetration testing GoAWSConsoleSpray: Password Spraying Tool

    GoAWSConsoleSpray – A Simple AWS Console Password Spraying Tool As part of our Cloud Security Penetr...

    Oct 11, 2024 12:47:49 PM | application penetration testing, app penetration testing, application security, app pentesting, application pentesting Server-Side Request Forgery Attack & Fix

    SSRF Attack We recently came across a privilege escalation attack avenue during a web application / ...

    Oct 11, 2024 12:47:33 PM | Google Chat, Google cloud, Google API, Google, developer tools, how to, Google Data Retrieving Google Task Data

    Working in a cloud environment, like C-suite, can be very convenient. They provide lots of functiona...

    Oct 11, 2024 12:47:17 PM | Adversarial Simulation, exploitation, EDR, LSASS, how to Access Without Mimikatz: Internal Monologue

    Credential Access Without Mimikatz On a recent engagement, a client implemented multiple EDR solutio...

    Oct 11, 2024 12:47:04 PM | MSN World 1.4.2 for Android – Cleartext Storage of Sensitive Information

    Summary=======MSN World application for Android (version 1.4.2) stores sensitive information in clea...

    Oct 11, 2024 12:46:51 PM | Tales From The Red Team: Building Winexe

    During one of our Red Team Engagements we were able to gain a foothold on our client’s perimeter via...

    Oct 11, 2024 12:45:50 PM | client-side, ecommerce (Very Simple) Checkout Manipulation Fun with PayPal

    Many small businesses (and to be fair, several large businesses as well) use an external vendor to h...

    Oct 11, 2024 12:45:39 PM | Leadership Preparing For Ransomware Attacks

    The effects of ransomware attacks are no longer limited to large corps, it’s important for the avera...

    Oct 11, 2024 12:44:38 PM | HP SiteScope, HP No-Scoped HP SiteScope

    Overview Recently on an internal penetration test engagement I ran into an installation of HP SiteSc...

    Oct 11, 2024 12:44:26 PM | Guest Blog, Strategic Insight Guest Blog: Attracting & Retaining Women in Security – Part Three

    In my last two posts, I talked about how the shortage of security professionals and the fact that wo...

    Oct 11, 2024 12:44:14 PM | Leadership, interview, application security, Christopher Emerson, building an application security program Building An Application Security Program: Part 2

    Read Part 1 here.. Last time we talked about how you would start an application security program and...

    Oct 11, 2024 12:43:57 PM | Apple iOS 13 Device Setup for Penetration Testing

    [HERE’S A COMPANION POST ON SETTING UP AN ANDROID DEVICE FOR PENETRATION TESTING] One of the initial...

    Oct 11, 2024 12:43:11 PM | CBSSports.com Horizontal Access Control Bypass (Trades & Add/Drop)

    Summary=========The CBSSports.com fantasy sports sites do not properlyenforce access control between...

    Oct 11, 2024 12:42:59 PM | Advanced TTPs, DotNettoJScript Advanced TTPs – DotNetToJScript – Part 3

    In our last blog we walked through modifying the UnmanagedPowerShell project to produce a version of...

    Oct 11, 2024 12:41:48 PM | Disclosures, command execution LogicalDOC Vulnerability Disclosure

    White Oak Security discovered several vulnerabilities in the document management system, LogicalDOC,...

    Oct 11, 2024 12:40:16 PM | application penetration testing, application security, authentication vulnerabilities, application pentesting Unauthenticated: XXE Edition

    Welcome to another installment of Unauthenticated! In this post, we will look at a recent web applic...

    Oct 11, 2024 12:40:02 PM | bluetooth We’ve Been Hacked By Mice!

    MouseJack, originally discovered by Bastille, is a vulnerability that affects many wireless (non-Blu...

    Oct 11, 2024 12:39:51 PM | burp suite plugins, application penetration testing, application security, burp suite reshaper, burp suite extensions, penetration testing with Burp Suite, AuthMatrix, burp suite tools, application pentesting, Burp Suite, authorize Sculpting Burp Extension Output With Burp Suite Reshaper Plugin

    One of the reasons that Burp Suite has become a standard tool for Web Application Penetration Testin...

    Oct 11, 2024 12:39:37 PM | amazon The Amazon Scam (COVID-19)

    Lately, I have received more phishing emails in my burner (test) email that are related to Amazon th...

    Oct 11, 2024 12:39:24 PM | Leadership, assessments, Different types of security testing Types Of Security Testing: Scans, Assessments, Pentests

    Learn about different types of security testing, like the differences between Scans vs Vulnerability...

    Oct 11, 2024 12:39:10 PM | Advice for Pentesters, how to, beginner, How to be a pentester Basics Of Soldering: Guide For Tech Enthusiasts

    In the realm of technology, soldering holds significant importance. Whether you’re working with elec...

    Oct 11, 2024 12:38:57 PM | hacking password, password, how to, hamming distance, Defense, Insecure password Hamming Distance & Password Variation

    We’ve all had this experience: Your password is required to be changed every so often, and now you’v...

    Oct 11, 2024 12:38:30 PM | day care, Strategic Insight Think Of The Children (part 1)

    As my wife recently started an at-home daycare, we have done testing of different child activity tra...

    Oct 11, 2024 12:38:18 PM | DNS tool, application security, burp suite extensions, penetration testing with Burp Suite, burp suite tools, how to, free tools, Burp Suite New Burp Suite Extension Blows Your SOCKS Off

    Improving Quality-Of-Life With Simple Burp Suite Extensions (Part One) If you have been using Burp S...

    Oct 11, 2024 12:37:38 PM | Adversarial Simulation, adversary, Cyber security kill chain Red Teaming Guide | Part 1

    So You Want a Red Team: The Primer In my former life, I was a member of an institutional Red Team at...

    Oct 11, 2024 12:37:15 PM | insecure application, application penetration testing, app penetration testing, application security, app pentesting, Insecure password reset, application pentesting, Insecure password Insecure Password Reset

    Brett uncovers an insecure password reset during a pentest, this post will go through the password r...

    Oct 11, 2024 12:37:01 PM | application security, penetration testing with Burp Suite, Burp Suite Web App Pentesting With Burp Suite Scan Profiles

    What separates a tool from a tester? Read White Oak Security’s blog about pentesting web apps effici...

    Oct 11, 2024 12:36:45 PM | Adversarial Simulation, Domain admin, domain compromises Take Over Situations: Part 3 – SQL Injection to Domain Admin

    White Oak Security recently performed a red team engagement for a client where we discovered subsidi...

    Oct 11, 2024 12:36:31 PM | healthcare ransomware Healthcare Ransomware Attacks

    Our EndPoint & Ransomware Simulation services have a positive impact on White Oak’s clients, lea...

    Oct 11, 2024 12:31:45 PM | budget, Strategic Insight Small Company Security On A Budget – Part 1

    Life is filled with the best of intentions, such as wanting to win the lottery or keep the work emai...

    Oct 11, 2024 12:31:36 PM | Adversarial Simulation, Endpoint detection and response, EDR, LSASS, cylance, Domain admin, LOLBin Bypassing Defenses: Cylance

    Bypassing defenses with Cylance during a White Oak Security’s red team engagement to extract domain ...

    Oct 11, 2024 12:30:16 PM | how to, Cloud Security, AWS, cloud penetration testing, cloud pentesting, ARNs, cloud security audit Parsing ScoutSuite Results With jq

    Cloud Security Audits Supported by other tools and manual analysis, ScoutSuite provides a solid base...

    Oct 11, 2024 12:28:45 PM | Disclosures, Escalation, FTP, copy TitanFTP Vulnerability Disclosure

    White Oak Security discovered multiple vulnerabilities in the TitanFTP NextGen server owned by South...

    Oct 11, 2024 12:28:28 PM | exploit BlazeDS Java Object Deserialization Exploit Walkthrough

    During a recent internal network penetration test, we saw indications that an Adobe ColdFusion host ...

    Oct 11, 2024 12:28:13 PM | application security, api, how to, Blind Cross-Site Scripting, GCPXSSCanary, burp collaborator, gcp, blind xss Blind XSS & GCP Functions: GCPXSSCanary

    An Intro to Blind XSS & Secure GCP Functions During a recent engagement, I ran across an instanc...

    Oct 11, 2024 12:28:01 PM | free tools Gone In 60 Mobile Apps – part 1

    This series of posts is in no way showcases a full penetration test, which does a much deeper dive i...

    Oct 11, 2024 12:27:49 PM | CLSID, Adversarial Simulation, Alternative Execution Macro Saga, ActiveX, COM Alternative Execution Macro Saga: CLSID – Part 5

    Hello again and thanks for returning to our Alternative Execution Macro Saga series! Over the last f...

    Oct 11, 2024 12:27:35 PM | Leadership, Adversarial Simulation, best practices, Device security testing, device security, Defense, 405(d), health industry, healthcare Managing Cybersecurity Threats In Health Industry

    Health Industry Threats Health industry threats are still on the rise. Healthcare organizations rema...

    Oct 11, 2024 12:27:21 PM | What’s In A Social Engineering Toolkit?

    One of the many services that White Oak Security offers is Onsite Social Engineering. As a pentester...

    Oct 11, 2024 12:27:08 PM | application penetration testing, application security, burp suite extensions, burp, Application security program, application pentesting, Burp Suite, app security, tls passthrough, addtoTLSpassthrough 1.0.1 AddToTLSPassThrough 1.0.1 Version Burp Extension Release Notes

    Following our initial release of the addToTLSPassThrough Burp Suite Extension, we are pleased to ann...

    Oct 11, 2024 12:27:01 PM | Adversarial Simulation, active directory, internal penetration test Take Over Situations: Part 2 – Zerologon

    This blog post will walk through utilizing publicly available exploit code to compromise a network t...

    Oct 11, 2024 12:26:08 PM | Cloud Security, cloudfront, Cobalt Strike Solution, Command & Control, user agent, Cobalt Strike, Netskope Can I See Your “USER AGENT” Please?

    Recently, on an assessment, I was working on trying to bypass AMSI+EDR in order to get our lovely Co...

    Oct 11, 2024 12:25:53 PM | Strategic Insight Guest Blog: Attracting & Retaining Women in Security – Part One

    According to estimates, there will be a shortage of 2 million cybersecurity professionals worldwide ...

    Oct 11, 2024 12:25:42 PM | android Android 10 Device Setup for Penetration Testing

    [COMPANION POST FOR APPLE DEVICES] One of the initial challenges of performing an Android mobile app...

    Oct 11, 2024 12:25:29 PM | Brief CMD+CTRL Cyber Range Review

    Secure360 just took place here in Minnesota on May 14th through the 15th. One interesting addition t...

    Oct 11, 2024 12:25:10 PM | application penetration testing, app penetration testing, application security, burp suite extensions, app pentesting, burp suite tools, how to, application pentesting, Burp Suite, app security, extend sessions, session timeout, application vulnerability Burp Suite: Session Timeout Vulnerabilities & Session Extension

    Penetration Testing is often an exercise of observing the behavior of the target, and then finding c...

    Oct 11, 2024 12:24:53 PM | guide, how to, Defense, internal penetration test, Active Directory Security, AD security, ad hardening Active Directory Security

    AD Hardening For penetration testers who do many internal network penetration tests, the process ten...

    Oct 11, 2024 12:24:34 PM | Adversarial Simulation, 0-day 0-Day In A Multi-Million Dollar Machine

    Overview I was engaged to perform a mainframe penetration test recently. What is a mainframe? Mainfr...

    Oct 11, 2024 12:24:16 PM | Tales From The Red Team: What the Heck is Virgo?

    Our Red Team engagements generally start out as technical as possible. We start with OSINT and some ...

    Oct 11, 2024 12:24:02 PM | injection, csv CSV Injection – What’s the Risk?

    Today we’re going to talk a bit about CSV injection. First of all, what is CSV Injection? “CSV Injec...

    Oct 11, 2024 12:23:46 PM | Adversarial Simulation Skim Job: Skimming Your Way In

    Skim Job is White Oak Security’s RFID skimmer project, discover how we did this social engineering R...

    Oct 11, 2024 12:23:35 PM | Adversarial Simulation, Alternative Execution Macro Saga, ActiveX, Alternative Execution, disable activex controls, disable controls, controls Alternative Execution Macro Saga: Microsoft Web Browser – Part 7

    Welcome to the last post in the Alternative Execution Macro Saga series (part 1 – InkPicture, part 2...

    Oct 11, 2024 12:23:20 PM | application security, dockerizing test environment, dockerizing a web testing environment Dockerizing A Web Testing Environment: Part 1

    Discover White Oak Security’s how to blog series part one on dockerizing a web testing environment, ...

    Oct 11, 2024 12:23:14 PM | Network Security, exploitation, application penetration testing, app pentesting, how to, Bypassing OpenSSH, Bypassing OpenSSH MaxAuthTries Bypassing OpenSSH MaxAuthTries

    Chances are if you’re reading this article, you are in the middle of a penetration test against a fa...

    Oct 11, 2024 12:23:08 PM | Hack challenge, Google map data, geolocation, how to, Hacktoria, geolocation 16 OSINT Challenge: Hacktoria Geolocation 16

    What Is OSINT? For those who aren’t familiar with the term, OSINT stands for Open Source Intelligenc...

    Oct 11, 2024 12:22:58 PM | interview, Strategic Insight, Christopher Emerson, cyber security summit White Oak Founder/CEO Interview

    Christopher Emerson was interviewed at this year’s Cyber Security Summit (2019) about the organizati...

    Oct 11, 2024 12:21:23 PM | CBSSports.com Vunerabilities

    I want to start by thanking the folks at CBS Interactive andCBS Corporation for working so diligentl...

    Oct 11, 2024 12:20:59 PM | Adversarial Simulation Social Engineers Best Friend – Part 1: Proxmark3 & RFIDs

    When performing onsite social engineering engagements for clients, regardless of industry, 95% of th...

    Oct 11, 2024 12:20:41 PM | application penetration testing, application security, app pentesting, application pentesting, invalid usernames, invalid users Determining Valid User Accounts In Web Applications

    New security breaches are occurring on an almost daily basis. Attackers often gather breach data in ...

    Oct 11, 2024 12:20:07 PM | Adversarial Simulation, exploitation, Cloud Security, docker, internal penetration test Unauthenticated: Docker Edition

    Welcome to a new installment of Unauthenticated! One of my goals with this series is to drive home t...

    Oct 11, 2024 12:19:49 PM | Strategic Insight, Christopher Emerson, Anatomy of a Hack Christopher Emerson’s Secure360 Presentation

    A number of people had asked for a copy of Christopher’s presentation (Anatomy of a Hack) from the 2...

    Oct 11, 2024 12:19:42 PM | Some Tips for Analyzing Malicious Word Documents

    Most people these days have one of those burner email addresses – used for product sign-ups, etc.. I...

    Oct 11, 2024 12:19:29 PM | DotNettoJScript DotNetToJScript – Redux

    In my previous several blog posts (here, here, and here) we covered usage of a really interesting to...

    Oct 11, 2024 12:19:13 PM | enumerating, application security, how to, dockerizing test environment, building a test environment, dirb, creating a testing environment, custom word list, dockerizing a web testing environment, enumerating a web root Dockerizing A Web Testing Environment: Part 2

    Part 2 on dockerizing a web testing environment and crafting custom wordlists by White Oak Security,...

    Oct 11, 2024 12:18:49 PM | application security, penetration testing with Burp Suite, burp, burp suite tools, developer tools, how to, Burp Suite, burp collaborator, cursor Cursor Chaos: Tackling The Text Troublemaker In Burp Suite Professional

    Burp Suite Professional’s User Interface is one of the most advanced Java UIs out there, but everyon...

    Oct 11, 2024 12:18:28 PM | CVE, Disclosures, CentreStack, CentreStack Vulnerability Disclosure CentreStack Disclosure

    Note: Updated 6/9/2023 to update official CVE IDs White Oak Security discovered an instance of Gladi...

    Oct 11, 2024 12:18:07 PM | application security, Gowitness, Jenkins Jenkins: Remote Execution Via Malicious Jobs

    This article is a follow-up to Unauthenticated: Jenkins Edition where we discussed the dangers of un...

    Oct 11, 2024 12:17:53 PM | Advice for Pentesters, application security, Learn To Code Success In Pentesting: Learn To Code

    White Oak Security’s expert pentesters share a tip in their success: learn to code! Whether you’re i...

    Oct 11, 2024 12:16:53 PM | how to Nmap: Host Discovery

    This article describes how to enhance the default Nmap host discovery phase to include SYN and ACK p...

    Oct 11, 2024 12:16:47 PM | From VEEAM to Domain Administrator

    On a recent Internal Penetration Test engagement, I was reviewing some Nessus scan data and came acr...

    Oct 11, 2024 12:16:32 PM | burp, fingerprinting Service Fingerprinting Through External Interaction-Part 2

    External Service Interaction through DNS or HTTP is one way to identify out-of-band server interacti...

    Oct 11, 2024 12:16:24 PM | Advanced TTPs, DotNettoJScript Advanced TTPs – DotNetToJScript – Part 2

    Last time we went through an overview of the awesome DotNetToJScript project, and why you should be ...

    Oct 11, 2024 12:16:17 PM | Disclosures CVE-2012-5868: WordPress 3.4.2: Sessions Not Terminated Upon Explicit User Logout

    Summary ========== WordPress 3.4.2 fails to invalidate a user’s sessions upon logout. WordPress was ...

    Oct 11, 2024 12:16:10 PM | Adversarial Simulation, data breaches GitHub Cave Of Wonders: Secrets – Part 1

    GitHub Cave Of Wonders – Part 1 begins to dive into secrets management & how data repositories a...

    Oct 11, 2024 12:16:03 PM | CBSSports.com Horizontal Access Control Bypass (Trading Block)

    Summary=========The CBSSports.com fantasy sports sites did not properly enforce access control betwe...

    Oct 11, 2024 12:14:35 PM | Guest Blog, Strategic Insight Attracting & Retaining Women in Security – Part Four

    In my last post, I talked about some of the reasons that women are leaving the security profession a...

    Oct 11, 2024 12:14:22 PM | Disclosures, how to, Bravia Sony Bravia Remote Code Execution Disclosure

    Sony Bravia Overview Sony’s BRAVIA Signage (1) is an application to deliver video and still images t...

    Oct 11, 2024 12:14:09 PM | application security, burp suite extensions, penetration testing with Burp Suite, burp suite tools, how to, free tools, Burp Suite Find What Sparks Joy In Your Burp Suite Proxy History With Subtractive Scoping

    Improving Quality-Of-Life With Simple Burp Suite Extensions (Part Two) The “right tool for the job” ...

    Oct 11, 2024 12:13:58 PM | Leadership, interview, cybersecurity industry, how to become a penetration tester, cybersecurity opportunities, how to, How to be a pentester, career path How To Become A Penetration Tester

    This year, I gave a talk at GenCyber at the Alexandria Technical College in northern Minnesota. As a...

    Oct 11, 2024 12:13:37 PM | burp suite plugins, free tools, Burp Suite 5 Useful & Free Burp Suite Plugins

    At White Oak Security, we do a variety of engagement types. Previously, we’ve written several posts ...

    Oct 11, 2024 12:12:02 PM | Leadership, cybersecurity opportunities, in person opportunties, bug bounty, bug bounty hunting, cyber security events, bugcrowd Bugcrowd

    Pentesting and bug bounty hunting go hand-in-hand. Several of our pentesters find joy in bug bounty ...

    Oct 11, 2024 12:11:53 PM | Disclosures Microsoft Lync Server 2010: Remote Code Execution/XSS – User Agent Header

    Summary ========== Microsoft Lync 2010 fails to properly sanitize user-supplied input, which can lea...

    Oct 11, 2024 12:11:38 PM | Behind the Bug

    During a recent engagement, I was tasked with testing a web application, in a non-production environ...

    Oct 11, 2024 12:11:27 PM | Matt Stellmacher Joins White Oak Security!

    White Oak Security is excited to announce that Matt Stellmacher has joined the company to lead sales...

    Oct 11, 2024 12:11:18 PM | Cloud, docker Tales From The Red Team: Deploying Kali in Containers in Your Cloud

    This is a story from one of our more recent Red Team engagements and what we did after gaining acces...

    Oct 11, 2024 12:11:08 PM | application security, don't believe everything you see Invisible Data in Web App Pentesting – Don’t Believe Everything You See

    Don’t believe everything you see! Invisible or hidden data in web application pentesting could be re...

    Oct 11, 2024 12:08:56 PM | Advanced TTPs, DotNettoJScript Advanced TTPs – DotNetToJScript (Part 1)

    About three years ago Google Project Zero’s researcher James Forshaw released the excellent DotNetTo...

    Oct 11, 2024 12:08:26 PM | day care, daycare Think Of The Children (part 2 – the Second Born)

    While researching daycare software online we identified multiple providers / companies that offered ...

    Oct 11, 2024 12:08:07 PM | Gone in 60 Mobile Apps – part 2

    This series of posts is in no way showcases a full penetration test, which does a much deeper dive i...

    Oct 11, 2024 12:07:15 PM | Adversarial Simulation, Alternative Execution Macro Saga, ActiveX, COM Alternative Execution Macro Saga: InkPicture – Part 1

    This is the first in a series called the Alternative Execution Macro Saga – if you’re interested in ...

    Oct 11, 2024 12:06:57 PM | accessibility Accessibility Within Application Security Tools

    Before we get into the nuts and bolts of this post, I need to provide a little background. The COVID...

    Oct 11, 2024 12:06:34 PM | bug bounty frustrations, bug bounty, Defense, How to be a pentester, bug bounty hunting Bug Bounty Frustrations

    Recently, the pentesters here at White Oak Security have run into some common frustrations regarding...

    Oct 11, 2024 12:06:18 PM | CVE, Disclosures Fishbowl Disclosure: CVE-2022-29805

    Finding A Shell In Your Fishbowl White Oak Security discovered an instance of Fishbowl Inventory tha...

    Oct 11, 2024 12:06:01 PM | STEM Methodology Process

    Our STEM Methodology process is White Oak Security’s unique, 3 phrase approach to personalized penet...

    Oct 11, 2024 12:05:51 PM | Adversarial Simulation, Advice for Pentesters, adversary Threat Hunter

    Learn how threat hunting enhances penetration testing by identifying malicious activity in logs and ...

    Oct 11, 2024 12:04:52 PM | Leadership, cybersecurity industry, CCDC, cyber security events CCDC 2023

    Red Team Volunteering Experiences From The Collegiate Cyber Defense Competitions This blog post will...

    Sep 19, 2024 3:34:00 PM | api, how to, how to pentest, part 2, prep, postman How to Prepare for an API Pentest – Postman

    Part 2 of the How To Prepare For API Pentesting series looks into Postman by Cyber Avisors Daniel sa...

    Sep 19, 2024 3:34:00 PM | api, how to, curl, part 3 How To Prepare for an API Pentest – Curl

    Part 3 of how to prepare for an API pentest, featuring Curl by Daniel at Cyber Advisors.

    Sep 19, 2024 3:34:00 PM | api How To Prepare for an API Pentest – Insomnia

    This is one part of a series of posts on how to prepare your API for a pentest. Check back in the ne...

    Sep 19, 2024 4:00:00 AM | Flipper pentesting, Flipper setup, how to, Flipper, Flipper fanclub, Flipper tool, Flipper Zero Multi Tool, Flipper Zero Hacking Tool, part 1 Flipper Fanclub: Part 1 – Flipper Zero Pentesting

    Flipper Zero is a tiny tool perfect for pentesters, IT professionals, & techies alike. White Oak...

    Sep 19, 2024 4:00:00 AM | Flipper Zero, Flipper pentesting, Flipper Zero Update, Flipper setup, how to, Firmware, Flipper, Flipper fanclub, Flipper tool, Flipper Zero Multi Tool, Flipper Zero Hacking Tool, part 2 Flipper Fanclub: Part 2 – Updating Flipper Zero

    Updating Flipper Zero firmware is easy with Cyber Advisors Flipper fanclub part 2 guide, with both m...

    Sep 19, 2024 12:30:00 AM | #automation, application penetration testing, app penetration testing, app pentesting, AuthMatrix, how to, application pentesting, Burp Suite, authorization testing, automating authorization testing, part 1 Automating Authorization Testing: AuthMatrix – Part 1

    Cyber Advisors series covers what is authorization testing & AuthMatrix’s basic setup of roles, ...

    Sep 19, 2024 12:30:00 AM | #automation, application penetration testing, app penetration testing, app pentesting, AuthMatrix, how to, application pentesting, authorization testing, automating authorization testing, chains, part 2 Automating Authorization Testing: AuthMatrix – Part 2

    Part 2 of Authomating Authorization Testing by White Oak Security dives into some more AuthMatrix ad...

    Sep 19, 2024 12:00:00 AM | Adversarial Simulation, how to, part 1 MiniDumpDotNet: MiniDumpWriteDump – Part 1

    Part 1 of Cyber Advisors MiniDumpDotNet blog, in which we examine the Win32 API call & walk thro...

    Sep 19, 2024 12:00:00 AM | Adversarial Simulation, how to, part 2, minidumpdotnet MiniDumpDotNet: Pure CLR Alt – Part 2

    Cyber Advisors MiniDumpDotNet - Part 2, we go through the current projects available & how we ad...

    Sep 18, 2024 3:48:00 PM | Adversarial Simulation, gophish, DNS tool, golang, how to, gophish setup, autosneakphish, part 4 Phishing Email For Success – Part 4

    Jeffrey Green conducts successful phishing email campaigns all the time, learn how to make your own ...

    Sep 18, 2024 3:47:00 PM | Adversarial Simulation, gophish, DNS tool, automated tools, golang, how to, gophish setup, autosneakphish, part 3 Phishing For Success – Part 3 & Autosneakphish Tool

    Part 3 Phishing For Success builds out a phishing infrastructure & uses automated tools to bypas...

    Sep 18, 2024 3:46:00 PM | Leadership, Adversarial Simulation, executive pov, intro to phishing, company integrity, part 2 Phishing For Success – Part 2

    Phishing For Success Part 2 dives into phishing leadership topics of why, when, where, by who, &...

    Sep 18, 2024 3:45:00 PM | Leadership, Adversarial Simulation, executive pov, intro to phishing, company integrity, part 1 Phishing For Success – Part 1

    Part 1 of Phishing For Success by Jeffrey Green is an intro to phishing from an executive's perspect...

    Sep 18, 2024 2:59:23 PM | basics, authentication vulnerabilities, authentication, simple security fails, part 5 Simple Security Fails: part 5 – Basic Authentication

    Brett DeWall wraps up the simple security fails series part 5 on basic authentication issues that we...

    Sep 18, 2024 2:55:16 PM | part 4, simple security fails, servers Simple Security Fails: part 4 – Extraneous Server Content

    Welcome back to Simple Security Fails - Part 4 talks about extraneous server content! Megan Roby tal...

    Sep 18, 2024 2:51:04 PM | api, docker, part 3, simple security fails, docker daemons Simple Security Fails: part 3 – Exposed Docker Daemon API

    Brett Dewall continues the Simple Security Fails series in part 3 he describes exposed Docker daemon...

    Sep 18, 2024 2:45:58 PM | input validation, part 2, simple security fails, inproper input Simple Security Fails: part 2 – Improper Input Validation

    Cyber Advisors Simple Security Fails Part 2 - by Megan Roby dives into improper input validation! Sh...

    Sep 18, 2024 2:39:45 PM | security, basics, directory, beginner, how to pentest, part 1, fails, simple security fails Simple Security Fails: part 1 – Directory Listing

    Cyber Advisors' Brett DeWall talks about simple security fails - part 1 dives into directory listing...

    Sep 17, 2024 9:02:47 PM | CVE, Disclosures, CVE-2018-19859, zip slip Zip Slip to Reverse Shell in OpenRefine

    White Oak Security discovered a “Zip Slip” Authenticated Remote Code Execution vulnerability in Frev...

    Sep 17, 2024 8:34:18 PM | Adversarial Simulation, Cobalt Strike Solution, C2 Infrastructure Automation, Command & Control, C2 Infrastructure, C2, Cloud provider, Cobalt Strike Cobalt Strike OpSec

    This Cyber Advisor Cobalt Strike OpSec blog can help Red Team/pentesting experts remove unnecessary ...

    Sep 17, 2024 11:20:03 AM | Adversarial Simulation, application security, how to, DNS, Bypass Using DNS To Bypass SSRF Protections

    This Cyber Advisors post shows a quick & easy method for bypassing a denylist type of control wh...

    Sep 17, 2024 6:57:57 AM | Bloodhound, how to, pentesters bestfriend, Neo4j Database, Cypher Query BloodHound Cypher Query Primer for BloodHound

    A primer on how to use Cypher queries within the Neo4j web console to investigate your BloodHound da...

    Sep 17, 2024 6:53:11 AM | Conveigh, Adversarial Simulation, Endpoint detection and response, EDR, CanaryPi, Broadcast Poisoning Detection Tools, Broadcast Poisoning Honeypot, bait requests, Defense, Bypassing defenses, bypassing responder detections Identifying & Bypassing Responder Detections

    Talis Ozols goes into detail on tools used to set up honeypot broadcast requests & how to identi...

    Sep 16, 2024 9:31:20 PM | enumerating, GraphQL Voyager, field suggestions, application security, api, burp suite extensions, burp suite tools, Apollo GraphQL, how to, GraphiQL, ferox, Burp Suite, graphQL GraphQL APIs & Enumeration Basics

    Dive into GraphQL! Learn how the query language works, security considerations, tools/techniques to ...

    Sep 5, 2024 8:59:58 PM | application penetration testing, app penetration testing, application security, app pentesting, CORS, application pentesting, app security, CORS attack, application vulnerability Fun With CORS

    Cyber Advisors found a misconfiguration that allowed us to use a CORS attack to steal session tokens...

    Mar 14, 2024 9:53:37 AM | application penetration testing, app penetration testing, application security, penetration testing with Burp Suite, burp, burp suite tools, how to, application pentesting, Burp Suite, app security, Perfunctory Proxy Slam The Door Shut On Burp Suite’s Perfunctory Proxy

    Burp Suite has some really cool features that make it useful as an HTTP Swiss Army Knife. It’s great...

    Dec 13, 2023 5:20:34 AM | Disclosures, authentication vulnerabilities, easy access, KingConnect KingConnect Vulnerability Disclosure

    Upon recent discovery, White Oak Security discloses four vulnerability issues in the KingConnect KWM...

    Nov 2, 2023 4:43:31 AM | Microsoft, Adversarial Simulation, Network Security, best practices, how to, Defense, Bypassing defenses, Attack, active directory, kerbrute, impacket, evilwinrm, AS-REP Roasting, kerberoasting, CrackMapExec, Detection and Monitoring, Bypass Flying Under The Radar: Bypassing Microsoft Defender For Identity Detections

    Talis Ozols' guide shows several methods for bypassing Microsoft Defender for identifying detections...

    Oct 4, 2023 10:57:00 PM | VPN, how to become a penetration tester, Hack challenge, golang, how to, How to be a pentester, how to pentest Pivoting VPN Process Tunneling: Ligolo-ng

    Cyber Advisors uses Ligolo-ng to get a network pivot point that can relay reverse shells & file ...

    Sep 30, 2023 12:00:00 AM | cyber security events, Cyber Advisors News White Oak Security Is Now Cyber Advisors!

    White Oak Security is now Cyber Advisors! Now we have experienced, friendly penetration testing and ...

    Aug 18, 2023 3:30:00 PM | LSASS, best practices, Defense, Attack, active directory, Detection and Monitoring, pentesting, Attacks & Defenses: Dumping LSASS With No Mimikatz

    Talis (formerly White Oak Security) demonstrates the tools & the how to guide on both attacks &a...

    Aug 8, 2023 9:02:01 AM | Adversarial Simulation, Network Security, adversary, LSASS, how to, Defense, Bypassing defenses, credential dumping protections, how to pentest, drivers, credential dumping, Bypass Credential Dumping Protections: Part 2 - Bypass LSA Protection

    Learn about methods & techniques attackers use to bypass LSA Protection & dump credentials f...

    Jul 27, 2023 5:36:33 AM | burp suite plugins, guide, golang, how to, free tools, Burp Suite Nuclei Plugin & Burp Suite – Template Creation Guide

    Cyber Advisors guides you through how the Nuclei template generator plugin works & why its integ...

    Jul 11, 2023 10:20:14 AM | Adversarial Simulation, Network Security, adversary, LSASS, how to, Defense, domain level group policy, credential dumping protections, credential dumping Credential Dumping Protections: Part 1 - LSA Protection

    Windows Credential Dumping Protections blog part 1 by Bryan Valarezo shines light on LSA Protection,...

    Jun 30, 2023 3:12:19 AM | Adversarial Simulation, application penetration testing, application security, password, how to, hashcat, How to be a pentester, hash types, attack mode types Hashcat Quick Guide Techniques & Tips

    Hashcat guide by Joshua Platz on targeted password cracking in engagements/environments with techniq...

    Apr 27, 2023 4:09:25 AM | application penetration testing, APKLeaks, application security, how to, APK APKLeaks: Discover Leaks Within APK Files

    Cyber Advisors pentester shares a mobile application penetration testing tool called APKLeaks that s...

    Mar 16, 2023 7:33:32 AM | Adversarial Simulation, Network Security, Frequency jamming, hardware security, Device security testing, device security, internet of things, iot security LoRa Frequency & Penetration Testing

    White Oak Security discusses the security of the LoRa frequency, including common threats, approache...

    Jan 4, 2023 10:12:11 AM | cracking password, exploitation, hacking password, CVE, Disclosures, Escalation, exploit, how to, ODAT, hashcat, oracle databases, CVE-2018-3004, Attack Exploiting Oracle Databases With ODAT

    Read a real-world example of a misconfigured Oracle database that allowed Cyber Advisors to complete...

    Dec 15, 2022 6:38:58 AM | Adversarial Simulation, Escalation, how to, Domain admin, Defense, Attack, internal penetration test, Account operators Account Operators Privilege Escalation

    This Account Operators Privilege Escalation how-to blog by Talis Ozols shares the Account Operators ...

    Oct 20, 2022 1:54:00 AM | Leadership, Intro to penetration testing, getting started, becoming pentester, how to, intro to pentesting, How to be a pentester, becoming a penetration tester, how I got started How I Became A Penetration Tester

    This series of blog posts was sparked from a recent internal discussion and is really just to learn ...

    Oct 7, 2022 6:42:34 AM | application security, burp suite reshaper, example, burp suite macros, penetration testing with Burp Suite, burp suite tools, how to, Burp Suite Burp Suite Macros – Reshaper Guide

    Burp Suite's tools sometimes cause issues for pentesters, so Cyber Advisors created a how-to guide t...

    Aug 25, 2022 6:34:37 AM | exploitation, how to, Burp Suite, batching attacks, graphQL GraphQL Batching Attacks: Turbo Intruder

    Michael Rand, one of our penetration testing experts, demonstrates how to exploit GraphQL batching a...

    Aug 4, 2022 8:44:00 AM | best screenshot tool, best practices, best performance setup, screenshot tools, tools, pentesting tools Screenshot Tool: Part 6 – Which Tool Is Best?

    Part 6 of the Screenshot Tool series compares the top 5 HTTP screenshot tools to figure out which to...

    Jul 28, 2022 6:31:38 AM | best screenshot tool, best performance setup, Aquatone, screenshot tools, tools, pentesting tools Screenshot Tool: Part 5 – Aquatone

    Aquatone is the featured penetration testing tool for part 5 of Michael Rand’s Screenshot Tool blog ...

    Jul 21, 2022 12:38:00 AM | golang, Gowitness, best performance setup, pentesting,, screenshot tools, tools, pentesting tools Screenshot Tool: Part 4 – Gowitness

    Part 4 of the screenshot tool series covers the features within the Gowitness tool, how easy it is t...

    Jul 14, 2022 6:22:02 AM | best screenshot tool, becoming pentester, best performance setup, screenshot tools, tools, pentesting tools Screenshot Tool: Part 3 – Snapback

    Welcome back pentesters & bug bounty hunters to our cyber advisors tech team's screenshot tool s...

    Jun 30, 2022 1:55:00 AM | best screenshot tool, best performance setup, screenshot tools, tools, pentesting tools Screenshot Tool: Part 2 – WitnessMe

    In reviewing the top HTTP screenshot tool series, Cyber Advisors presents part 2 on how to use the W...

    Jun 23, 2022 3:27:07 AM | EyeWitness, best performance setup, screenshot tools, tools, pentesting tools Screenshot Tool: Part 1 – EyeWitness

    Cyber Advisors reviews the top HTTP screenshot tools that are currently available for pentesters or ...

    May 19, 2022 4:36:33 AM | Bypassing Doors, how to, bypassing REX sensor, Defense, Bypassing defenses, can of compressed air, compressed air, tools, pentesting tools, redteam, social engineering Bypassing Doors – Part 4: Compressed Air

    Part 4 of Brett DeWall's Bypassing Doors shares how to bypass REX sensors (Request to Exit sensor) w...

    May 12, 2022 7:18:48 AM | Bypassing Doors, how to, bypassing REX sensor, Defense, free tools, Bypassing defenses, how to pentest, tools, pentesting tools, redteam, social engineering Bypassing Doors – Part 3: REX Sensor

    Cyber Advisors, Brett's part 3 of the Bypassing Doors series shows how our experts bypass REX sensor...

    May 5, 2022 6:15:27 AM | Bypassing Doors, how to, Defense, bypassing double doors, double doors tool, DDT, tools, pentesting tools, redteam, social engineering Bypassing Doors – Part 2: DDT

    Part 2 of Cyber Advisors Bypassing Doors series, we demonstrate the Double Door Tool or the DDT. Wat...

    Apr 28, 2022 6:39:25 AM | Bypassing Doors, how to, Defense, Bypassing defenses, tools, pentesting tools, hacking, redteam, social engineering Bypassing Doors – Part 1: UTDT

    Wonder how our pentesters open doors without the keys or access? In this part 1 of Bypassing Doors s...

    Apr 6, 2022 5:24:56 AM | gophish, how to, gophish setup, gandi domain, gandi Gophish Setup: Gandi – Part 2

    In this part 2 post of the Gophish Setup series, Cyber Advisors will be configuring Gophish with a m...

    Feb 17, 2022 2:02:00 AM | editing bytecode, application penetration testing, fix, application security, app pentesting, how to, java editing bytecode, application pentesting, app security Modifying Java By Editing Bytecode

    Pentesters at Cyber Advisors share how to modify compiled Java executables by editing bytecode, whic...

    Jan 5, 2022 3:23:56 AM | gophish, getting started, how to, gophish setup, How to be a pentester Gophish Setup – Part 1

    This post by cyber advisors dives into the functionality & usage of the tool, Gophish, used to d...

    Sep 23, 2021 5:54:09 AM | Adversarial Simulation, Endpoint detection and response, EDR, Bypassing defenses Bypassing Defenses: Symantec Endpoint Protection

    Cyber Advisors highlights how we bypassed the EDR solution Symantec Endpoint Protection, enabling kn...

    Jul 15, 2021 5:09:08 AM | application security, how to Installation & Use Of TestSSL.sh Tool

    Discover how to use, configure, & install one of Cyber Advisors penentration testers, Brett DeWa...

    Jun 9, 2021 7:09:00 AM | android pentesting, how to, android penetration testing, how to root, pentesting tools How To Root A Google Pixel 4a

    Brett DeWall (one of our pentesters) is back at it again, with Cyber Advisors new blog - a guide on ...