okla.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Oklahoma... we're trying ya'll

Administered by:

Server stats:

33
active users

#Pentesting

20 posts10 participants0 posts today
0x40k<p>Seriously, CSS for spam? Mind. Blown. 🤯 Ran into a situation today where CSS in emails caused total mayhem. It's crazy what people are doing with it!</p><p>Turns out, CSS, that styling language we all know, is getting abused. Think hidden text, user tracking – it's all happening! 😩 Who even considers that kind of stuff?</p><p>CSS isn't just about making things look pretty anymore. Spammers are using stuff like `text_indent` and `opacity` to hide content. Cisco Talos even exposed this. The danger? Phishing and tracking, mainly. The fix? Improved filters and privacy proxies are a good start.</p><p>It kinda reminds me of a pentest where we almost missed a CSS-based phishing page! Sometimes it's the small details that get you, right?</p><p>So, what's the craziest CSS trick you've ever seen used maliciously? I'm all ears! 🤔</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/emailsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>emailsecurity</span></a></p>
0x40k<p>IoT security... still a hot topic, isn't it? An Edimax IC-7100 camera got hacked? Oh, that's an oldie but goodie! Gotta love the Mirai Botnet making a cameo. 🤖</p><p>Seriously though, ancient devices with default passwords? It's basically like leaving the front door wide open for attackers. They're just itching to exploit CVE-2025-1316.</p><p>Yeah, I know, no more patches 'cause it's "old news." But hey, changing that password, checking the firmware, and *not* directly connecting it to the internet can actually make a difference!</p><p>This reminds me of a pentest we did where we almost missed a similar vulnerability. IoT devices can really be tricky to deal with. And honestly, I'd rather help my clients than just sell them something. 😉</p><p>So, what IoT horror stories have *you* encountered? Spill the beans! 👇</p><p>\<a href="https://infosec.exchange/tags/IoTsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IoTsecurity</span></a> \<a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> \<a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a></p>
Bill<p>Hey <a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>appsec</span></a> people. How do you handle organization of testing artifacts when you are dealing with tons of apps? I have a new client in deep water, their app suite is 20 years old and shows it. They have 53 endpoints. </p><p>My testing strategy is not designed for that.</p><p>How do you keep things organized? Is there a cool tool I need to know about? Is it Burp Suite Enterprise time for POINT? How do you keep your notes?</p><p>I know a lot of this is kinda up to your own personal philosophy for testing, but I thought it would make for informative conversation fodder for St. Paddy. ☘️ </p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a></p>
0x40k<p>Cloud security can be a real head-scratcher, right? I mean, 66% of open buckets? Seriously?! 🤯 It seems like a lot of folks underestimate the Shared Responsibility Model. You see, cloud providers handle the infrastructure, but you're responsible for *your* data.</p><p>And get this: AI tools like ChatGPT are making it easier for hackers to create exploits. But hey, let's be real – security by obscurity never truly worked, did it? 🤷‍♂️</p><p>So, what's essential? IAM policies, encryption, logging, and monitoring are all a must. Oh, and don't forget penetration tests! Do them regularly, not just once a year. 😉</p><p>What cloud security challenges have *you* been running into lately? Let me know in the comments below! 👇</p><p><a href="https://infosec.exchange/tags/CloudSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CloudSecurity</span></a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a> <a href="https://infosec.exchange/tags/AWS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AWS</span></a> <a href="https://infosec.exchange/tags/Azure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Azure</span></a> <a href="https://infosec.exchange/tags/GCP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GCP</span></a></p>
0x40k<p>Okay, cybersecurity's been absolutely bonkers this week, right? 🤯 Seriously, Juniper routers got pwned, North Korea's allegedly swiping coal (again!), and now there's malware lurking in Python packages. WTF?! 😵‍💫</p><p>This is just a friendly nudge (or maybe a scream): Update your systems. Like, *now*. And for goodness sake, PLEASE check your supply chain! Otherwise, attackers will be doing the tango on your systems – and trust me, you don't want that dance. 💃</p><p>As a pentester, I see the same basic security gaps over and over. 🤦‍♂️ Honestly, awareness training is pure gold. And while automation is awesome, it doesn't replace good old-fashioned manual testing. You gotta get your hands dirty!</p><p>So, what security headaches are bugging you the most lately? Let's chat! <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a></p>
Rubén Santos García<p>🚀 New Post: Testing Smart Contracts Beyond Unit Tests 🔍</p><p>Unit tests aren’t enough! I dive into:<br>✅ Fuzzing for hidden bugs<br>✅ Invariant testing for stability<br>✅ Advanced testing with Foundry</p><p>🔗 Read now: <a href="https://kayssel.com/post/web3-15/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">kayssel.com/post/web3-15/</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/web3" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>web3</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/smartcontracts" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>smartcontracts</span></a></p>
0x40k<p>Okay, E2EE for RCS, huh? Sounds promising at first glance! 😎 But I've gotta admit, I'm already feeling uneasy about it... RCS was supposed to replace SMS, right? Problem is, it's been a security nightmare up until now. So now they're talking about adding E2EE using MLS. Fine and dandy, but as we all know, the devil's always in the details. Think about implementation and interoperability!</p><p>I'm a firm believer in the saying, "Never trust encryption you haven't personally vetted!" I'm just not sure if this will actually improve things, or if it's just a bunch of marketing hype. What are your thoughts on Security by Obscurity? Are you for it, or against it? Let me know!</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/securityfail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>securityfail</span></a></p>
0x40k<p>Whoa, the U.S. just got a LockBit dev extradited! 🤯 Seriously, though, will this actually change anything? 🤔 I mean, it's good they're doing *something*, BUT... if the money's right, aren't there always gonna be more waiting in the wings? 🤷‍♂️</p><p>As a pentester, I see so many companies that are still ridiculously easy targets. Backups, patches, security awareness training – the basics, right? But so often, they just totally drop the ball! 🤦‍♂️</p><p>What do you all think? Will taking legal action actually make a difference, or is it just a never-ending cat-and-mouse game? 🤔</p><p><a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Ransomware</span></a> <a href="https://infosec.exchange/tags/LockBit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LockBit</span></a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a></p>
0x40k<p>Ugh, that dreaded download button is back! 😈 Cracked software can seem tempting at first, right? But honestly, more often than not, it brings a whole lot more trouble than it's worth. This MassJacker thing is just outrageous. It snatches your crypto address straight from your clipboard – poof, money gone! 💸</p><p>Being a pentester, I gotta say: be super careful about where you're getting your software (or *not* getting it, if you catch my drift 😉). It's definitely better to go the legal and secure route, rather than ending up broke and on the wrong side of the law. Make sure you check your hashes, scan those downloads, and keep your antivirus software updated. And most importantly, don't forget to use your common sense! 🤔</p><p>What are some of your craziest download fail stories? Spill the beans! 👇 <a href="https://infosec.exchange/tags/SecurityAwareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SecurityAwareness</span></a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a> <a href="https://infosec.exchange/tags/Cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybercrime</span></a></p>
0x40k<p>Okay, so this OBSCURE#BAT campaign is seriously next-level stuff! 🤯 Rootkits are bad enough as it is, but throw in some social engineering tactics? Ouch, that's gotta hurt.</p><p>I mean, using captchas and disguising malware as legitimate software like Tor or VoIP clients is just plain nasty. It really highlights how crucial security awareness is these days, doesn't it?</p><p>As a pentester, I see people falling for these kinds of scams way too often, sadly. One wrong click, and bam! You're in trouble. 😩</p><p>So, everyone, please keep your eyes peeled when downloading files! Double-check those sources! And trust me, ad-blockers are definitely your friends. ✌️</p><p>Have you guys had any similar experiences? What social engineering tricks do you find particularly devious? 🤔</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/socialengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>socialengineering</span></a></p>
Lenin alevski 🕵️💻<p>New Open-Source Tool Spotlight 🚨🚨🚨</p><p>Sqlmap is an open-source tool for automating SQL injection detection and exploitation. It supports multiple databases like MySQL, PostgreSQL, Oracle, and more. Widely used for penetration testing, it includes features like database dumping, password cracking, and file system access. </p><p>Remember: powerful tools require responsible use. <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/PenTesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PenTesting</span></a></p><p>🔗 Project link on <a href="https://infosec.exchange/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GitHub</span></a> 👉 <a href="https://github.com/sqlmapproject/sqlmap" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/sqlmapproject/sqlmap</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Infosec</span></a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/Software" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Software</span></a> <a href="https://infosec.exchange/tags/Technology" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Technology</span></a> <a href="https://infosec.exchange/tags/News" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>News</span></a> <a href="https://infosec.exchange/tags/CTF" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CTF</span></a> <a href="https://infosec.exchange/tags/Cybersecuritycareer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecuritycareer</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hacking</span></a> <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>redteam</span></a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>blueteam</span></a> <a href="https://infosec.exchange/tags/purpleteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>purpleteam</span></a> <a href="https://infosec.exchange/tags/tips" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tips</span></a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>opensource</span></a> <a href="https://infosec.exchange/tags/cloudsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cloudsecurity</span></a></p><p>— ✨<br>🔐 P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking 💻🏴‍☠️</p>
0x40k<p>Just stumbled across something kinda scary... SAML authentication issues! Now, I know it sounds super technical, but honestly, this affects ANYONE using Single Sign-On. Seriously!</p><p>Think about logging into Netflix, Google, all that stuff – a lot of it uses SAML. What if someone could just waltz right in pretending to be you? SAML's basically the language websites use to confirm you are who you say you are. And Single Sign-On (SSO) makes it so you only log in once to access everything.</p><p>Now, about CVEs, they're like wanted posters for security flaws. CVE-2025-25291, CVE-2025-25292, CVE-2025-25293 are the numbers to remember. The problem lies in how XML is being interpreted. Two programs, same code, totally different results – NOT GOOD. Imagine two bouncers checking the same ID, but one lets everyone in, and the other doesn't. Total chaos!</p><p>As a pentester, I see these "parser differentials" way more often than I'd like. The devil's always in the details, right?</p><p>Big deal? HUGE. Account Takeover is totally possible! Hackers could swipe your identity. This affects the ruby-saml library – which is frequently used in web applications. Affected versions: &lt; 1.12.4 and &gt;= 1.13.0, &lt; 1.18.0.</p><p>Huge shoutout to GitHub Security Lab for finding this! They're lifesavers.</p><p>Good news, though! Updates are here: ruby-saml 1.12.4 and 1.18.0.</p><p>So, check if your web apps are using ruby-saml. And if they are, UPDATE THEM. Like, NOW. This isn't a joke.</p><p>Also, regular pentests are worth their weight in GOLD. Automated tools often miss stuff like this.</p><p>Do you use SAML? What are your experiences with it? How do you secure your web applications? Ever run into similar parsing issues? Let's share info and help keep everyone safe!</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a></p>
0x40k<p>Wow, North Korea's KoSpy is seriously spying on Android users! 🤯 It just reminds me why I always tell my clients: Don't trust any app you didn't code yourself! Seriously! 😅 And stay away from weird permission requests. Just don't do it!</p><p>Automated scans? Yeah, they're alright to have. But you know what's *really* effective? A proper, manual penetration test. That's how you catch stuff like this! 💪 Trust me!</p><p>So, what are your absolute deal-breakers when it comes to app permissions? 🤔 Let me know down below!</p><p><a href="https://infosec.exchange/tags/MobileSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MobileSecurity</span></a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a></p>
Bill<p>Apropos of nothing, PeopleSoft uses 303 See Other as a response code for auth redirects and whatnot. It's pointed out a weakness in all the cool filters I use. Always learning. <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>appsec</span></a></p>
pentest-tools.com<p>We tested 15 HTML sanitizers and managed to break 3 of them! How We Found XSS in Odoo &amp; Gitea</p><p>Last December two of our security researchers - Alex &amp; Catalin - put 15 HTML sanitizers to the test across Python, Go, JavaScript, and Ruby. The result? Three critical vulnerabilities that impact major platforms used by millions!</p><p>Key findings:<br>✅ Python (lxml.html.clean) – Vulnerability found in Odoo (5M+ users)<br>✅ Go (BlueMonday) – XSS in Gitea (used by Google, MasterCard, OpenStack)</p><p>👉 The research exposed how sanitizers fail to handle edge cases, leading to security risks in chat systems, forums, and self-hosted git platforms.</p><p>🎥 Watch the full keynote for more insights: <a href="https://youtu.be/0M4e347tMds" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">youtu.be/0M4e347tMds</span><span class="invisible"></span></a> </p><p><a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/ethicalhacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ethicalhacking</span></a> <a href="https://infosec.exchange/tags/offensivesecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>offensivesecurity</span></a></p>
0x40k<p>Uh oh, trouble's brewing! 😨 Firefox users, listen up – your add-ons might be about to throw a tantrum! Sounds innocent enough, right? But trust me, an expired certificate can *totally* ruin your day.</p><p>Picture this: your password manager or ad blocker suddenly goes kaput. The culprit? An expired root certificate – basically Firefox's digital ID.</p><p>As a pentester, I see this stuff all the time: these "little things" are prime targets for attacks. An unpatched browser? That's like leaving your back door wide open. So, check your version ASAP (Menu -&gt; Settings -&gt; About Firefox). Anything older than version 128 or ESR 115.13 needs an urgent update! Tor Browser users: you're in the danger zone too! Good news for iOS/iPad users though, you can relax. 😉</p><p>Have you updated yet? And which add-ons are totally indispensable for you? Let me know in the comments!</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>firefox</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/browsersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>browsersecurity</span></a></p>
0x40k<p>Heads up, folks! Meta's FreeType warning (CVE-2025-27363) is something you *definitely* need to take seriously. Remote Code Execution (RCE) through font parsing? Ouch! 😬</p><p>If you're running versions 2.13.0 or earlier, you're vulnerable, so check those Linux distros! Seriously, outdated FreeType versions are basically an open invitation for trouble.</p><p>Speaking as a pentester, I can't stress this enough: never underestimate the security impact of your libraries. Updates are absolutely essential. Automated scans are great and all, but they just can't replace a thorough pentest. It's just the way it is! 😉</p><p>So, how do *you* manage your open-source dependencies? I'm curious to hear your strategies! Drop your thoughts below! 👇</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/freetype" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>freetype</span></a></p>
0x40k<p>Okay, so AI in Pentesting, huh? 🤖 It's definitely a hot topic! A lot of folks instantly worry about losing their jobs, but let's be real: aren't we pentester basically problem-solvers?</p><p>Thing is, AI *can* actually help us speed up the simpler stuff. Think OSINT, CVE checks, and even report writing – AI could give us a boost there. And that would give us *more* time to focus on the really tricky hacks.</p><p>But hey, a word of caution: AI is just a tool, folks. It's not a magic bullet. Creativity and solid experience *still* matter big time! And let's not forget, security *solely* reliant on AI is just plain wrong. Seriously, certificates or no certificates, a company is NOT secure without good old-fashioned manual pentesting.</p><p>What are your thoughts? 🤔 <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a> <a href="https://infosec.exchange/tags/AISecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AISecurity</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
0x40k<p>Ahoy there, fellow tech enthusiasts! 🏴‍☠️ Microsoft's got another one for us – six zero-days actively being exploited! Ouch, that's gotta hurt. 🤕</p><p>Seriously folks, get those systems patched ASAP. UAF, NTFS, Integer Overflows – we're not kidding around here. Attackers are practically drooling over vulnerabilities like these.</p><p>And while you're at it, double-check those USB sticks, alright? Trust me, I've seen enough digital nastiness to last a lifetime...</p><p>Oh, and just a friendly reminder: Automated scans? They're definitely not a replacement for a real pentest! Remember, security isn't a product you just buy; it's a continuous journey.</p><p>So, what's your experience with zero-days been like? Spill the beans – I'm all ears! Share your stories below!</p><p><a href="https://infosec.exchange/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITSecurity</span></a> <a href="https://infosec.exchange/tags/ZeroDay" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ZeroDay</span></a> <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a></p>
0x40k<p>Okay, folks, are you aware that TP-Link routers are in the crosshairs? Seriously, the Ballista Botnet is making waves... and it's not good. CVE-2023-1389 is flashing red – remote code execution! 🚨</p><p>Listen up: You *really* need to update your routers! I can't tell you how often I hear, "Oh, the router? It's fine!" from clients. And then BAM! Something like this happens. So, what should you do? First off, check your firewall. Next, change those passwords – strong ones, please! Honestly, consider getting a penetration test done. Automated tools? They're nice, sure, but they're *no* substitute for a seasoned security expert. Keep in mind that IT security isn't a one-time fix; it's an ongoing process. 😉</p><p>Now, I'm curious: How often do *you* update your router firmware? Let's hear it!</p><p><a href="https://infosec.exchange/tags/router" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>router</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a></p>