Penetration Testing

During a recent pentest, we exploited an insecure PDF generator to trigger SSRF and access AWS instance metadata. PDF generators often allow risky features like JavaScript by default, making them an overlooked attack surface.

During a recent penetration test, we uncovered a critical insecure deserialization vulnerability hidden in a client’s production application. What started as a suspicious base64 string quickly unfolded into serialized Java objects, ysoserial payloads, and a proof-of-exploitation via DNS callbacks. In this post, we share the story behind the discovery, explain the risks of insecure deserialization, and highlight how a simple fix helped secure a vulnerable authentication endpoi

Hacking with pickles Intro In this post, I want to share an interesting vulnerability we've discovered during a penetration test on a...

How Can A Lack Of Environment Separation Led Our Red Team to Remote Code Execution

Penetration Testing Services by Cybenari Penetration testing is a proactive cybersecurity practice that simulates real-world cyberattacks...

<p>In recent years, the world of cybersecurity has witnessed a dramatic rise in the sophistication and maturity of bug bounty programs. With tech giants and startups alike offering enticing rewards to those who can discover vulnerabilities in their systems, a new generation of security researchers and bug hunters has emerged. But how has this rise [&hellip;]</p>

The digital universe is vast, intricate, and continually evolving. To safeguard this cosmos, penetration testing stands as a sentinel, revealing vulnerabilities lurking in the shadows. Among its myriad forms, Black Box and White Box penetration tests emerge as contrasting yet equally significant strategies with pros and cons for each type of test. Grasping their nuances

<p>For those diving deep into cybersecurity and penetration testing, understanding the complexities and nuances of different vulnerabilities is crucial. One such vulnerability that&#8217;s seen a rise in prominence due to the widespread adoption of microservices is the Server-Side Request Forgery (SSRF). Let&#8217;s dive into the specifics of SSRF and discuss how to protect against it. [&hellip;]</p>

<p>Introduction As the internet evolves, so does the complexity of ensuring secure access and user authentication. Two widely-adopted standards that have come to the forefront are OAuth and OpenID Connect (OIDC). However, as with all technologies, they are not immune to vulnerabilities. This guide will delve into what these standards are, common security pitfalls associated [&hellip;]</p>