A Deep Dive into Ethically Hacking OAuth 2.0 & OIDC
If you are from an IT company, your tech infrastructure is most likely to have OAuth 2.0 and OpenID Connect (OIDC) as its core components. Together, these protocols allow a secure and seamless user authentication across applications. OAuth 2.0 is deployed to enable users to access third-party applications without needing to enter passwords, while OIDC […]
SSO Pen Tests’ Major Vulnerabilities
These days, more and more companies use single sign-on or SSO to manage access to their services and applications. This way, they delegate the authentication or authorization process to a trusted third party, allowing users to sign in to different services with the same access data. It’s true that SSO rescues users from the hassle […]
When Should We Slow Down or Pause the Patching Process?
Patching is often regarded as one of the standard cybersecurity hygiene measures. Every second article or video talks about applying patches and updates quickly and regularly to keep the systems protected. However, lately, cybersecurity experts have been preaching that patching should not be regarded as an automatic reaction. They are, in fact, saying that there […]
Common Lateral Movement Techniques for Ethical Hacking
ReliaQuest’s Annual Threat Report for 2024 revealed that once attackers infiltrate a network, they can achieve lateral movement in as little as 27 minutes, with an average time of 48 minutes. This surely sounds scary, but what if a company itself simulates attacks using lateral movement techniques to identify exploitable, unprotected gateways and vulnerabilities? The […]
Breaking the Chain- Exploiting Token Abuse for Lateral Movement
Penetration testers can steal a user’s identity without even breaking their password. This is done by simulating a token impersonation attack, which is more like a digital mask. A token is like a backstage pass users get when they log in to a system or software. In technical terms, a token is a data element […]
The 5 Stages of Penetration Testing
Penetration testing (pen test for short) is an ethical hacking technique in which an attack is officially simulated against a company’s technical infrastructure to know about all the security loopholes a threat actor can exploit. In simpler words, a white-hat hacker tries breaking into different domains of a company’s technical system to come across all […]
