The Blog
Find our latest news here!
Simplify your DORA compliance – Exaface
DORA wants to stop Swiper from swiping... Unfortunately, saying it three times is not enough to make it happen in cybersecurity. A European law was therefore needed to regulate the operational resilience of the financial sector: DORA “Digital Operational Resilience...
Internet exposure audit: Attack Surface Mapping – Exaface
Mapping in the EASM cycle is the starting point for analyzing an external attack surface. The data collected during this phase represents the vision of a malicious actor who is interested in an organization: websites and their technologies, remote access referenced or not, administration interfaces, possible connected objects left open to the Internet, an application that you thought was decommissioned, and potentially other systems that you do not suspect.
Solution EASM programme CaRE – Exaface
The health sector is the 3rd sector most affected by cyberattacks, after local authorities and VSEs/SMEs according to ANSSI - National Agency for Information Systems Security. The Digital Health Agency recalls that “recent cyberattacks show that Internet exposure is...
External Attack Surface Management (EASM) – Exaface
Exaface is a French EASM solution designed and developed to: ✓ Face current and future threats by providing the most comprehensive vision possible: continuous discovery, increased monitoring, identification of risks, prioritization and remediation ✓ Respond to issues of sovereignty and data protection ✓ Simplify the management of your cyber exposure through a single tool
Simple Anti-Virus Bypass with Mimikatz
This short article presents the update of the script created based on the excellent Black Hills article: "naive" or configured to be lax Anti-Virus often relies on signatures, which can be easily circumvented like demonstrated in the initial article. During a recent...
WebDev websites pentest
This article aims to share the results of our experience of penetration tests carried out on websites built with WebDev and the HFSQL database. It is written for pentesters and security researchers who wish to study the security of these technologies, but also for curious developers. We will see in particular the possibilities offered by HFSQL in the event of SQL injections, how to authenticate on an accessible HFSQL service, as well as the replication of a local WebDev environment to study its security.
Prepare and optimize your security audits
Whether or not you are experienced in the pentest exercise, you will find in this article some points allowing you to prepare your security audit well by making sure you have the necessary information and reflexes before consulting your service providers, but also to maximize your return on investment.
Admin PrestaShop RCE “à la WordPress”
Build a PrestaShop module in order to have an RCE when obtaining administrator access during a pentest.
Dolibarr : unauthenticated contacts database theft
Vladimir discovered a critical vulnerability that could be exploited by an unauthenticated attacker. It provides access to a competitor’s entire customer file, prospects, suppliers, and potentially employee information if a contact file exists. Both public and private notes can also be retrieved. Very easy to exploit, it affects Dolibarr 16.x versions.
Centreon map vulnerability
Technical details on the vulnerability discovered by Vladimir and affecting the Centreon Map extension.
