Whoa, the IT security world was on FIRE this week! Open source supply chain attacks, malware sneaking into the Play Store, ransomware bypassing EDR... and is AI just pouring gasoline on the phishing flames?! Seriously intense! Cloud security's getting a raw deal and let's be real, backups are only as good as their security.

It's wild how rapidly the threat landscape's evolving, isn't it? Gotta stay sharp, folks! Automated vulnerability scans? They're definitely nice, but manual penetration tests are still essential. And AI? Awesome tech, but also seriously risky. Disinformation and manipulation are spiraling out of control. We've gotta stay vigilant!

So, what are *your* biggest IT security pain points right now? Spill the beans!

#infosec #pentesting #offensiveSecurity

Mar 24

**0x40k** @0x40k@infosec.exchange · Mar 18

0x40k @0x40k@infosec.exchange

Alright, Okta and similar tools are cool and all, but don't think they're a get-out-of-jail-free card for security! I frequently see IAM systems configured incorrectly. For instance, MFA is often forgotten. What about outdated accounts? Or giving admin rights to everyone? Boom! You've got a potential breach on your hands.

Listen up: IAM isn't just about setting it up and forgetting about it; you've *got* to *live* it! Automation definitely helps, but it's no substitute for manual checks. Regular pentests are a must, and certificates only tell part of the story.

So, what IAM best practices do you use (beyond the standard documentation)? Let's share some insights! #infosec #pentesting #okta #security

Mar 18

**Bill** @Sempf@infosec.exchange · Mar 17

Bill @Sempf@infosec.exchange

Hey #appsec people. How do you handle organization of testing artifacts when you are dealing with tons of apps? I have a new client in deep water, their app suite is 20 years old and shows it. They have 53 endpoints.

My testing strategy is not designed for that.

How do you keep things organized? Is there a cool tool I need to know about? Is it Burp Suite Enterprise time for POINT? How do you keep your notes?

I know a lot of this is kinda up to your own personal philosophy for testing, but I thought it would make for informative conversation fodder for St. Paddy.

#infosec #pentesting

Mar 17

**Bill** @Sempf@infosec.exchange · Mar 13

Bill @Sempf@infosec.exchange

Apropos of nothing, PeopleSoft uses 303 See Other as a response code for auth redirects and whatnot. It's pointed out a weakness in all the cool filters I use. Always learning. #pentesting #appsec

Mar 13

**The New Oil** @thenewoil@mastodon.thenewoil.org · 2025-03-10T06:00:45.000Z

The New Oil @thenewoil@mastodon.thenewoil.org

#Hetty: #OpenSource #HTTP toolkit for security research

https://www.helpnetsecurity.com/2025/03/10/hetty-open-source-http-toolkit-security-research/

Help Net Security · Mar 10Hetty: Open-source HTTP toolkit for security research - Help Net SecurityHetty is an open-source HTTP toolkit designed for security research, offering a free alternative to commercial tools like Burp Suite Pro.

#cybersecurity #PenTesting

Mar 12

**Konstantin** @kpwn@infosec.exchange · Mar 3

Konstantin @kpwn@infosec.exchange

I'm excited to share CVE Crowd's Top 5 Vulnerabilities from February 25!

These five stood out among the 352 CVEs actively discussed across the Fediverse.

For each CVE, I’ve included a standout post from the community.

Enjoy exploring!

#Pentesting #AppSec #InfoSec

Mar 3

**Stormy Daniels** @pstrada.bsky.social@bsky.brid.gy · Mar 1

Stormy Daniels @pstrada.bsky.social@bsky.brid.gy

Pic of the Day #infosec #cybersecurity #cybersecuritytips #pentesting #cybersecurityawareness #informationsecurity bird.makeup/users/hackin...

Mar 1

**0x40k** @0x40k@infosec.exchange · Feb 26

0x40k @0x40k@infosec.exchange

Hey everyone, what's cooking in the open-source universe? I just stumbled upon something that's seriously mind-blowing.

So, there's this Python library pretending to be a music tool (automslc), but get this – it's actually illegally downloading songs from Deezer! And the worst part? It turns your computer into an accomplice in a huge music piracy operation. Seriously, a digital pirate cove.

And then there's this npm saga with @ton-wallet/create... Crypto wallet emptied, just like that!

The moral of the story? Open source rocks, but blindly trusting everything is a recipe for disaster. Always double-check those dependencies! Automated scans are cool, but a real penetration test? That's pure gold.

Clients are always so appreciative when we can spot and fix this kind of stuff beforehand!

Now, I'm curious: What are your go-to methods for keeping your codebase squeaky clean and secure? Any tips or tricks you'd like to share?

#infosec #pentesting #devsecops

Feb 26