How NodeZero Enhances Cybersecurity

Attackers don’t have to “hack in” using zero-day vulnerabilities. Often, attackers log in by chaining together misconfigurations, dangerous product defaults, and exploitable vulnerabilities to harvest and reuse credentials.

This session will discuss five real-world attacks that enabled Horizon3.ai to become domain administrator, gain access to sensitive data, take over cloud VPCs, and compromise critical business systems. In most instances no security alerts were triggered despite having state-of-the-art security tools in place. Attendees will learn how they can find, fix, and verify the remediation of exploitable attack paths so they can proactively harden their network.

Authoritarian regimes have learned in recent years that cybercrime can be a profitable economic enterprise – so much so that they continue to invest substantial resources in large- and small-scale cybercrime.

NodeZero is a generational leap beyond a traditional pentest – organizations often see that for themselves from the moment they give our autonomous pentesting platform a shot. NodeZero surfaces risks and weaknesses that would never have come up during a general...

Low-Level Vulnerability Leads to Domain Compromise

On May 31, 2023, Progress released a security advisory for their MOVEit Transfer application which detailed a SQL injection leading to remote code execution and urged customers to update to the latest version. The vulnerability, CVE-2023-34362, at the time of release...

OrangeHRM is software for Human Resource Management (HRM). In a routine audit of the open source version of OrangeHRM, we discovered a SQL injection vulnerability in the “Buzz” module, an integrated social media tool within the software.

Authenticated low privilege users can use this vulnerability to disclose the full contents of the OrangeHRM database, including sensitive user personal information and password hashes. It’s also possible to execute a denial of service attack to bring down the application.

Low-Level Vulnerability Leads to Domain Compromise

University credentials being sold on the dark web and used against individuals or the institution itself in subsequent cyberattacks.

The CISOs Report finds CISOs are prioritizing Zero Trust and partner risk management to mitigate critical security challenges.

Snehal Antani, CEO and Co-founder of Horizon3.ai, presented The Wartime Security Mindset: the evolution of attack at a briefing at the SOFIC Conference in conjunction with our alliance partner Carahsoft.

NodeZero is the first autonomous penetration testing platform to offer both internal and external pentesting in one self-service platform.

The Horizon3.ai Attack Team released their VMware Authentication Vulnerability (CVE-2022-22972) Technical Deep Dive.

VMware recently patched a critical authentication bypass vulnerability in their VMware Workspace ONE Access, Identity Manager and vRealize Automation products (CVE-2022-22972). This vulnerability allows an attacker to login as any known local user.

Security Strategies

Industry Insights

Attack Research

No Results Found

Attack Content

No Results Found

No Results Found

Security Strategies

Industry Insights

Attack Research

No Results Found

Attack Content

No Results Found

No Results Found

Research Blog

Filters