Resource Center

The Jerry machine from the Hack The Box platform nicely illustrates the danger of weak and default credentials.

On August 25, 2021, Atlassian released a security advisory for CVE-2021-26084, an OGNL injection vulnerability found within a component of Confluence Server and Data Center. This critical vulnerability allows an unauthenticated attacker to execute arbitrary commands on the server. A few days later, on August 31, security researchers @iamnoob and @rootxharsh quickly developed a working proof of concept given the vulnerability…

Credential attacks bypass traditional defenses and cause billions in damage. Learn why they work, what’s at risk, and how Horizon3.ai helps fix what matters.

NodeZero compromises the "Active" machine on Hack The Box by chaining classic Active Directory vulnerabilities: GPP password exposure, Kerberoasting, and CVE-2020-1472 (ZeroLogon). This advanced walkthrough builds on earlier feedback and demonstrates multiple escalation paths to Domain Admin.

In August, Orange Tsai released details and also spoke at BlackHat and DEFCON detailing his security research into Microsoft Exchange. His latest blog post details a series of vulnerabilities dubbed ProxyShell. ProxyShell is a chain of three vulnerabilities: CVE-2021-34473 - Pre-auth Path Confusion leads to ACL Bypass CVE-2021-34523 - Elevation of Privilege on Exchange PowerShell Backend CVE-2021-31207 - Post-auth Arbitrary-File-Write leads to…

The engineering team has been working tirelessly to improve the "what to wow" user experience, add more attack content, add indicators of best practices and improve analytical insights. Improving our "what to wow" user experience – In security, there are two types of findings: critical problems that require you skip lunch, or cancel plans with…

NodeZero exploited EternalBlue on HTB’s Blue machine to gain system access and dump credentials, showing the risk of unpatched SMB vulnerabilities.

Learn why regulatory compliance is not enough for true cybersecurity. Discover how continuous automated pentesting and network segmentation help you move beyond check-the-box security.

Being a #learnitall, Lesson 1: Be Open to Be Wow’d Most of the startup advice out there is pretty clear: get feedback early and often. Customer input is invaluable to delivering iter0, your MVP, feature releases that matter, bug fixes, utility and simplicity. In Customer Success, a lot of the job is review and advise so…

In the world of network security, compliance is the bare minimum. Compliance is locking your door, but what about your windows?