Blog
Technical Insights and Research from Our Team of Specialists.
Conti, Ryuk, and REvil are three of the most well-known and notorious ransomware groups that have caused significant damage and financial loss to organisations worldwide. Each of these groups has...
Ransomware, a multifaceted cyber threat, is more complex and damaging than many realise. With diverse attack vectors and multiple profit mechanisms, it represents an escalating danger. This guide delves into...
Ransomware is a growing threat. It's undeniable and indiscriminate, looming over businesses of all sizes and industries. We take a look at the ins and outs of why Ransomware affects...
June 2023 - We discuss and highlight how we bypassed one of the most heavily used 'zero trust' application whitelisting platforms. Their homepage ironically states that they block execution of...
Password managers stand as an essential tool in the modern digital landscape. With the escalating number of online accounts, they offer a secure repository to organise and store a multitude...
May 2023 - In this edition, we highlight how a decommissioned application was not fully removed as expected, allowing us to abuse legacy functionality to compromise an enormous amount of...
We discovered multiple high severity CVEs in Syncfusion's software and discuss the advantages and disadvantages of utilising third-party solutions in your software. This blog goes into detail about the issues...
A good MSSP (Managed Security Service Provider) should be able to service all their clients cyber security needs to a very high standard. With the sheer size of the cyber...
In April 2023, we completed an internal infrastructure security assessment for a client in the financial sector. What we didnt realise, is that this would become our first 'Fail of...
March 2023 - With single sign-on becoming more common during our assessments, we cover one of the vulnerabilities we discovered during an engagement that let us forge SAML responses to...
Subdomain takeovers are where an attacker is able to abuse dangling DNS aliases for cloud services to host their own content on an organisation’s subdomain. This content could consist of...
In February 2023, we completed a web application security assessment for a new client within the legal field. What followed was a series of hurdles, followed by jumps and yet...
Within almost 99% of web application penetration tests, there is usually at least one TLS / SSL related issue. Typically these are either reported as a Low CVSS score, or...
ImageMagick is one of those really powerful libraries that always gets mentioned in regards to anything to do with image processing. Sure enough, it’s a case of doing “apt install”...
In December 2022, we completed a web application security assessment for a client who wanted assurance that their newly developed application was ready for production. The application allowed users to...
In November 2022, we completed a web application security assessment for a new client within the health / wellbeing sector. We were told through previous discussions, that the web application...
When it comes to writing custom tooling for engagements, the motivations associated with it often vary. At a high level, as a consultancy, having the capabilities to produce allows us...
Multi-Factor Authentication (MFA) has been widely adopted over the years as a means to enhance the security of authentication processes for all sorts of systems. It has somewhat become a...
In October 2022, we completed an internal security assessment for a large tech organisation with clients in the legal industry, focused around the handling of sensitive documents for other companies....
In September 2022, we completed an internal security assessment for a large client in the tech industry. The scope was enormous – about 20,000 hosts in scope split over eight...
In August 2022, we completed a web application penetration test for a relatively new client. The scope was a pre-existing web application that allowed users to manage their calendars, plan...
Contact Us
