3 min
InsightIDR
Detecting Inbound RDP Activity From External Clients
Today, we discuss how to detect inbound RDP activity from external clients.
4 min
Threat Intel
Rapid7 Threat Intelligence Book Club: ‘Countdown to Zero Day’ Recap
The final section of Kim Zetter's “Countdown to Zero Day”pulls together the many factors that are present in attacks such as Stuxnet.
3 min
Penetration Testing
Pen Test, Part 3: Jumping a Fence and Donning a Disguise
Here is the story of how I jumped a fence and broke into a construction vehicle to take control of an energy company's network.
2 min
Metasploit Weekly Wrapup
Metasploit Wrapup 9/14/18
Your weekly run-down of the modules and improvements that landed in Metasploit Framework.
4 min
Do You Know Your AppSec ROI?
This blog was previously published on blog.tcell.io.
This week has been a pretty interesting week in breaches. With the recent news
of Magecart being the attacker of both Ticketmaster and British Airlines, you
can't help but wonder why companies aren't learning from each other so they
aren't faulted for the same vulnerabilities. The answer in most cases is that
they don’t have the resources available to stay ahead of these attacks. Security
has traditionally been seen as a cost center, but with
3 min
Penetration Testing
How to Identify and Prioritize Gaps with the Cybersecurity Maturity Assessment, Post-2018 'Under the Hoodie'
At Rapid7, we believe that cybersecurity within a company is not just a function with many stakeholders, but rather a shared responsibility among all employees, regardless of role.
5 min
Threat Intel
HUMINT: The Riskiest (and Most Valuable) Form of Intelligence Gathering
As threat actors make their attacks more difficult to see and stop, human intelligence (HUMINT) has become critical for cybersecurity success.
3 min
Patch Tuesday
Patch Tuesday - September 2018
More than 60 vulnerabilities were addressed by this month's patches, including CVE-2018-15967 (a privilege escalation/information disclosure vulnerability in Adobe Flash Player).
2 min
Penetration Testing
Pen Test, Part 2: How Just One Flaw Helped Us Beat the Unbeatable Network
During one pen testing engagement, we were pitted against a well-hardened, locked-down, and mature environment. However, all it took was one slip-up to give us the keys to the kingdom.
5 min
Serverless and the OWASP Top 10
This blog was previously published on blog.tcell.io.
This post kicks off a series we’re doing on serverless security, since it’s one
of the hot trends in application development. Over the next several weeks, I’ll
be writing about what serverless is, what types of applications benefit from it,
and the security considerations you might have when building your application on
bleeding-edge technology.
Serverless model
Serverless computing, sometimes called “Function as a Service” (FaaS), lets you
2 min
Metasploit Weekly Wrapup
Metasploit Wrapup 9/7/18
Ghost(script) in the shell
There has been a lot of buzz the last couple weeks about Google Project Zero's
Tavis Ormandy's new Ghostscript -dSAFER bypass, now complete with a Metasploit
module. With some valiant work by wvu and taviso
himself, the latest way to break out of a PDF is now
at your fingertips. If you pulled an advanced copy from the PR
, make sure to use
the refined vers
6 min
Metasploit
External Metasploit Modules: The Gift that Keeps on Slithering
For HaXmas last December, I wrote about the introduction of Python modules to Metasploit Framework. As our module count keeps on growing, we thought that it would be a good time to update the community on where we are at.
3 min
Penetration Testing
This One Time on a Pen Test, Part 1: Curiosity Didn’t Kill the Cat—Honesty Did
As part of a penetration test, I worked with the client to craft an engagement that would evaluate their employee and technology preparedness against a sophisticated, targeted phishing and vishing attack.
3 min
Metasploit Weekly Wrapup
Metasploit Wrapup: 8/31/18
VPN to root
The Network Manager VPNC Username Privilege Escalation
module by bcoles
exploits a privilege escalation attack in the
Network Manager VPNC plugin configuration data (CVE-2018-10900) to gain root
privileges. Network Manager VPNC versions prior to 1.2.6 are vulnerable and the
module has been successfully tested against 1.2.4-4 on Debian 9.0.0 (x64) and
1.1.93-1 on Ubuntu Linux 16.04.4 (x64). The
e
4 min
Penetration Testing
Under the Hoodie: Which Vulns Are Being Exploited by Attackers (and Our Pen Testers) in 2018?
Software vulnerabilities are at the core of pen testing—and our "Under the Hoodie" report provides insights and advice one can only get in the trenches.