Tomorrow brings the fall equinox, and that means (as we are almost contractually obligated to say at this point) winter is coming.…
The final section of Kim Zetter's “Countdown to Zero Day”pulls together the many factors that are present in attacks such as Stuxnet.…
Here is the story of how I jumped a fence and broke into a construction vehicle to take control of an energy company's network.…
Your weekly run-down of the modules and improvements that landed in Metasploit Framework.…
At Rapid7, we believe that cybersecurity within a company is not just a function with many stakeholders, but rather a shared responsibility among all employees, regardless of role.…
As part of this year's "Under the Hoodie" report, we identified the latest web application security risks companies are facing today.…
More than 60 vulnerabilities were addressed by this month's patches, including CVE-2018-15967 (a privilege escalation/information disclosure vulnerability in Adobe Flash Player). Over a quarter of these are considered Critical, which means there may be at least one way that malicious code could propagate without…
During one pen testing engagement, we were pitted against a well-hardened, locked-down, and mature environment. However, all it took was one slip-up to give us the keys to the kingdom.…
My name is Eliott Teissonniere, and I was selected as a Google Summer of Code (GSoC) student for Metasploit this summer! Today, I am excited to tell you more about what we did and what’s next.…
Ghost(script) in the shell There has been a lot of buzz the last couple weeks about Google Project Zero's Tavis Ormandy's new Ghostscript -dSAFER bypass, now complete with a Metasploit module. With some valiant work by wvu and taviso himself, the latest way to…
Security orchestration and automation can be a saving grace in security for many resource-strapped or highly targeted companies.…
For HaXmas last December, I wrote about the introduction of Python modules to Metasploit Framework. As our module count keeps on growing, we thought that it would be a good time to update the community on where we are at.…
As part of a penetration test, I worked with the client to craft an engagement that would evaluate their employee and technology preparedness against a sophisticated, targeted phishing and vishing attack.…
VPN to root The Network Manager VPNC Username Privilege Escalation module by bcoles exploits a privilege escalation attack in the Network Manager VPNC plugin configuration data (CVE-2018-10900) to gain root privileges. Network Manager VPNC versions prior to 1.2.6 are vulnerable and the module…
