I never rely on automation alone.
In a recent external pentest, I was going over the assets manually, while running some tools in the background, including nuclei.
In a recent external pentest, I was going over the assets manually, while running some tools in the background, including nuclei.
1. One instance was running a software vulnerable to arbitrary file deletion. Nuclei didn't even smell it, unfortunately.
What I usually do, is to look over famous exploits for the specific software. And this one was a victim.
What I usually do, is to look over famous exploits for the specific software. And this one was a victim.
2. Another instance was running a software vulnerable to RCE. Thanks @infosec_au for the amazing work that help uncover this.
Nuclei has some templates for this, but they didn't catch it.
Similar to #1, I dug deeper manually and confirmed the vulnerabilty.
Nuclei has some templates for this, but they didn't catch it.
Similar to #1, I dug deeper manually and confirmed the vulnerabilty.
3. As much as I love automation and tooling, and as much as it is helpful in many ways, I learn time and again through experience, that I'm always better in the pentests I perform by manually looking over assets.
#pentesting #appsec #cybersecurity
#pentesting #appsec #cybersecurity
• • •
Missing some Tweet in this thread? You can try to
force a refresh
