Better API Endpoint Enumeration: Testing for the #1 OWASP Security Vuln
Broken Access Controls is at the top of the OWASP Top 10. The difficulty is finding each instance to test. Learn 3 ways to enumerate API endpoints thoroughly.
AI
Discover expert penetration testing insights on artificial intelligence, the ways it is used in cyber attacks, and the way Raxis uses it to improve pentesting.
AI-Augmented Series: Why We Take AI Security Training Seriously at Raxis
Raxis CTO Brian Tant discusses the AI portion of our annual security awareness training and how we take AI security seriously.
Bypassing ChatGPT’s Open-Source Model Security Restrictions for Agentic Hacking
Ryan Chaplin wondered what it would take to bypass ChatGPT’s open-source model security restrictions to allow AI to hack his website. See how he did it here.
Deepfakes: The Face on Your Screen Might Not Be Real
Phishing and other social engineering techniques have crossed a threshold with deepfake attacks. Scottie Cole discusses how to protect your organization.
AI-Augmented Series: AI Scripting for Brute-Forcing on a Web App Pentest
On a recent web app pentest, Andrew Trexler used AI to find client-side code that stopped his brute-force attack then used AI again to thwart that code.
BeyondTrust RCE Vulnerability Exploited: Critical 9.9 CVSS Flaw Under Active Attack
While BeyondTrust patched cloud-hosted Remote Support customers earlier this month, on-premises deployments of BeyondTrust must manually patch to remediate.
The Future of Security: Why AI-Augmented Penetration Testing Is the Way Forward
Raxis CEO Mark Puckett looks back at a year of many changes and forward to the ways AI-augmented pentesting is changing the industry.
Autonomous Supply-Chain Worm Compromises Postman, PostHog, Zapier, and 26k Others
Operating fully autonomously, this new supply-chain malware has compromised Postman, PostHog, Zapier and 26k others. Learn what your organization should do now.
The Role of AI in Penetration Testing
Bonnie Smyre shows how Raxis’ AI-augmented pentesting gives their expert pentesters more time for complex chained attacks and discovery of business-logic flaws.
AI-Augmented Series: LLM-Aided Enumeration for Dormant WordPress Account Discovery
Ryan Chaplin leads off our Augmented-AI series with a scenario from a recent pentest using AI to write a script to discover an account to gain system access.
The @ctrl/tinycolor NPM Attack: The Brutal Anatomy of a Cascading Supply Chain Breach
Over 40 major packages were exploited in this malware campaign. Learn what happened and what your organization should do if you have been affected.
OWASP Top 10 for LLM Applications Penetration Testing
Lead Penetration Tester Jason Taylor looks at OWASP’s Top 10 list for LLM applications for penetration testing as AI machine learning becomes prevalent.
13 posts in AI.