SonicWall SMA1000 CVE-2026-102255: Why Patching Can’t Wait
CVE-2026-102255 is a CVSS 10.0 SSRF flaw in SonicWall SMA1000 appliances. Attempts began two days after disclosure. Learn why patch windows must shrink.
Penetration Testing
Discover expert-led penetration testing insights, real-world attack simulations, and best practices to uncover vulnerabilities and strengthen your security.
PHP2Shell and UpdraftCentral Keys: Two PHP Threats to Fix Now
Patch PHP2Shell (CVE-2026-109618, CVE-2026-109619) and remove stolen UpdraftCentral keys. Raxis explains how to check exposure and fix both PHP threats.
Cool Tools: NetExec (NXC) – Modules Deep Dive
Learn how NetExec (NXC) modules speed up internal pentests. Scottie Cole covers GPP passwords, LAPS, Zerologon checks, and coerce_plus with example commands.
French Supermarket Hack: When OT Security Failures Reach the Food Supply
The French supermarket hack exploited unpatched, internet-facing Danfoss controllers. Learn why OT security gaps like this persist and how to close them.
Cool Tools: Stunnel for Bypassing DPI
Pentesters often need to bypass Deep Packet Inspection (DPI), network IPS, and SOC detection by disguising network traffic. Learn how stunnel does just that.
Auditing Passwords with Domain Password Audit Tool (DPAT)
Learn how to use the Domain Password Audit Tool (DPAT) that helps you discover if policies are bypassed and if new policies need to be in place.
Better API Endpoint Enumeration: Testing for the #1 OWASP Security Vuln
Broken Access Controls is at the top of the OWASP Top 10. The difficulty is finding each instance to test. Learn 3 ways to enumerate API endpoints thoroughly.
Choosing a Penetration Testing Company: Operational Technology (OT)
Operational Technology pentesting is highly specialized and needs to be performed by experienced OT testers. Learn how to choose the best pentest company.
Cool Tools: The NetExec (NXC) nxcdb Database
Principal Pentester Scottie Cole continues his NetExec series with nxcdb, the database that automatically stores key info like hosts and creds while you hack.
Rapid Web Host Recon with GoWitness
Enumerating webpages during an internal network pentest can be a large task, but GoWitness makes it easy to focus on high value webpages. Learn how it works.
Raxis at Black Hat USA 2026: Come Find Us at Booth 6018
Raxis will be at Black Hat USA 2026 August 4–6 at Mandalay Bay Convention Center in Las Vegas. Find us at booth 6018.
AI-Augmented Series: Why We Take AI Security Training Seriously at Raxis
Raxis CTO Brian Tant discusses the AI portion of our annual security awareness training and how we take AI security seriously.
79 posts in Penetration Testing.