New Metasploit Module for Penetration Testing: Azure AD Login Scanner
Raxis’ Matt Dunn has published another Metasploit module, this one describing a vulnerability in Azure’s Active Directory Seamless Single Sign-on. Learn more here.
Security Recommendations
Get actionable cybersecurity advice from Raxis experts. Explore best practices, tips, and recommendations to strengthen your organization’s security.
Introduction to Cross-Site Scripting
This video covers the basics of cross-site scripting, including reflected, stored, and DOM-based XSS as well as remediation to protect against these attacks.
Nagios XI Stored Cross-Site Scripting (XSS): CVE-2021-38156
Nagios is open-source network and system monitoring software. Raxis’ Matt Dunn has discovered a cross-site scripting vulnerability that could leave users open to attack.
Keep Your Cookies in the Cookie Jar: HttpOnly and Secure Flags
How can cookies be used against you? And how do you keep that from happening? Raxis’ Matt Dunn explains.
Hurricane Ida: Limiting the Damage
Lead penetration tester Scottie Cole is a Gulf Coast resident and former first responder. Read his tips for avoiding hackers and scams that can be as costly as a natural disaster.
PRTG Network Monitor Stored Cross-Site Scripting Vulnerability (CVE-2021-29643)
Raxis lead penetration tester Matt Dunn uncovers a new vulnerability in the PRTG Network Monitor (CVE-2021-29643). Read more here.
Don’t Take the Smishbait
Unwanted text messages are annoying, but some also hide malicious links. Here are some ways to avoid being “smished.”
ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability (CVE-2021-31813)
Raxis’ Matt Dunn has discovered another ManangeEngine cross-site scripting (XSS) vulnerability, this time in the Applications Manager product (CVE-2021-31813).
Why Mutual Assured Destruction is an Incomplete Cyber Defense Strategy
Is the threat of full-scale retaliation enough to prevent large-scale cyberattacks? Raxis’ Bonnie Smyre explains why this Cold War strategy is not effective.
A High-Tech Take on an Old-Time Scam
Don’t fall prey to scammers trying to convince you that your domain name is about to be stolen by an overseas company.
SonicWall Patches Three Zero-Day Vulnerabilities
Cybersecurity company SonicWall has released patches for three zero-day vulnerabilities that are currently being exploited.
NSA, FBI, CISA Statement on Russian SVR Activity
The US government is warning businesses to beware of vulnerabilities being exploited by the Russian Foreign Intelligence Service (SVR RF). But that’s not the only group taking advantage. Here’s what you should do.
97 posts in Security Recommendations.