web penetration testing

We Can’t Rely on the Browser for Protection

 A large part of doing security consulting is providing proper mitigations and recommendations to our clients.  Sure, the testing is the exciting part, but it is the recommendations that are going to have the greatest impact on our client’s security.  It is our goal to help make the security posture better, not set a record …

We Can’t Rely on the Browser for Protection Read More »

Comparing Authorization Levels with Burp’s Compare Site Map feature

Burp Suite from Portswigger.net is a fantastic web app testing tool that we use regularly at Secure Ideas. Though Burp is very popular in the security industry, there are a lot of features that often get overlooked. One of these features is the “Compare Site Maps” feature. This wizard-based function compares two different site maps of a …

Comparing Authorization Levels with Burp’s Compare Site Map feature Read More »

Professionally Evil Toolkit – Reconnoiter

In this series of the Professionally Evil Toolkit we will be talking about Reconnoiter. Reconnoiter was created by Secure Ideas very own Jason Wood. Reconnoiter is a set of scripts written in python to help aid in the reconnaissance phase of a penetration test.  The tool has two main functions, username generation and LinkedIn profile harvesting. The …

Professionally Evil Toolkit – Reconnoiter Read More »

Who We Are: Thom Dosedel

Who am I: Thom Dosedel, Senior Security Consultant at Secure Ideas.  What do I do at Secure Ideas: Like my fellow consultants, I participate in both internal and external penetration tests performing structured attacks on network, web, wireless, or mobile environments.  We also perform architecture reviews, provide defense based analysis and recommendations. What is my …

Who We Are: Thom Dosedel Read More »

Your Passwords Were Stolen: What’s Your Plan?

If you have been glancing at many news stories this year, you have certainly seen the large number of data breaches that have occurred. Even just today, we are seeing reports that Drupal.org suffered from a breach (https://drupal.org/news/130529SecurityUpdate) that shows unauthorized access to hashed passwords, usernames, and email addresses. Note that this is not a …

Your Passwords Were Stolen: What’s Your Plan? Read More »

Admin Consoles, Default Creds, and Sweet Pwnage

When performing internal network penetration tests, one thing that really gets us excited is finding administrative consoles.  Tomcat and PHPMyAdmin are two of the most common that I’ve found from my experience.  The reason we get excited is that many of these consoles have never had the default credentials changed.  Why?  Because they’re on the …

Admin Consoles, Default Creds, and Sweet Pwnage Read More »

Scroll to Top