The Threats That Are Your Weakest Link

June 25, 2018, Mike Weber, Vice President, Coalfire Labs

Coalfire published the latest report in its Securealities series, The Penetration Risk Report, and it’s based on findings from Coalfire penetration tests. It includes data drawn from engagements with businesses of all sizes, spanning financial services, retail, healthcare, and technology/cloud service providers. Some findings were contrary to current accepted wisdom on cybersecurity while other findings confirmed long held notions for others.

IoT Discussion at the Leidos Supplier Innovation & Technology Symposium

June 12, 2018, Abel Sussman, Senior Project Manager, Commercial Services, Coalfire

Coalfire was asked to participate on a technical panel about the Internet of Things (IoT) at the Leidos Supplier Innovation & Technology Symposium on June 6. This event is a dynamic day enabling Leidos’ largest suppliers as well as targeted start-ups to showcase their offerings and capabilities to a diverse set of federal leaders and key contractors.

How I Found CVE-2018-8819: Out-of-Band (OOB) XXE in WebCTRL

June 11, 2018, Darrell Damstedt, Senior Consultant, Coalfire Labs, Coalfire

I like to do bug bounties from time  to time, mostly when I am sacrificing sleep once the kids are finally out cold.  This seemed like a worthy experience to document. Let me just start by saying I  don't plan on going into the whole recon bits too deeply here. Maybe I will someday if I ever have enough time to give the topic the justice it deserves. 

Pro Tips: Testing Applications Using Burp, and More

June 08, 2018, Esteban Rodriguez, Consultant, Coalfire Labs, Coalfire

Burp Suite is one of my favorite tools for web application testing. The feature set is rich, and anything that it does not do by default can usually be added with an extension. There are a few things, however, that while they exist in Burp Suite, are not completely intuitive. Below are a few pro tips to help you get the most out of your web application tests.

A Cyber Engineering Primer: Vulnerability Management Lifecycle

June 07, 2018, Ben Scudera, Cyber Engineering Consultant, Coalfire

According to the SANS Institute, “Vulnerability management is the process in which vulnerabilities in IT are identified and the risks of these vulnerabilities are evaluated. This evaluation leads to correcting the vulnerabilities and removing the risk or a formal risk acceptance by the management of an organization.”