Topic
Redis
API Token Lifecycle: From Issuance to Revocation and Secure Management
Vulnerabilities & Exploits
Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access
Vulnerabilities & Exploits
Redis Patch Bypass Enables Multiple RCE Exploits as PoCs for TLS and Stream Vulnerabilities Go Public
Vulnerabilities & ExploitsOSINT for the Lazy Part 16: Discovering Hidden Corporate Infrastructure Through Shodan
The article explains how Shodan differs from traditional search engines by indexing internet-connected devices such as servers, routers, cameras, databases, and admin panels rather than web pages. It provides ten practical search techniques including hostname queries, SSL certificate searches, ASN lookups, IP range scans, and targeted queries for development environments, admin panels, and databases. Examples demonstrate how forgotten dev.company.com or staging.company.com hosts, open Jenkins or Grafana dashboards, and exposed MongoDB or Redis instances can be located with simple filters. The piece walks through a five-step real-world workflow that combines domain, SSL, organization, and service-title searches to map a target company’s infrastructure. It emphasizes that Shodan only reveals services already exposed to the internet and does not perform any exploitation. Common root causes listed include forgotten test servers, rushed DevOps configurations, and misconfigured firewalls. The article concludes with a reminder that many organizations remain unaware their internal systems are visible to anyone using the same techniques.
Mapping Logical Air Gap Techniques for Secure Network Segmentation
A detailed technical overview explores how organizations can achieve logical air gaps to isolate high-value network segments without completely severing data exchange. The article contrasts classic physical air gaps with everyday reverse proxies and introduces six distinct levels of isolation ranging from physical media to semantic validation. It evaluates each approach across three axes: whether a direct network path remains, which side initiates connections, and whether synchronous responses are possible. Practical constructions such as dual-homed hosts, message brokers, and schema-enforced proxies are examined alongside common misconceptions including reverse tunnels and port knocking. The guide emphasizes that true logical air gaps terminate sessions at an intermediary that then originates new, controlled exchanges. Real-world deployments typically combine multiple layers, such as network separation plus transport proxies plus content validation, to balance security and usability for critical environments like industrial control systems and backup repositories.
OAuth Authorization Server Built Without Storing User Profiles
The article details the evolution of an OAuth Authorization Server that deliberately avoids storing user profiles, relying instead on external identity providers for authentication. It addresses three core constraints: hundreds of dynamically created isolated APIs, a public SPA client without a BFF, and the inability of resources to query the AS on every request. The design separates concerns so the AS handles only clients, tenants, grants, audiences, scopes, keys, sessions, and token issuance while the Main API owns profiles and roles. Tokens are managed securely inside a Service Worker using a custom FedCM grant, eliminating races across tabs and reducing XSS exposure. The approach minimizes blast radius, simplifies compliance, and keeps the AS replaceable without affecting product domain logic.