Risks of Using HTTP For Your Web Application For modern web applications, the average user will interact over a secure protocol for communication (i.e. HTTPS, or Hypertext Transfer Protocol Secure). However, it’s not uncommon to encounter a web application hosted in an internal corporate environment using the less secure HTTP (Hypertext Transfer Protocol) which communicates […]
A big phishing trend abuses the OAuth Device Code Authentication flow against Microsoft 365 tenants. This type of attack consists of abusing Microsoft’s device code flow by coercing targeted users to enter a generated code into Microsoft’s OAuth device authentication portal here, which will then grant API access to the user’s account. A few reasons […]
What is a vulnerability scan? How does it differ from a Contact us? What are the benefits of a vulnerability scan? How often should you conduct a vulnerability scan? This article answers all these questions! What is a vulnerability scan? A vulnerability scan is essentially an automated process to identify potential security risks associated with […]
A common theme amongst clients when conducting penetration tests is a large attack surface. Generally, the biggest risk is amongst externally exposed assets. However, this can be related to internal penetration tests and web application penetration tests. This blog post will briefly examine the biggest risks associated with a large attack surface. Unknown Assets It […]
What is the difference between a vulnerability scan and a penetration test? A common question many client’s may ask, is what is the difference between a vulnerability scan and a penetration test? This blog post will go into addressing the similarities and differences of each activity. What is a Vulnerability Scan? A vulnerability scan is […]
External penetration tests often require organizations to safeguard their external perimeter against threats, whether for compliance, banking, or client requirements. However, it can be a daunting task which may have you wondering, “What can go wrong during a penetration test?”. This blog post examines the risks and will empower you to address these issues before […]
This process, involving the simulated attack on a network to identify vulnerabilities, is critical for maintaining the integrity and confidentiality of an organization’s data. However, there’s a crucial aspect often neglected during these tests: application security testing.
Lucid Security Engineers regularly encounter HTTP headers during web application or network penetration testing that reveal potentially sensitive information such as application architecture, server versions, or information about the underlying host system. These types of information disclosure vulnerabilities can be utilized by attackers to quickly determine vulnerable server versions and perform more targeted attacks. As […]
Lucid Security is a Veteran owned cybersecurity solutions company focused on offensive security and penetration testing.