Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
44

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
150
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
130
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
78
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
120
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
88
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
0
73
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
日々のSlackアラート確認運用をCustom Chat Modesで楽にした話 / 日々のSlackアラート確認運用をCustom Chat Modesで楽にした話
Avatar for Imamoto Hikaru imamotohikaru
0
450
今日から使える AWS Step Functions 小技集 / AWS Step Functions Tips
Avatar for Masanori Yamaguchi kinunori
7
650
なぜThrottleではなくDebounceだったのか？ 700並列リクエストと戦うサーバーサイド実装のすべて
Avatar for Yoshiori SHOJI yoshiori
10
3.5k
AI時代におけるドメイン駆動設計 入門 / Introduction to Domain-Driven Design in the AI ​​Era
Avatar for Futoshi Endo fendo181
0
670
クレジットカードの不正を防止する技術
Avatar for Yuta Horii yutadayo
15
6.7k
仕様駆動 x Codex で 超効率開発
Avatar for Izumu KUSUNOKI ismk
2
1.4k
QAセントラル組織が運営する自動テストプラットフォームの課題と現状
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
370
【AWS reInvent 2025 関西組 事前勉強会】re:Inventの“感動と興奮”を思い出してモチベ爆上げしたいです
Avatar for Toshiki Terai ttelltte
0
140
なぜインフラコードのモジュール化は難しいのか - アプリケーションコードとの本質的な違いから考える
Avatar for Gosuke Miyashita mizzy
43
12k
プログラミング言語を書く前に日本語を書く── AI 時代に求められる「言葉で考える」力/登壇資料（井田 献一朗）
Avatar for Hacobu hacobu
PRO
0
150
JJUG CCC 2025 Fall バッチ性能!!劇的ビフォーアフター
Avatar for HayashiYuichiro hayashiyuu1
0
140
[JDDStudy #10] 社内Agent勉強会の取り組み紹介
Avatar for Kyojin.Syo yp_genzitsu
1
130

Featured

See All Featured
Building Better People: How to give real-time feedback that sticks.
Avatar for Will Jessup wjessup
370
20k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
Avatar for Chris Coyier chriscoyier
508
140k
Scaling GitHub
Avatar for Zach Holman holman
463
140k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
140
34k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
Avatar for Marc Duiker marcduiker
34
2.3k
How To Stay Up To Date on Web Technology
Avatar for Chris Coyier chriscoyier
791
250k
[RailsConf 2023 Opening Keynote] The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
31
9.7k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
340
57k
Typedesign – Prime Four
Avatar for Hannes Fritz hannesfritz
42
2.9k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
348
40k
Practical Orchestrator
Avatar for Shlomi Noach shlominoach
190
11k
Save Time (by Creating Custom Rails Generators)
Avatar for Garrett Dimon garrettdimon
PRO
33
1.8k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and