Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

EASM mistakes waiting to happen

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
64
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
190
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
190
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
110
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
180
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
130
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
120
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
生成AIで高い生産性を求められて、 悩み、乗り越えた話
Avatar for GO Inc. dev mot_techtalk
2
130
FinTech 1-2 : Overview of FinTech
Avatar for Kenji Saito ks91
PRO
0
150
freeeらしさをAIとともに作る / Creating the freee Experience with AI
Avatar for ymrl ymrl
0
200
AI時代のAPI開発を加速する品質ガードレール / API Quality Guardrails in the AI Era
Avatar for Yoichi Kawasaki yokawasa
0
130
Snowflake Horizon Catalog と Apache Iceberg で作る オープンなデータ基盤
Avatar for キタガワ kitagawaz
0
440
いちAWSエンジニアのAI活用を振り返る #devio2026 / devio osaka 2026 kawahara
Avatar for MasahiroKawahara masahirokawahara
2
380
ビジネスを止めない技術的負債の返済のための戦略とその手法 - 技術的負債と向き合う / Complexity and Simplicity
Avatar for soudai sone soudai
PRO
3
550
私の推しは「聞いてから進む」AIです -AI-DLCに一人でアプリを作らせた話
Avatar for Yuuki Yamashita yama3133
1
170
事業活動を AI Ready にする攻めと守りのデータエンジニアリング / data-engineering-for-ai-ready-business
Avatar for pei0804 pei0804
1
140
Snapshot Testing in Practice: Predictable and Reliable SwiftUI Views
Avatar for Felipe Espinoza fespinoza
0
120
[2026 Oracle Technical Deep Dive] VMwareワークロードのOCI移行実践ガイド - OCVSでの継続利用からOCIコンピュートへの移行まで (2026年9月17日開催)
Avatar for oracle4engineer oracle4engineer
PRO
0
120
メルペイ 会計システム概要と歴史
Avatar for mewuto mewuto
0
150

Featured

See All Featured
SEOcharity - Dark patterns in SEO and UX: How to avoid them and build a more ethical web
Avatar for Sara Fernández Carmona sarafernandez
0
300
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2.5k
Bioeconomy Workshop: Dr. Julius Ecuru, Opportunities for a Bioeconomy in West Africa
Avatar for AKADEMIYA2063 akademiya2063
PRO
1
390
A better future with KSS
Avatar for Kyle Neath kneath
240
18k
Future Trends and Review - Lecture 12 - Web Technologies (1019888BNR)
Avatar for Beat Signer signer
PRO
0
3.8k
Game over? The fight for quality and originality in the time of robots
Avatar for Wayne Barker wayneb77
1
300
Improving Core Web Vitals using Speculation Rules API
Avatar for Sergey Chernyshev sergeychernyshev
21
1.7k
Art, The Web, and Tiny UX
Avatar for Lynn Fisher lynnandtonic
304
22k
Agile Leadership in an Agile Organization
Avatar for Dr. Kim W Petersen kimpetersen
PRO
0
270
<Decoding/> the Language of Devs - We Love SEO 2024
Avatar for Nikki Halliwell nikkihalliwell
1
340
Music & Morning Musume
Avatar for Bryan Veloso bryan
48
7.4k
How to Grow Your eCommerce with AI & Automation
Avatar for Katarina Dahlin katarinadahlin
PRO
2
310

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and