Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
43

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
140
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
120
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
77
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
110
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
82
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
0
68
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
生成AI時代に必要な価値ある意思決定を育てる「開発プロセス定義」を用いた中期戦略
Avatar for KAKEHASHI kakehashi
PRO
1
250
2025年になってもまだMySQLが好き
Avatar for yoku0825 yoku0825
8
3.4k
新規案件の立ち上げ専門チームから見たAI駆動開発の始め方
Avatar for ShuyaKinjo shuyakinjo
0
650
データアナリストからアナリティクスエンジニアになった話
Avatar for hatsu hiyokko_data
2
330
おやつは300円まで！の最適化を模索してみた
Avatar for PERSOL CAREER Dev | techtekt techtekt
PRO
0
260
Obsidian応用活用術
Avatar for 松濤Vimmer onikun94
0
130
Grafana Meetup Japan Vol. 6
Avatar for Taisei Ito kaedemalu
1
200
DDD集約とサービスコンテキスト境界との関係性
Avatar for Aja9tochin pandayumi
2
240
【初心者向け】ローカルLLMの色々な動かし方まとめ
Avatar for Aratako aratako
7
2.7k
なぜスクラムはこうなったのか？歴史が教えてくれたこと/Shall we explore the roots of Scrum
Avatar for Genki Sano sanogemaru
1
410
大「個人開発サービス」時代に僕たちはどう生きるか
Avatar for Sotaro Karasawa sotarok
15
7.4k
ここ一年のCCoEとしてのAWSコスト最適化を振り返る / CCoE AWS Cost Optimization devio2025
Avatar for MasahiroKawahara masahirokawahara
1
1.3k

Featured

See All Featured
It's Worth the Effort
Avatar for 3n 3n
187
28k
KATA
Avatar for Megan Lloyd mclloyd
32
14k
BBQ
Avatar for Matthew Crist matthewcrist
89
9.8k
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
55
13k
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
29
2.8k
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
160
23k
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
126
53k
Being A Developer After 40
Avatar for Adrian Kosmaczewski akosma
90
590k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
Avatar for mongodb mongodb
48
9.7k
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
96
6.2k
Fashionably flexible responsive web design (full day workshop)
Avatar for Andy Clarke malarkey
407
66k
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
411
22k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and