Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
66
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
200
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
190
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
120
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
180
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
130
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
130
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
アカウント統制の健康診断
Avatar for KenichiNakamura kenichinakamura
1
190
これだけは抑えておきたい！後悔しない re:Invent の過ごし方 / AWS re:Invent 2026 prestudy
Avatar for Masanori Yamaguchi kinunori
2
340
正解のない研修に放り出されて / Being thrown into a training program with no right answers
Avatar for akira ohno ohnoeight
1
150
導入から定着へ ~コーディングエージェントを日常業務に組み込む実践知~
Avatar for Yuki Sakai yukisakai1225
0
230
Obsidian Vault Architectures
Avatar for Daisuke Masuda x5gtrn
PRO
0
150
AIコーディングを実践してきた1年を振り返る / Looking Back on a Year of Practicing AI Coding
Avatar for 武田隆志 takedatakashi
1
130
ポケモン対戦を自動で記録して振り返ろう
Avatar for Yusuke Fukasawa fufufukakaka
0
400
freeeにおける AI を用いた ブラウザ動作確認の自動化の取り組み
Avatar for freee freee
PRO
0
220
クラウドエージェントの先駆け Devin。今も最先端を走る、他との違い
Avatar for kinopee kinopeee
0
370
ドメインエキスパートは いかにして AI を使って プロダクト開発をするか
Avatar for tshiraishi tatsuyashiraishi
1
190
スクラム祭り2026福井トラック_閉じたループから価値のスパイラルへ
Avatar for Takaya Nakanishi kc_nakanishi
0
170
局所最適は悪ではない。壊れているのは指標です。量と質を同時に見る先行指標の設計
Avatar for Recruit recruitengineers
PRO
2
1.2k

Featured

See All Featured
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
331
25k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
348
41k
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
6.3k
Agile Actions for Facilitating Distributed Teams - ADO2019
Avatar for Mark Kilby mkilby
0
320
The browser strikes back
Avatar for Jono Alderson jonoalderson
0
1.9k
Practical Tips for Bootstrapping Information Extraction Pipelines
Avatar for Matthew Honnibal honnibal
25
2.1k
A brief & incomplete history of 
UX Design for the World Wide Web: 1989–2019
Avatar for Jason CranfordTeague jct
2
540
Navigating Algorithm Shifts & AI Overviews - #SMXNext
Avatar for Aleyda Solis aleyda
1
1.7k
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.6k
Chasing Engaging Ingredients in Design
Avatar for Sebastian Deterding codingconduct
0
370
Into the Great Unknown - MozCon
Avatar for Noah Learner thekraken
41
2.8k
Crafting Experiences
Avatar for Bethany Jepchumba bethany
1
390

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and