Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
46

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
160
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
140
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
86
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
140
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
96
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
85
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
AWS re:Inventre:cap ～AmazonNova 2 Omniのワークショップを体験してきた～
Avatar for NRI Netcom nrinetcom
PRO
0
120
Scrum Guide Expansion Pack が示す現代プロダクト開発への補完的視点
Avatar for Sonjin Yamamoto sonjin
0
280
田舎で20年スクラム（後編）：一個人が企業で長期戦アジャイルに挑む意味
Avatar for Tomonori Fukuta chinmo
1
860
チームで安全にClaude Codeを利用するためのプラクティス / team-claude-code-practices
Avatar for tomoki10 tomoki10
4
1.8k
2025年の医用画像AI/AI×medical_imaging_in_2025_generated_by_AI
Avatar for YoshihiroTodoroki tdys13
0
290
小さく、早く、可能性を多産する。生成AIプロジェクト / prAIrie-dog
Avatar for Visional Engineering ＆ Design visional_engineering_and_design
0
310
1万人を変え日本を変える!!多層構造型ふりかえりの大規模組織変革 / 20260108 Kazuki Mori
Avatar for SHIFT EVOLVE shift_evolve
PRO
5
610
BidiAgent と Nova 2 Sonic から​考える音声 AI について
Avatar for Yuuki Yamashita yama3133
2
140
Next.js 16の新機能 Cache Components について
Avatar for sutetotanuki sutetotanuki
0
210
Claude Codeを使った情報整理術
Avatar for 西岡 賢一郎 (Kenichiro Nishioka) knishioka
18
11k
あの夜、私たちは「人間」に戻った。 ── 災害ユートピア、贈与、そしてアジャイルの再構築 / 20260108 Hiromitsu Akiba
Avatar for SHIFT EVOLVE shift_evolve
PRO
0
340
松尾研LLM講座2025 応用編Day3「軽量化」 講義資料
Avatar for Aratako aratako
15
4.8k

Featured

See All Featured
Let's Do A Bunch of Simple Stuff to Make Websites Faster
Avatar for Chris Coyier chriscoyier
508
140k
Music & Morning Musume
Avatar for Bryan Veloso bryan
46
7k
Build your cross-platform service in a week with App Engine
Avatar for Jose L jlugia
234
18k
Bootstrapping a Software Product
Avatar for Garrett Dimon garrettdimon
PRO
307
120k
Writing Fast Ruby
Avatar for Erik Berlin sferik
630
62k
The Anti-SEO Checklist Checklist. Pubcon Cyber Week
Avatar for Ryan Jones ryanjones
0
35
Stop Working from a Prison Cell
Avatar for Chris Michel hatefulcrawdad
273
21k
Money Talks: Using Revenue to Get Sh*t Done
Avatar for Nikki Halliwell nikkihalliwell
0
130
Fight the Zombie Pattern Library - RWD Summit 2016
Avatar for Marcelo Somers marcelosomers
234
17k
Lessons Learnt from Crawling 1000+ Websites
Avatar for Charles Meaden charlesmeaden
PRO
0
990
Leo the Paperboy
Avatar for Maya Tellez mayatellez
0
1.3k
Visual Storytelling: How to be a Superhuman Communicator
Avatar for David Neal reverentgeek
2
400

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and