Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
47

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
170
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
150
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
92
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
140
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
110
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
88
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
【NGK2026S】日本株のシステムトレードに入門してみた
Avatar for 高橋かずひと kazuhitotakahashi
0
280
Deno・Bunの標準機能やElysiaJSを使ったWebSocketサーバー実装 / ラーメン屋を貸し切ってLT会! IoTLT 2026新年会
Avatar for you（@youtoy） you
PRO
0
210
コスト削減から「セキュリティと利便性」を担うプラットフォームへ
Avatar for SansanTech sansantech
PRO
1
710
AIとともに歩む情報セキュリティ / Information Security with AI
Avatar for Hokuto Hoshi kanny
4
3k
DEVCON 14 Report at AAMSX RU65: V9968, MSX0tab5, MSXDIY etc
Avatar for Akira Tsukamoto mcd500
0
240
What happened to RubyGems and what can we learn?
Avatar for Mike McQuaid mikemcquaid
0
180
KubeCon + CloudNativeCon NA ‘25 Recap, Extensibility: Gateway API / NRI
Avatar for Aya (Igarashi) Ozawa ladicle
0
160
usermode linux without MMU - fosdem2026 kernel devroom
Avatar for Hajime Tazaki thehajime
0
160
セキュリティについて学ぶ会 / 2026 01 25 Takamatsu WordPress Meetup
Avatar for Rocket Martue rocketmartue
1
230
SREが向き合う大規模リアーキテクチャ 〜信頼性とアジリティの両立〜
Avatar for Kuniaki Moriya zepprix
0
300
今日から始める Amazon Bedrock AgentCore
Avatar for Har1101 har1101
4
300
ファインディの横断SREがTakumi byGMOと取り組む、セキュリティと開発スピードの両立
Avatar for adachi.ryo rvirus0817
1
820

Featured

See All Featured
Code Review Best Practice
Avatar for Trisha Gee trishagee
74
20k
Reflections from 52 weeks, 52 projects
Avatar for Jefferson Lam jeffersonlam
356
21k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
340
58k
Designing for humans not robots
Avatar for Tammie Lister tammielis
254
26k
Everyday Curiosity
Avatar for Cassini Nazir cassininazir
0
120
What Being in a Rock Band Can Teach Us About Real World SEO
Avatar for Ade Holder 427marketing
0
170
How to Ace a Technical Interview
Avatar for Jacob Kaplan-Moss jacobian
281
24k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
135
9.7k
The untapped power of vector embeddings
Avatar for Frank van Dijk frankvandijk
1
1.6k
Heart Work Chapter 1 - Part 1
Avatar for Lake Fama lfama
PRO
5
35k
Become a Pro
Avatar for Speaker Deck speakerdeck
PRO
31
5.8k
Joys of Absence: A Defence of Solitary Play
Avatar for Sebastian Deterding codingconduct
1
280

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and