Upgrade to PRO for Only $50/Year—Limited-Time Offer! 🔥

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
45

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
150
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
130
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
81
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
130
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
92
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
0
76
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
MS Ignite 2025で発表されたFoundry IQをRecap
Avatar for Akira Sato satodayo
3
230
Sansan Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
3.3k
セキュリティAIエージェントの現在と未来 / PSS #2 Takumi Session
Avatar for GMO Flatt Security flatt_security
3
1.4k
オープンデータの内製化から分かったGISデータを巡る行政の課題
Avatar for 室木直樹 naokim84
2
1.3k
Ryzen NPUにおけるAI Engineプログラミング
Avatar for Jun Ando anjn
0
210
ページの可視領域を算出する方法について整理する
Avatar for yamatai12 yamatai1212
0
160
How native lazy objects will change Doctrine and Symfony forever
Avatar for Benjamin Eberlei beberlei
1
380
Docker, Infraestructuras seguras y Hardening
Avatar for José Juan Sánchez Hernández josejuansanchez
0
150
Master Dataグループ紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
4k
なぜフロントエンド技術を追うのか？なぜカンファレンスに参加するのか？
Avatar for sakito sakito
9
1.9k
Introduction to Sansan for Engineers / エンジニア向け会社紹介
Avatar for Sansan, Inc. sansan33
PRO
5
48k
freeeにおけるファンクションを超えた一気通貫でのAI活用
Avatar for jaxx2104 jaxx2104
3
600

Featured

See All Featured
Connecting the Dots Between Site Speed, User Experience & Your Business [WebExpo 2025]
Avatar for Tammy Everts tammyeverts
10
700
Writing Fast Ruby
Avatar for Erik Berlin sferik
630
62k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
140
34k
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
31
3k
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
14k
KATA
Avatar for Megan Lloyd mclloyd
PRO
32
15k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
12k
Code Review Best Practice
Avatar for Trisha Gee trishagee
73
19k
[RailsConf 2023] Rails as a piece of cake
Avatar for Vladimir Dementyev palkan
58
6.1k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
Avatar for Irina Nazarova irinanazarova
9
1.1k
jQuery: Nuts, Bolts and Bling
Avatar for Doug Neiner dougneiner
65
8.1k
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
33
1.4k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and