Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
59
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
190
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
170
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
100
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
160
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
120
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
99
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
個人AIからチームAIへ：開発における品質と生産性の再設計
Avatar for Atsushi Nakatsugawa moongift
PRO
0
320
Sony_KMP_Journey_KotlinConf2026
Avatar for ソニー株式会社 sony
1
180
React、まだ楽しくて草
Avatar for uhyo uhyo
7
1.4k
もりもり新機能を一挙紹介！ AgentCoreに入門して、AWS上にAIエージェントを構築しよう
Avatar for みのるん minorun365
PRO
5
350
さきさん文庫の書籍ができるまで
Avatar for H.Saki sakiengineer
0
320
AI Adaptable なテストを整える工夫 / Ways to Make Your Tests AI-Adaptable
Avatar for 株式会社ビットキー / Bitkey Inc. bitkey
PRO
2
190
Spring AI × MCP 入門〜AIエージェントへのツール公開、境界設計から始める最小構成 〜
Avatar for 宮本裕也 yuyamiyamoto
0
190
なぜハノーバーメッセに行くべきなのか 〜初参加だから語れること〜
Avatar for 田中 聖也 tanakaseiya
0
190
Oracle AI Database@Google Cloud：サービス概要のご紹介
Avatar for oracle4engineer oracle4engineer
PRO
6
1.5k
大規模災害時でも高い信頼性を維持するアプリケーション基盤の実現/nikkei-tech-talk46
Avatar for 日本経済新聞社 エンジニア採用事務局 nikkei_engineer_recruiting
0
120
組織の中で自分を経営する技術
Avatar for shoota shoota
0
230
Unlocking the Apps
Avatar for Tim Perry pimterry
0
130

Featured

See All Featured
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
128
17k
Easily Structure & Communicate Ideas using Wireframe
Avatar for Afnizar Nur Ghifari afnizarnur
194
17k
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2.3k
The Spectacular Lies of Maps
Avatar for Per Axbom axbom
PRO
1
770
HDC tutorial
Avatar for Michiel Stock michielstock
2
680
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
128
55k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
Avatar for Addy Osmani addyosmani
10
1.2k
ラッコキーワード サービス紹介資料
Avatar for ラッコ株式会社 rakko
1
3.5M
How GitHub (no longer) Works
Avatar for Zach Holman holman
316
150k
Collaborative Software Design: How to facilitate domain modelling decisions
Avatar for Kenny Baas-Schwegler baasie
1
230
The Curious Case for Waylosing
Avatar for Cassini Nazir cassininazir
1
360
Amusing Abliteration
Avatar for ianozsvald ianozsvald
1
190

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and