Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
56
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
190
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
170
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
100
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
150
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
120
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
95
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
EBS暗号化に失敗してEC2が動かなくなった話
Avatar for Moe Hamaguchi hamaguchimmm
2
200
Keeping Ruby Running on Cygwin
Avatar for fd0 fd0
0
150
最新の脅威動向から考える、コンテナサプライチェーンのリスクと対策
Avatar for Kyohei Mizumoto kyohmizu
1
700
Sansan Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
4.3k
Do Ruby::Box dream of Modular Monolith?
Avatar for Tomohiro Hashidate joker1007
1
340
コードや知識を組み込む / Incorporate Code and Knowledge
Avatar for Kenji Saito ks91
PRO
0
150
Master Dataグループ紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
4.6k
AI時代 に増える データ活用先
Avatar for ono.takayuki takahal
0
220
QGISプラグイン CMChangeDetector
Avatar for Forestgeo.info naokimuroki
1
390
エージェントスキルを作って自分のインプットに役立てよう
Avatar for Yuta Matsumura tsubakimoto_s
0
320
Oracle AI Database@AWS：サービス概要のご紹介
Avatar for oracle4engineer oracle4engineer
PRO
4
2.3k
Revisiting [CLS] and Patch Token Interaction in Vision Transformers
Avatar for yu4u yu4u
0
360

Featured

See All Featured
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
128
55k
HDC tutorial
Avatar for Michiel Stock michielstock
2
630
Scaling GitHub
Avatar for Zach Holman holman
464
140k
Building a Modern Day 
E-commerce SEO Strategy
Avatar for Aleyda Solis aleyda
45
9k
Optimizing for Happiness
Avatar for Tom Preston-Werner mojombo
378
71k
A better future with KSS
Avatar for Kyle Neath kneath
240
18k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
128
17k
Reflections from 52 weeks, 52 projects
Avatar for Jefferson Lam jeffersonlam
356
21k
Marketing to machines
Avatar for Jono Alderson jonoalderson
1
5.2k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.8k
Building an army of robots
Avatar for Kyle Neath kneath
306
46k
The browser strikes back
Avatar for Jono Alderson jonoalderson
0
970

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and