Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
56
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
180
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
160
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
100
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
150
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
120
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
94
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
Contract One Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
0
16k
AIペネトレーションテスト・ セキュリティ検証「AgenticSec」ご紹介資料
Avatar for Sho Nakatani laysakura
0
1.6k
プロンプトエンジニアリングを超えて：自由と統制のあいだでつくる Platform × Context Engineering
Avatar for yuriemori yuriemori
0
170
NOSTR, réseau social et espace de liberté décentralisé
Avatar for Renaud Lifchitz rlifchitz
0
150
Master Dataグループ紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
4.6k
DIPS2.0データに基づく森林管理における無人航空機の利用状況
Avatar for Forestgeo.info naokimuroki
0
190
2026年度新卒技術研修 サイバーエージェントのデータベース 活用事例とパフォーマンス調査入門
Avatar for CyberAgent cyberagentdevelopers
PRO
6
7.4k
AI時代に新卒採用、はじめました/junior-engineer-never-die
Avatar for dmnlk dmnlk
0
240
あるアーキテクチャ決定と その結果/architecture-decision-and-its-result
Avatar for Ryo Tomidokoro hanhan1978
2
570
Strands Agents × Amazon Bedrock AgentCoreで パーソナルAIエージェントを作ろう
Avatar for yoko / Naoki Yokomachi yokomachi
2
270
AIがコードを書く時代の ジェネレーティブプログラミング
Avatar for polidog polidog
PRO
3
670
新メンバーのために、シニアエンジニアが環境を作る時代
Avatar for puku0x puku0x
0
650

Featured

See All Featured
Between Models and Reality
Avatar for mayunak mayunak
3
260
JavaScript: Past, Present, and Future - NDC Porto 2020
Avatar for David Neal reverentgeek
52
5.9k
Impact Scores and Hybrid Strategies: The future of link building
Avatar for Tamara Novitovic tamaranovitovic
0
250
We Have a Design System, Now What?
Avatar for Morgane Peng morganepeng
55
8.1k
DevOps and Value Stream Thinking: Enabling flow, efficiency and business value
Avatar for Helen Beal helenjbeal
1
160
Game over? The fight for quality and originality in the time of robots
Avatar for Wayne Barker wayneb77
1
160
Intergalactic Javascript Robots from Outer Space
Avatar for Vicent Martí tanoku
273
27k
jQuery: Nuts, Bolts and Bling
Avatar for Doug Neiner dougneiner
66
8.4k
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
174
15k
SEO for Brand Visibility & Recognition
Avatar for Aleyda Solis aleyda
0
4.4k
A Guide to Academic Writing Using Generative AI - A Workshop
Avatar for Kenji Saito ks91
PRO
1
260
Design of three-dimensional binary manipulators for pick-and-place task avoiding obstacles (IECON2024)
Avatar for konakalab konakalab
0
400

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and