Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
55

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
180
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
160
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
99
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
150
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
110
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
92
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
スピンアウト講座05_実践活用事例
Avatar for overflow ,Inc overflowinc
0
1.3k
脳が溶けた話 / Melted Brain
Avatar for Keisuke69 keisuke69
1
1.1k
Navigation APIと見るSvelteKitのWeb標準志向
Avatar for Okuto Oyama yamanoku
2
120
AI時代のIssue駆動開発のススメ
Avatar for Atsushi Nakatsugawa moongift
PRO
0
270
韓非子に学ぶAI活用術
Avatar for tomfook tomfook
3
1k
OpenClawでPM業務を自動化
Avatar for 西岡 賢一郎 (Kenichiro Nishioka) knishioka
1
230
BFCacheを活用して無限スクロールのUX を改善した話
Avatar for Ryuya Yanagi apple_yagi
0
130
Change Calendarで今はOK？を仕組みにする
Avatar for tommy tommy0124
1
120
Amazon Qはアマコネで頑張っています〜 Amazon Q in Connectについて〜
Avatar for Yuuki Yamashita yama3133
1
140
LLMに何を任せ、何を任せないか
Avatar for an cap120
10
5.8k
Kubernetesの「隠れメモリ消費」によるNode共倒れと、Request適正化という処方箋
Avatar for g0xu g0xu
0
140
やさしいとこから始めるGitHubリポジトリのセキュリティ
Avatar for Yuta Matsumura tsubakimoto_s
2
1.8k

Featured

See All Featured
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2.2k
Designing Experiences People Love
Avatar for Jonathan Moore moore
143
24k
Prompt Engineering for Job Search
Avatar for Mfonobong Umondia mfonobong
0
230
Navigating the moral maze — ethical principles for Al-driven product design
Avatar for Skipper Chong Warson skipperchong
2
310
A better future with KSS
Avatar for Kyle Neath kneath
240
18k
A Modern Web Designer's Workflow
Avatar for Chris Coyier chriscoyier
698
190k
GitHub's CSS Performance
Avatar for Jon Rohan jonrohan
1032
470k
How to Talk to Developers About Accessibility
Avatar for Jason CranfordTeague jct
2
160
How to Get Subject Matter Experts Bought In and Actively Contributing to SEO & PR Initiatives.
Avatar for Liv Day livdayseo
0
91
Six Lessons from altMBA
Avatar for Skipper Chong Warson skipperchong
29
4.2k
Code Review Best Practice
Avatar for Trisha Gee trishagee
74
20k
Scaling GitHub
Avatar for Zach Holman holman
464
140k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and