Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
37

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
140
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
91
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
69
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
110
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
73
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
0
52
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.5k

Other Decks in Technology

See All in Technology
Oracle Cloud Infrastructure データベース・クラウド：各バージョンのサポート期間
Avatar for oracle4engineer oracle4engineer
PRO
48
33k
Drawing with LLMs
Avatar for Rist Inc. rist
0
240
データ戦略部門 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
3.2k
AI Engineering Summit Pre Event LT #10
Avatar for Kaoru okaru
2
520
開発効率と信頼性を両立する Ubieのプラットフォームエンジニアリング
Avatar for teru0x1 teru0x1
0
120
dbt Cloudの新機能を紹介！データエンジニアリングの民主化：GUIで操作、SQLで管理する新時代のdbt Cloud
Avatar for Sagara sagara
0
160
Test Smarter, Not Harder: Achieving Confidence in Complex Distributed Systems
Avatar for Elias Nogueira eliasnogueira
1
140
型システムを知りたい人のための型検査器作成入門
Avatar for Yusuke Endoh mame
14
3.3k
GitHub Copilot Use Cases at ZOZO
Avatar for Ryosuke Horie horie1024
1
510
MCPを利用して 自然言語で 3Dプリントしてみよう！
Avatar for 濱田孝治 hamadakoji
0
1.3k
単一Gitリポジトリから独立しました
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
400
おれのAI活用の現状とこれから
Avatar for TsukasaSekiguchi tsukasagr
0
130

Featured

See All Featured
The Art of Delivering Value - GDevCon NA Keynote
Avatar for David Neal reverentgeek
14
1.5k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
430
65k
jQuery: Nuts, Bolts and Bling
Avatar for Doug Neiner dougneiner
63
7.8k
Code Reviewing Like a Champion
Avatar for maltzj maltzj
524
40k
The Web Performance Landscape in 2024 [PerfNow 2024]
Avatar for Tammy Everts tammyeverts
8
640
Building a Modern Day 
E-commerce SEO Strategy
Avatar for Aleyda Solis aleyda
41
7.3k
Adopting Sorbet at Scale
Avatar for Ufuk Kayserilioglu ufuk
77
9.4k
Writing Fast Ruby
Avatar for Erik Berlin sferik
628
61k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
245
12k
How to Ace a Technical Interview
Avatar for Jacob Kaplan-Moss jacobian
276
23k
Building a Scalable Design System with Sketch
Avatar for Laura Van Doore lauravandoore
462
33k
GitHub's CSS Performance
Avatar for Jon Rohan jonrohan
1031
460k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and