Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
63
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
190
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
180
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
110
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
170
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
130
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
120
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
『自分で判断できるか』を基準に、プロダクトのハンズオン研修でAI利用の線を引いてみた / Where We Drew the Line on AI in Hands-on Training
Avatar for yuki honyanya
1
850
When Does a Local Qwen Start to Break
Avatar for Shoto morshoto
0
140
Point Cloud as a Foreign Language for Multi-modal Large Language Model
Avatar for Takuya MINAGAWA takmin
0
360
Guerilla InnerSource in enterprises, during the AI hype
Avatar for Oleg Nenashev onenashev
PRO
0
140
PdMをやめて、 "プロダクトビルダー"という 働き方に変えました / PdM to Product Builder
Avatar for Takuya Shikichi shikichee
2
640
AIとペアプロを始める。人とのペアプロをやめる。ペアプロの良さを改めて知る。もっと好きになった。 / Rediscovering Pair Programming
Avatar for yuki honyanya
1
130
IDperturb: Enhancing Variation in Synthetic Face Generation via Angular Perturbation
Avatar for SansanTech sansantech
PRO
0
110
魔法少女がClaude Codeを監視する / ccportal-deck
Avatar for Noriyuki TAKEI noriyukitakei
3
120
AIで開発は速くなったのに、なぜ現場は楽にならないのか 〜あなたの組織のボトルネックを突き止めるワークショップ〜
Avatar for Kazuto Kusama jacopen
1
210
はじめてのDatabricks：技術者向けワークショップ / beginner-workshop
Avatar for Databricks Japan databricksjapan
PRO
0
110
書籍『生成AIの安全性入門』の入門
Avatar for Koki Wataoka wataoka
0
160
Azure App Service / Container Apps の組み込み認証
Avatar for Kuniteru Asami kuniteru
0
160

Featured

See All Featured
Leading Effective Engineering Teams in the AI Era
Avatar for Addy Osmani addyosmani
9
2.5k
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2.4k
The browser strikes back
Avatar for Jono Alderson jonoalderson
0
1.6k
The Curse of the Amulet
Avatar for Matthew Lei leimatthew05
2
14k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
162
16k
Optimising Largest Contentful Paint
Avatar for Harry Roberts csswizardry
37
3.9k
Max Prin - Stacking Signals: How International SEO Comes Together (And Falls Apart)
Avatar for Tech SEO Connect techseoconnect
PRO
0
430
The Director’s Chair: Orchestrating AI for Truly Effective Learning
Avatar for Mike Taylor tmiket
1
290
How to Think Like a Performance Engineer
Avatar for Harry Roberts csswizardry
28
2.8k
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
163
24k
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
7k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
Avatar for Joe Casabona jcasabona
35
2.8k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and