Cybersecurity Blog

Trying to wrap your head around what separates Continuous Penetration Testing from other forms of network security testing? Well, we get it.

That’s why we’ve put together this handy little video. Sit back, have a snack and learn how CPT works, why it’s advantageous and how it can help you keep your organization’s network safe.

Read More...

If you’re not in the cybersecurity trenches daily, it can be tough to get a clear understanding of many popular terms used by the professionals testing your organization’s network.

To lend you a hand, we’ve compiled a list of some terms you can expect to see regularly (especially if you work with us). We’ll keep this list updated regularly. And, if you don’t see a term you’ve heard just send us a note. We’ll be sure to add it.

Read More...

Automated Vulnerability Scanners, on the surface, have a lot of appeal to IT directors. But the harsh reality is they provide a false sense of security and leave your network exposed. Click to learn more about understanding scanners and pentesting.

Read More...

Collecting and validating an organization’s employee base is critical for any successful offensive information security operation. With this information, we’re able to conduct social engineering campaigns and password spray endpoints. Check out the full post to learn the process for fully enumerating an organization’s employee base.

Read More...

When starting a penetration test, we first try to discover domains associated with our target apex domain.

To help you navigate this part of the process, we’re going to detail it, highlighting tips and tricks for working around registrant privacy services and other roadblocks you may face.

Read More...

Let’s face it, Slack is a treasure trove of information for hackers. Credentials. Proprietary data. Social engineering opportunities. You get the picture – it’s an information-rich environment.

I’m going to dig into Slack workspace compromise via Mythic C2 and macOS to provide additional information and tooling you can use to leverage a stolen Slack session.

Read More...

Bug-bounty programs live and die by their ability to target public-facing assets and then expose related vulnerabilities. But one asset is out of their reach, and it’s arguably the most dangerous to your network.

Read More...

Recent reports from FireEye revealed a large-scale campaign to infect company networks using a modified version of the SolarWinds Orion monitoring agent.

To give you a clear understanding how continuous penetration testing can help you enumerate the possible use of SolarWinds Orion we’re going to highlight methodologies we use every day at Sprocket.

Read More...

Oh, the world of good ol’ bug-bounty programs. In recent months they’ve become a hot topic for IT teams looking to unearth vulnerabilities.

And it’s easy to see why. They’re flashy and promise the world. Your company gets notified when a vulnerability is detected. The bounty hunter gets paid for the finding. Everybody leaves happy. Well, not really. Find out why.

Read More...

Getting hacked hurts. Not only is it often a PR nightmare and the cause of sleepless nights – a company data breach is a financial fright fest that can cost you millions of dollars. That’s no secret. But often for business owners and executives it isn’t clear why cybersecurity pros use continuous penetration testing to protect their network, brand – and the bank.

In a recent column in InBusiness, Sprocket Security’s founder Casey Cammilleri breaks down the basics of penetration testing and why it’s an essential piece of your network security plan.

Read More...