The Axios supply chain attack exposed why dependency scanning fails against credential compromise. Learn how attackers backdoor popular packages and what your penetration tests are missing.
Testing Lab
Testing Lab
Where our research team shares tools, techniques, and threat intelligence
Security Research
Multifunction printers silently store domain credentials, expose unauthenticated management interfaces, and sit on flat networks. Learn how attackers exploit MFPs to achieve domain admin in minutes.
Understanding how SiteGround’s proof-of-work CAPTCHA silently disrupts automated WordPress security scans and how to work around it.
Decompiling a retired .NET application reveals how a single middleware misconfiguration leads to full authentication bypass.
Why traditional API pentests miss real commerce risk and how cart tokens, checkout flows, and cross-layer auth gaps expose customer data.
LLM behavior isn't governed by a rulebook — it emerges from context, shaped by a stack of training, fine-tuning, and runtime instructions. Understanding this explains why the same model gives radically different responses to functionally identical requests.
Sometimes when conducting a Penetration Testing exercise or Red Team engagement, you might be interested in extracting password hashes or credentials of your target Windows user, without the use of Mimikatz to avoid detection. This is where you would resort to using an NTLM downgrade attack. In this article we shall discuss how you can be able to perform this...
Nick Aures guides us through a real-life pentesting moment with important lessons for authentication using industry-standard technology, in this case JWTs.
Your Always-On Security Engine
Our team utilizes a custom blend of methodologies from the best penetration testing standards.
As an offensive security team, we are committed to providing a world-class capability that blends more seamlessly with your larger operations. While there’s always more work to do, we pride ourselves on our commitment to the continuous model, and expanded risk intelligence it can provide to our customers. If you’re locked into a contract, but are curious to know what this band of practitioners can do, consider engaging us for our Red Team Events.
Casey Cammilleri
Founder & CEO
No slides. No sales pitches. Just real talk about how security leaders evaluate, select, and justify security solutions.
Watch
No slides. No sales pitches. Just real talk about how security leaders evaluate, select, and justify security solutions.
Watch
Join Sprocket's Team as they expose real techniques used to bypass security tools and learn what this means for validating security tools before you buy.
Watch
Penetration testing remains a core pillar of cybersecurity, but not all tests are created equal. This webinar with Sprocket Security and ISC2 recorded on July 24, 2025 explores 5 types
...
Watch
Black Hat and DEFCON (affectionately dubbed Hacker Summer Camp) is right around the corner! Join us as "hackers" everywhere gear up for one of the most anticipated events of the
...
Watch
On this episode of Pentesters Chat, our team explored offensive security engagements.
Watch
Whether you're just starting to explore ASM or are looking to refine your existing strategy, this webinar will provide valuable insights and actionable advice to strengthen your organization’s security posture.
Watch
The Sprocket testing team discusses Single Sign On (SSO).
Watch
The Sprocket testing team discusses Attack Surface Management.
Watch
The Sprocket testing team discusses Password Protected Systems.
Watch
The Sprocket testing team discusses AI and Machine Learning Systems.
Watch
