A deep technical breakdown of CVE-2024-0692 and how Sprocket Security developed a working exploit for this high-severity SolarWinds SEM deserialization vulnerability, revealing real-world impact beyond scanner findings.
Testing Lab
Testing Lab
Where our research team shares tools, techniques, and threat intelligence
Security Research
Explore what we know about the emerging WatchGuard CVE-2025-14733 vulnerability — unauthenticated RCE risk, active attacks, affected versions, and response steps.
Microsoft's soft patch didn't kill tenant enumeration. Attackers have new ways to map cloud infrastructure. Learn how modern Azure and Microsoft 365 enumeration techniques work, why they're back, and what defenders should do next.
Emerging React and Next.js vulnerabilities (CVE-2025-55182, CVE-2025-66478): what Sprocket Security is seeing, current detection coverage, and guidance for teams.
OWASP’s 2025 Top 10 shows how security misconfigurations and software supply chain issues dominate. Here’s how continuous pentesting closes the gap.
Follow a vulnerability researcher’s deep dive into FFmpeg’s LADSPA plugin loader and the discovery of CVE-2025-60616 — a logic flaw in how environment variables are trusted. Learn how this vulnerability enables code execution, why fuzzing missed it, and how proper validation and process isolation can prevent similar exploits.
Comcast Business Cybersecurity Threat Report analyzed events, revealing how attackers are shifting tactics and accelerating the pace at which exposures become exploitable. We will expand on four of the threats that keep showing up in breach postmortems, how they work in reality, and what organizations should do about them.
Sprocket Security's Director of Technical Operations reveals how Domain Admin access was gained through overlooked misconfigurations and intricate attack paths, with both insight and humor.
Your Always-On Security Engine
Our team utilizes a custom blend of methodologies from the best penetration testing standards.
As an offensive security team, we are committed to providing a world-class capability that blends more seamlessly with your larger operations. While there’s always more work to do, we pride ourselves on our commitment to the continuous model, and expanded risk intelligence it can provide to our customers. If you’re locked into a contract, but are curious to know what this band of practitioners can do, consider engaging us for our Red Team Events.
Casey Cammilleri
Founder & CEO
No slides. No sales pitches. Just real talk about how security leaders evaluate, select, and justify security solutions.
Watch
No slides. No sales pitches. Just real talk about how security leaders evaluate, select, and justify security solutions.
Watch
Join Sprocket's Team as they expose real techniques used to bypass security tools and learn what this means for validating security tools before you buy.
Watch
Penetration testing remains a core pillar of cybersecurity, but not all tests are created equal. This webinar with Sprocket Security and ISC2 recorded on July 24, 2025 explores 5 types
...
Watch
Black Hat and DEFCON (affectionately dubbed Hacker Summer Camp) is right around the corner! Join us as "hackers" everywhere gear up for one of the most anticipated events of the
...
Watch
On this episode of Pentesters Chat, our team explored offensive security engagements.
Watch
Whether you're just starting to explore ASM or are looking to refine your existing strategy, this webinar will provide valuable insights and actionable advice to strengthen your organization’s security posture.
Watch
The Sprocket testing team discusses Single Sign On (SSO).
Watch
The Sprocket testing team discusses Attack Surface Management.
Watch
The Sprocket testing team discusses Password Protected Systems.
Watch
The Sprocket testing team discusses AI and Machine Learning Systems.
Watch
