Introducing WebQL, an automated JavaScript analysis tool that leverages CodeQL to identify and exploit vulnerabilities in modern web applications like SPAs and PWAs. By automating the extraction, beautification, and analysis of client-side code, WebQL enhances penetration testing by uncovering security issues obscured by modern development practices.
Testing Lab
Testing Lab
Where our research team shares tools, techniques, and threat intelligence
Security Research
This blog introduces snickerdoodle, a customized Cookiecutter template designed to help penetration testers quickly create and share complex CLI tools. By automating project setup with features like pre-configured CLI interfaces, Rich logging, and integrated dependency management using Poetry, Snickerdoodle allows security professionals to focus on coding rather than boilerplate setup.
403 status code bypasses might seem niche and impractical at first glance, but they can be surprisingly valuable for uncovering vulnerabilities at scale. This blog delves into the nuances of 403 bypass techniques, exploring how tools like Nuclei and Burpsuite can be leveraged to identify hidden admin panels and other restricted areas, even when traditional methods fall short.
Will Vandevanter discusses a talk he saw at Defcon 2024 that was jam-packed with knowledge, hunting an international criminal, 0 days, and a new open-source tool. Will also talks about some takeaways he got from the talk.
Bypass WAFs with gigaproxy: an HTTP proxy that rotates IPs using mitmproxy, AWS API Gateway, and Lambda. Read the blog to learn more.
Delve into the modern techniques and security controls surrounding password spraying. This series will explore the current techniques, tactics, and procedures (TTPs) for password spraying.
Semgrep, or Semantic Grep (For Code) should be a part of your pentesting toolkit. If you think otherwise, read on to see why.
Our approach to mass exploitation of the latest and greatest vulnerability. On the chopping block, this time around: CVE-2024-3400.
Your Always-On Security Engine
Our team utilizes a custom blend of methodologies from the best penetration testing standards.
As an offensive security team, we are committed to providing a world-class capability that blends more seamlessly with your larger operations. While there’s always more work to do, we pride ourselves on our commitment to the continuous model, and expanded risk intelligence it can provide to our customers. If you’re locked into a contract, but are curious to know what this band of practitioners can do, consider engaging us for our Red Team Events.
Casey Cammilleri
Founder & CEO
No slides. No sales pitches. Just real talk about how security leaders evaluate, select, and justify security solutions.
Watch
No slides. No sales pitches. Just real talk about how security leaders evaluate, select, and justify security solutions.
Watch
Join Sprocket's Team as they expose real techniques used to bypass security tools and learn what this means for validating security tools before you buy.
Watch
Penetration testing remains a core pillar of cybersecurity, but not all tests are created equal. This webinar with Sprocket Security and ISC2 recorded on July 24, 2025 explores 5 types
...
Watch
Black Hat and DEFCON (affectionately dubbed Hacker Summer Camp) is right around the corner! Join us as "hackers" everywhere gear up for one of the most anticipated events of the
...
Watch
On this episode of Pentesters Chat, our team explored offensive security engagements.
Watch
Whether you're just starting to explore ASM or are looking to refine your existing strategy, this webinar will provide valuable insights and actionable advice to strengthen your organization’s security posture.
Watch
The Sprocket testing team discusses Single Sign On (SSO).
Watch
The Sprocket testing team discusses Attack Surface Management.
Watch
The Sprocket testing team discusses Password Protected Systems.
Watch
The Sprocket testing team discusses AI and Machine Learning Systems.
Watch
Casey Cammilleri appeared on David Spark's webinar, Super Cyber Friday to discuss all things around the future of pentesting
Watch
