Horizon3.ai
Horizon3.ai

Pentesters

Filters

Tags
Reset

Showing 1–6 of 11 results

VMware vRealize Log Insight VMSA-2023-0001 Technical Deep Dive

January 31, 2023 |

Introduction The recent VMware VMSA describes four new CVEs affecting VMware vRealize Log Insight, reported by ZDI. Three of these CVEs can be combined to give an attacker remote code execution as root. This vulnerability is exploitable in the default configuration for VMware vRealize Log Insight. We have successfully reproduced this exploit and would like to provide the technical details...
Read More
keys neatly aligned in rows

Metrics That Matter: An Attacker’s Perspective on Assessing Password Policy

December 1, 2022 |

After compromising a Windows domain controller, one of the actions that NodeZero, our autonomous pentest product, performs is dumping all domain user password hashes from the Active Directory database. This is a common attacker technique, and the resulting dump is highly valuable to attackers. But did you know that this data is a great source of insight for defenders too?
Read More
Password Spray

The Undeniable Effectiveness of Password Spray

October 20, 2022 |

One of the most effective techniques NodeZero employs for initial access is password spray. It’s a primitive technique, basically guessing passwords, and when it works it feels like magic. Yet we see it work time and time again in various pentests conducted by NodeZero. In this post we’ll talk about what password spray is and walk through how NodeZero weaponizes...
Read More
Proven successful security model vs old industry standard

The Industry Standard Model is the Vulnerability

February 11, 2022 |

Which is more valuable to you; the ability to identify a problem, or the ability to solve the problem? There is a plethora of vulnerability scanning tools that do a decent job identifying vulnerabilities. Unfortunately, those tools rarely discern the possible from the exploitable.
Read More

How can NodeZero help you?

Let our experts walk you through a demonstration of NodeZero, so you can see how to put it to work for your company.

Schedule a Demo