Blog

blog
Blog

Offensive Security Is Now a Must: How CISOs Can Justify OffSec Investment

By Katrina Thompson on Wed, 09/10/2025
With emerging attacks coming harder, faster, and more ingeniously than ever before, organizations can’t afford to sit around and wait for attackers to tell them where their weak spots are. They need to get ahead of and around them with offensive security tactics; think penetration testing and red teaming. Unfortunately, for board members and stakeholders not on the security front lines, OffSec...
Offensive Cybersecurity
Penetration Testing
Red Team
Blog

SEC Readiness: 12 Reasons Why Your Offensive Security Matters More Than Ever

Mon, 09/08/2025
With the U.S. Securities and Exchange Commission’s (SEC) new cybersecurity disclosure rules in full effect as of December 2023, public companies — and even the vendors that support them — are now under unprecedented pressure to not only report material cyber incidents within four business days but also demonstrate robust, actionable cybersecurity plans. This is pushing offensive security (OffSec)...
Offensive Cybersecurity
Blog

Completing the Circle: The Path to CVE-2025-7388

By Marcos Accossatto on Thu, 09/04/2025
On March 6, 2024, Zach Hanley from Horizon3.ai wrote a blog post about reproducing CVE-2024-1403 using an authentication bypass in Progress OpenEdge.In the blog post, he explained the architecture behind OpenEdge and all the technical information related to the CVE-2024-1403 vulnerability. In the same blog post, he also posted a proof of concept (POC) to exploit the vulnerability. However, as this...
new exploit blog
Blog

Core Impact Quarterly Chronicle: Exploits and Updates | Q2 2025

By Pablo Zurro on Fri, 08/22/2025
Core Impact Exploit Library AdditionsOne of Core Impact’s most valuable features is its certified exploit library, maintained by a team (formerly Core Labs) within the Fortra Intelligence & Research Experts (FIRE) group. This team conducts in-depth research to evaluate and prioritize the most critical vulnerabilities, ensuring the library is updated with high-impact, reliable exploits that enable...
Penetration Testing
Black and white photo of hospital environment with lock icon overlay
Blog

Proposed HIPAA Update Makes Yearly Pen Testing Mandatory

By Katrina Thompson on Thu, 07/17/2025
In early 2025, significant changes to the HIPAA Security Rule were proposed by the Office of Civil Rights for the Department of Health and Human Services (OCR). The proposed update to the HIPAA Security Rule, published on January 6, 2025, introduces a significant new requirement: all covered entities and business associates must conduct penetration...
Penetration Testing
Compliance
blog article thumbnail
Blog

Core Impact 21.7: Transform Your Agents

By Pablo Zurro on Wed, 04/30/2025
We’re excited to announce the release of Core Impact 21.7, packed with powerful new features, thoughtful enhancements, and critical fixes that further solidify Core Impact as a go-to solution for penetration testers. This update focuses on extending agent customization options, improving integration with external tools, and optimizing the overall user experience.Agent TransformationsThis new...
Offensive Cybersecurity
Penetration Testing
new exploit blog
Blog

Core Impact Quarterly Chronicle: Exploits and Updates | Q1 2025

By Pablo Zurro on Mon, 04/07/2025
Core Impact Updates New Release: Core Impact 21.7Core Impact 21.7 is now available! This release sees the introduction of the new agent transformation callbacks, a newer UI for the entity's creation dialogs, a series of quality-of-life changes, and more.A more extensive post will be published detailing all the new features and their use cases. Core Impact Exploit Library AdditionsOne of Core...
Penetration Testing
new exploit blog
Blog

Core Impact Monthly Chronicle: Exploits and Updates | December 2024-January 2025

By Pablo Zurro on Wed, 02/19/2025
Core Impact Exploit Library AdditionsOne of Core Impact’s most valuable features is its certified exploit library, maintained by a team (formerly Core Labs) within the Fortra Intelligence & Research Experts (FIRE) group. This team conducts in-depth research to evaluate and prioritize the most critical vulnerabilities, ensuring the library is updated with high-impact, reliable exploits that enable...
Offensive Cybersecurity
Penetration Testing
blog article thumbnail
Blog

Core Impact and Cobalt Strike: Distinct Strengths, Enhanced Combination

By Pablo Zurro on Thu, 01/23/2025
Given its functionality as a multifaceted toolset, there are some features of Core Impact that users may not have taken advantage of. In this post, we’ll talk about SOCKS tunneling. Namely, we’ll walk through use cases of Core Impact’s SOCKS proxy capabilities and how to use it together with Cobalt Strike.What is SOCKS Tunneling?SOCKS Tunneling allows operators to run Core Impact modules and...
Offensive Cybersecurity
new exploit blog
Blog

Core Impact Monthly Chronicle: Exploits and Updates | November 2024

By Daniel De Luca on Thu, 12/12/2024
Core Impact Exploit Library Additions One of Core Impact’s most valuable features is its certified exploit library. Fortra’s Core Security has a team of expert exploit writers that conduct research, evaluating and prioritizing the most relevant vulnerabilities in order to update the library with critical and useful exploits. Additionally, the QA team creates its own clean environment to validate...
Offensive Cybersecurity
new exploit blog
Blog

Core Impact Monthly Chronicle: Exploits and Updates | October 2024

By Pablo Zurro on Fri, 11/08/2024
Core Impact Updates NTMLrelayx MultiRelay and Keep-Relaying Support The latest update to Impacket 0.12 introduces the MultiRelay and keep-relaying modes, allowing users to run relays for extended periods and analyze captured connections for each target. The NTLMrelayx module will continuously relay new incoming connections until manually stopped. This feature, combined with the Connection Store...
Offensive Cybersecurity
Penetration Testing
blog article thumbnail
Blog

How to Proactively Harden Your Environment Against Compromised Credentials

By Pablo Zurro on Wed, 10/23/2024
According to NordPass, the average user maintains an average of 168 logins for personal purposes, and no less than 87 for the workplace. This is an extraordinary amount to keep safe, and threat actors realize that it’s only a matter of time before users make a wrong move and enter those credentials somewhere they’re not supposed to. And this is why, inevitably, they manage to swipe them and sneak...
Offensive Cybersecurity
Penetration Testing
Red Team
blog
Blog

Are You Prepared for Ransomware IRL?

Thu, 10/10/2024
Most ransomware prevention advice focuses on antivirus software and other defenses, such as having good detection and response (DR) mechanisms. All of these are important. But with the advanced level of ransomware today, you also need to take measures that test your defenses and DR strategies to ensure the measures you have in place will hold up to a real-life advanced attack. Working in Theory vs...
Offensive Cybersecurity
Penetration Testing
new exploit blog
Blog

Core Impact Monthly Chronicle: Exploits and Updates | August & September 2024

By Pablo Zurro on Thu, 10/10/2024
Core Impact Exploit Library AdditionsOne of Core Impact’s most valuable features is its certified exploit library. Fortra’s Core Security has a team of expert exploit writers that conduct research, evaluating and prioritizing the most relevant vulnerabilities in order to update the library with critical and useful exploits. Additionally, the QA team creates its own clean environment to validate...
Offensive Cybersecurity
Penetration Testing
blog article thumbnail
Blog

Core Impact 21.6: Take Control with Connection Store

By Pablo Zurro on Mon, 08/12/2024
Core Impact 21.6 is now available. This release sees the introduction of the Connection Store, new reporting features, a newer UI for the entities Quick Information panel, a series of quality-of-life changes and more.(Re)Relay connections through the Connection StoreOnce intercepted, connections are a very valuable asset for pen testers. There are many advantages to connections, even independently...
Offensive Cybersecurity
Penetration Testing
new exploit blog
Blog

Core Impact Monthly Chronicle: Exploits and Updates | July 2024

By Pablo Zurro on Thu, 08/08/2024
Core Impact Exploit Library AdditionsOne of Core Impact’s most valuable features is its certified exploit library. Fortra’s Core Security has a team of expert exploit writers that conduct research, evaluating and prioritizing the most relevant vulnerabilities in order to update the library with critical and useful exploits. Additionally, the QA team creates its own clean environment to validate...
Offensive Cybersecurity
Penetration Testing
Core Security blog thumbnail
Blog

3 Components of a Proactive Security Strategy 

Mon, 07/22/2024
Your organization might have many cybersecurity defenses in place, but defenses alone are not enough to protect you from today’s multi-faceted cyberattacks. Proactively adding a layer of offensive security assessment and testing helps you pinpoint your system weaknesses before they are exploited. Proactive security measures help you stay ahead of attackers by: Identifying vulnerabilities and...
Offensive Cybersecurity
Penetration Testing
new exploit blog
Blog

Core Impact Monthly Chronicle: Exploits and Updates | June 2024

By Pablo Zurro on Thu, 07/11/2024
Core Impact Exploit Library AdditionsOne of Core Impact’s most valuable features is its certified exploit library. Fortra’s Core Security has a team of expert exploit writers that conduct research, evaluating and prioritizing the most relevant vulnerabilities in order to update the library with critical and useful exploits. Additionally, the QA team creates its own clean environment to validate...
Offensive Cybersecurity
Penetration Testing
blog article thumbnail
Blog

CISO Commentary: The Art of Patching

By Chris Reffkin on Tue, 07/09/2024
Recently, Core Security released the 2024 Penetration Testing Report, which shares the results from an annual survey of cybersecurity professionals on their experiences with offensive security strategies and solutions. In this series, we’re taking a deeper dive into some of the most noteworthy findings from the survey, with expert insights from Fortra’s CISO, Chris Reffkin, and Lead Product...
Offensive Cybersecurity
Penetration Testing
blog article thumbnail
Blog

CISO Commentary: Budgeting for Offensive Security

By Chris Reffkin on Mon, 06/24/2024
Recently, Core Security released the 2024 Penetration Testing Report, which shares the results from an annual survey of cybersecurity professionals on their experiences with offensive security strategies and solutions. In this series, we’ll take a deeper dive into some of the most noteworthy findings from the survey, with expert insights from Fortra’s CISO, Chris Reffkin, and Lead Product Manager...
Offensive Cybersecurity
Penetration Testing