Resources
Video

The Critical Next Steps After a Pen Test

Fri, 06/17/2022
You’ve completed a pen test and, not surprisingly, the offensive security exercise turned up multiple weak points and exploitable vulnerabilities across your enterprise environment. Now what? How do you do ensure your pen test results are actionable and that you get the support from leadership to act on the findings? How do you assess the risk and threat level of each discovered issue and create...
Offensive Cybersecurity
Penetration Testing
Proactive Guide to Federal Cybersecurity thumbnail
Guide

A Proactive Approach to Federal Cybersecurity

Cyber criminals focus on the easiest targets, which often are federal agencies. A recent White House Executive Order on cybersecurity puts renewed focus squarely on securing federal network infrastructure, which means federal agencies must step up their security games, complying with both existing and emerging regulations related to information security. Among other things, the order promotes...
Penetration Testing
Red Team
Security shield with keyhole
Video

Total Vulnerability Management: Securing Both Networks and Applications

Mon, 06/06/2022
To secure your organization effectively, you need to manage vulnerabilities in both your networks and applications. This requires a strategic approach to vulnerability management that looks at everything from application code to systems integrations. In this session, we will discuss vital steps in managing vulnerabilities and share which types of tools are best for each task. Included in this...
Getting Inside the Mind of An Attacker Part One Thumbnail
Video

Proactive Cybersecurity - The One Place Where "You're Being Offensive" is a Compliment

Mon, 06/06/2022
Cyber attackers are often portrayed as evil masterminds, but the truth is, most attackers are looking for the simplest wins. So what’s the best way to reduce your risk against threat actors? In addition to having reactive solutions and processes in place, organizations should also take a proactive approach, placing as many obstacles in an attacker’s way to make it too labor intensive to bother...
Penetration Testing
Are you ready for a pen test
Blog

Are You Ready for a Penetration Test?

Thu, 05/26/2022
The phrase “you’ve got to walk before you can run” is something that we’ve all heard and rolled our eyes at least once in our lives after we’ve attempted an advanced skill before mastering the basics. The saying is unfortunately very accurate when it comes to cybersecurity. Maturing your vulnerability management program is a process that must be done thoughtfully, ensuring you have a proper...
Penetration Testing
External Attacks on Active Directory
Video

Getting Inside the Mind of an Attacker: Active Directory Attack Scenarios

Thu, 05/26/2022
Active Directory is often considered the holy grail for cyber attackers, and for good reason. Once they have control of this critical asset, they essentially have the keys to the kingdom and can easily access, create, or modify any of the main accounts, including trust relationships and domain security policies. Despite best efforts and intentions, Active Directory may be far more at risk than we...
Building a Proactive Security Strategy
Video

Building a Proactive Security Strategy

Sat, 05/21/2022
Advancing your vulnerability management programme may be a journey, but it is a journey well worth taking and cannot be done overnight. As your programme matures the better your organisation can avoid costly attacks and breaches that may harm your business and reputation. Learn how a proactive cybersecurity program can be a game changer for an organisation's success through continuously assessing...
Penetration Testing
ransomware simulator
Blog

Core Impact Introduces Ransomware Simulation

By Pablo Zurro on Fri, 05/20/2022
Once upon a time, it was often necessary to define the term “ransomware” as it was frequently met with questioning looks and the need for clarification. Nowadays, you can hardly go a day without hearing about some sort of attack. What has made ransomware such a pervasive threat, and how can organizations learn to better protect themselves? In this blog, we’ll discuss why so many are worried about...
Penetration Testing
Article

Core Impact Issues Latest Exploit for F5 BIG-IP iControl REST Vulnerability

The F5 BIG-IP iControl REST vulnerability, a critical authentication bypass vulnerability that leads to unauthenticated remote code execution, is quite simple to exploit and provides an attacker with a method to execute arbitrary system commands as root. In this blog, we’ll explore exactly what this vulnerability is and how Core Impact can help you quickly uncover and exploit it during a...
Penetration Testing
What is OWASP
Blog

What is OWASP?

Tue, 05/03/2022
The cybersecurity world has so many acronyms, and yet we pretend to know what all of them are. However, there are many occasions that leave us wracking our brains, trying to remember what one stands for. Is it a product? An organization? A process? One acronym that everyone should know is OWASP—the Open Web Application Security Project. OWASP is a vital non-profit that works to improve software...
Penetration Testing
Achieve SIEM Success
Blog

Overcome These 3 Challenges to Achieve SIEM Success

By Pablo Zurro on Tue, 05/03/2022
Security Information and Event Management (SIEM) solutions can take much of the tedium and guesswork out of monitoring, managing, and prioritizing critical security events. That’s why increasing numbers of cybersecurity professionals are embracing SIEM. In the 2022 SIEM Report from Cybersecurity Insiders, 80% of cybersecurity professionals consider SIEM to be very important or extremely important...
SIEM
Guide

2022 SIEM Report

Security Information and Event Management (SIEM) solutions help organizations like yours centralize security protocols through effective security event management. SIEM solutions collect, aggregate, and analyze log and event data from various IT systems, creating reports on suspicious activity to monitor the health of the IT environment. The 2022...
SIEM
ransomware simulator
Video

Keeping Security SIEM-ple: 2022 Survey Results Revealed

Thu, 04/21/2022
With the dizzying number of systems, applications, and devices used in today’s organizations, constant data streams leave security professionals poring over endless security event alerts. Security Information and Event Management (SIEM) solutions aim to simplify the chaos by monitoring data sources for unusual activity to help identify and escalate critical security events. According to the 2022...
SIEM
Article

Proof of Concept: CVE-2022-21907 HTTP Protocol Stack Remote Code Execution Vulnerability

In this blogpost, we’ll briefly describe how we developed a DoS module for CVE-2022-21907. Instead of viewing it in a result-oriented way, we’ll approach it from a research standpoint, describing the process of developing this module for Core Impact. On Jan 11th 2022 Microsoft released a Security Update for a RCE vulnerability (CVE-2022-21907) in http.sys. According to Microsoft, this...
Article

Reversing and Exploiting with Free Tools: Part 13

In part 12, we completed the ROP bypass of the DEP in 64 bits. In this part, we’ll analyze and adapt the RESOLVER for 64 bits. Resolution of the 64-Bit Exercise As a quick point of clarification, the shellcode is not mine. However, it is quite public, so it was simply adapted for this example. Complete Solution Script Just to mix things up a bit, let’s start out by looking at the complete...
The Importance of Penetration Testing for Cloud Infrastructures
Blog

The Importance of Penetration Testing for Cloud Infrastructures

Thu, 04/07/2022
With cybersecurity threats perpetually looming, many organizations have come to rely on penetration testing to assess their security stance and uncover weaknesses. According to the 2023 Pen Testing Report, 86% of respondents reported they pen test at least once a year. But are security teams testing every aspect of their IT infrastructure? Internal and external network penetration tests...
Penetration Testing
Pen Testing in Different Environments
Blog

Pen Testing in Different Environments

Thu, 04/07/2022
As security threats persist, cybersecurity professionals are increasingly relying on penetration testing to uncover weaknesses and assess their security stance. According to the 2023 Pen Testing Report, 94% of respondents reported pen testing was at least somewhat important to their security posture. Organizations use a variety of methods to conduct such tests, using pen testing services, in-house...
Penetration Testing
Upcoming Webinar or Event

Get Custom Pricing for the Offensive Security - Advanced Bundle

Advanced Bundle Overview Swiftly advance your cybersecurity program with this security testing bundle that features both an advanced penetration testing tool, Core Impact, and Cobalt Strike, threat emulation software intended for advanced adversary simulation and Red Team engagements. While Core Impact and Cobalt Strike enable a proactive approach to security individually, they are even more...
2022 Pen Testing Report
Video

The Practice of Pen Testing: 2022 Survey Results Revealed

Tue, 03/22/2022
It seemed like all the challenges of 2020 carried over into 2021, and cybersecurity was no exception. Threat actors appeared to outpace every industry with staggering numbers of cyber-attacks, perhaps most notably with the perpetual uptick in ransomware attacks and the Log4j zero-day vulnerability. It was a year in which many organizations learned the importance of proactive cybersecurity,...
Why It’s Not Core Impact vs. Core Impact
Blog

Why It’s Not Core Impact vs. Cobalt Strike

Tue, 03/15/2022
Making a decision on a new cybersecurity tool is never easy—particularly when it’s unclear how rival products compare. It’s tempting to simply type “product vs. product” into Google and see if one stands out as the clear favorite. However, sometimes you can find that two products have been mistakenly grouped together and aren’t actually in competition, but rather, they are in separate categories....
Penetration Testing
Red Team