#infosec

@SecureOwl@infosec.exchange · 3d ago

Mini Pen Test Diaries Story: The year was 2010, and I was onsite at a UK local authority doing an internal network assessment. One of the tasks was - if given a standard, non-privileged, domain user account, with minimal access afforded to it - what could I do? Could I access sensitive documents? Could I login to systems I shouldn't be able to? Could I elevate myself. Standard stuff. I got my account, and immediately started fishing around the main file share with the users home directories on it. To my immense surprise, I found out that I was able to access the content of every single users home directory. Including all the top level folks. They must've accidentally given me some account in an IT group or something, so I check it out. Nope - groups look normal. The permissions on the share look pretty normal too. I play around with the account more and more and encounter zero resistance to anything, access wise. Something must be very wrong - but what? Finally I go over and speak to the IT people who I'd been working with. "So," I said. "This account, it's supposed to have a very minimal permissions set right?" "Yes, the lowest of the low." They reply. "So how come I can get into all these files?" I ask, and show them my rummaging around the very senior peoples confidential files. "You shouldn't be able to do that!!" Now, the three of us are rapidly trying to figure out what the heck is going on. It's surprisingly difficult to figure out. Eventually, I make what to this day remains one of my all time favorite pen testing discoveries. This organisation, had somehow, managed to add the entire "Domain Users" group to the "Domain Admins" group! All 1,500 people who worked there, had domain admin access. And after investigation, we found out it had been like that for 10 months. Someone couldn't get something working, until they found this "fix". Amazing. For more, slightly less mini pen test diaries stories, check out https://infosecdiaries.com #infosec #pentest #pentesting

36

0

20

0

Saphire Lattice

@saphire@dragon.style · May 08, 2026

According to https://letsencrypt.status.io/ "Stopping Issuance for Potential Incident - We have been made aware of a potential incident and are shutting down all issuance." Does that uh, happen often or? #letsencrypt #webdev #infosec

29

8

22

0

Анна

@hannaB@social.vir.group · May 08, 2026

The loudest security headlines are often just theater. The real failures are buried in neglected protocols, misconfigured systems, and the boring gaps no one wants to fund. Don’t let the spectacle distract you from the substance. #security #infosec #protocols

0

Saphire Lattice

@saphire@dragon.style · May 07, 2026

Well, the new Google ReCaptcha is awful, sheesh It's a QR code you have to scan with a "proper" device - aka with Google Services installed Goodbye last 10 years of phishing awareness, time to scan random QRs without a thought while you are purchasing things, woo! Seriously what were they thinking? And because it's recommended to be put in "high risk" places, people will expect them to be seen there, and so a scam/phishing QR will be so much easier to slip in. https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha/ #google #captcha #recaptcha #phishing #infosec #cybersecurity

239

52

286

0

/bin/danger

@adangerbartels@hachyderm.io · Apr 26, 2026

How does one audit a home network reasonably? Thinking of setting up some self hosted stuff that may involve internet ingress. I can DMZ a machine, but it's an i-dont-know-what-i-dont-know situation. Are firewall rules enough? How much should I actually be worrying about someone getting access to my local network segments? #infosec #cybersecurity #diy #selfhosting

1

0

2

0

Adhidarma Hadiwinoto

@adhisimon@mastodon.kodesumber.com · May 06, 2026

Yang masih pakai #httpd nya #apache silahkan dicek, kena impact-nya gak Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE https://thehackernews.com/2026/05/critical-apache-http2-flaw-cve-2026.html #cve #infosec

0

1

0

Andy

@0x4ndy@infosec.exchange · Mar 25, 2026

Having way too much fun with this thing. #m5stack #cardputer #hacking #infosec #security

4

2

1

0

alice

@wheresalice@woof.tech · May 06, 2026

Nice writeup on a session cookie exposure vulnerability, but also on the importance of having strict CAA DNS records for your domains https://mxsasha.eu/posts/ripe-ncc-sso-cookie-exposure/ #infosec #dns

0

Keira (She/Her)

@keira_reckons@aus.social · May 06, 2026

https://www.abc.net.au/news/2026-05-06/australian-educational-facilities-impacted-by-canvas-hack/106650094

We were told about this at uni today. They took pains to tell us they “only” had access to out names, emails, and messages between people. But don’t worry, not our passwords or bank details.

I mean, yes, if they had access to passwords (which ought to be encrypted), or bank details (which ought to be handled separately by someone with better creds than the beleaguered uni IT team), that would be a monumental fuck up bigger than the one that actually happened. But also I* can change a fucking password. I can’t change my uni address. And who knows what people have put into “messages”.

yes, I understand passwords matter because most people reuse them and don’t change them. It’s just a less big deal to me personally.

#breach #privacy #cyber #infosec

8

5

0

FlohEinstein

@FlohEinstein@chaos.social · May 06, 2026

Looks like the problem is fixed and .de-Domains are coming back #DNSSEC #denic #infosec #DNS #Ausfall

4

0

1

0

Ra (Freyja) (it/its)𒀭𒈹𒍠𒊩

@freya@social.highenergymagic.net · May 06, 2026

hey so. looking for a job (NZ or fully remote willing to hire a kiwi) in SRE, security, or linux/Unix system administration. 15 years experience administering Linux and Unix boxes, intermediate level of experience working with docker compose and containerisation and container security. No prior job experience unfortunately, all those 15 years were mostly personal projects and small-scale stuff for friends. I'm also 26, so I started when I was 11, explaining the no jobs so far. Currently running an entire multi-machine personal cloud infrastructure with a demonstration of all the services I have running at https://status.highenergymagic.net Three machines, 72 docker containers. One running most of them, one running Mastodon+glitchsocial, one running the uptime monitor. encrypted root on ZFS, alpine linux, gVisor on supported containers, plan to move to Kata. Entirely willing to accept entry-level job placements, no expectation of being paid a lot or anything, just want to be doing something and move the needle a little on my current "being broke" status. Currently using gVisor, docker compose, and kata containers in production, experience with Linux, docker, Net/Open/FreeBSD, Cisco IOS, Juniper Junos, Mikrotik and UniFi, configuring and administering Asterisk, plus extensive experience with IBM AIX and Sun Solaris. #fedihired #infosec #cybersecurity #linux #unix #docker #sre #DevOps #GetFediHired Please boost for reach, any job offers please DM me.

12

0

92

0

Quad9DNS

@quad9dns@mastodon.social · May 05, 2026

We are monitoring a #DNSSEC-related issue with #DE ccTLD. The issue is not specific to Quad9. We will update once more information becomes available. You can subscribe for updates at: https://uptime.quad9.net/ Our thoughts are with DENIC staff responding to this incident. #HugOps #DNS #infosec

54

1

55

2

Michał "rysiek" Woźniak · 🇺🇦

@rysiek@mstdn.social · May 05, 2026

Looks like DE ccTLD is unresolvable due to DNSSEC issue: https://dnsviz.net/d/nic.de/dnssec/ 😬 #InfoSec #DNSSEC #DNS #Germany

63

59

79

3

Adhidarma Hadiwinoto

@adhisimon@mastodon.kodesumber.com · May 05, 2026

RE: https://mastodon.kodesumber.com/@redis_release_watcher/116522696579501450 Yang punya redis, ada security patch buat CVE-2026-25243 dan CVE-2026-23479. #redis #cve #infosec

0

Morgan

@kaidenshi@exquisite.social · May 04, 2026

Holy shit, Microsoft. Whoever made this decision should be fired. Into the Sun. https://lemmy.world/post/46435614 #infosec #facepalm #clowncar

157

32

186

0

Mike Sheward

@SecureOwl@infosec.exchange · May 05, 2026

Did a good zero knowledge to full control of web app without tools pen test last week.

found /.git/config was readable
said config file contained GitHub personal access token
cloney cloney clone clone
review app source, find lots of debug holes and frankly, nasty sql injection issues
find hardcoded cloud storage credentials in source
party like it were the early 2000’s i guess

#infosec

81

9

40

0

al

@alan@lighthouse.co.im · May 02, 2026

On 25 Feb 2026, the UAE announced the world's first sovereign financial cloud. The CEO: "Finance runs on digital infrastructure; hence it must be sovereign." Four days later, drones hit AWS ME-CENTRAL-1. Two AZs down simultaneously. 109 services disrupted. 37 still dark two months later. They understood the problem. The implementation gap killed them anyway. https://haunted.lighthouse.co.im/articles/finance-runs-on-digital-infrastructure/ #CloudSovereignty #DigitalSovereignty #AWS #CloudResilience #InfoSec #Infrastructure #DataSovereignty #FinTech

2

1

0

Steele Fortress

@steelefortress@infosec.exchange · May 02, 2026

Tenable's Q1 2026 earnings call wasn't just a revenue story. Buried in the executive commentary was a signal worth paying attention to: exposure management is replacing point-in-time vulnerability scanning as the operational standard. Read more: https://steelefortress.com/24lads Cybersecurity #InfoSec #CyberDefense #Encryption #Privacy

0

Olly 👾

@Olly42@nerdculture.de · Apr 28, 2026

Google blocks 8.3B Policy-Violating Ads in 2025, launches Android 17 Privacy Overhaul. The new policy updates relate to contact and location permissions in Android, allowing third-party apps to access the contact lists and a user's location in a more privacy-friendly manner. This includes a new Contact Picker, which offers a standardized, secure, and searchable interface for contact selection. "This feature allows users to grant apps access only to the specific contacts they choose, aligning with Android's commitment to data transparency and minimized permission footprints," Google said. https://android-developers.googleblog.com/2026/03/contact-picker-privacy-first-contact.html ⁉️To comply with this update, developers are being urged to review their apps location usage to ensure that they are requesting the minimum amount of location data necessary for them to function.⁉️ #android #security #privacy #engineer #media #infosec #developer #tech #news

3

1

2

0

Larvitz

@Larvitz@burningboard.net · May 01, 2026

Fresh gist: mitigating CVE-2026-31431 ("Copy Fail") on RHEL 8/9/10 with a tiny Ansible playbook. It blacklists algif_aead via a kernel boot arg (initcall_blacklist=algif_aead_init), reboots only when needed, and asserts the mitigation actually stuck after reboot. Idempotent & safe to re-run. https://codeberg.org/Larvitz/gists/src/branch/main/2026/20260501-CVE-2026-31431_RHEL_Mitigation.md #Ansible #RHEL #Linux #InfoSec #SysAdmin #DevOps #CVE #CVE_2026_31431 #copyfail

27

2

22

1

About This Hashtag

#infosec

Related