Penetration Testing Archives - Page 7 of 41

Exploiting Google Calendar: How Cybercriminals Use Calendar Invites to Spread Malicious Links and What You Can Do to Defend Against It

4 March 20254 March 2025 by Krishna

In the context of cybersecurity, the growing trend of exploiting digital calendar platforms is part of a broader shift towards social engineering and phishing attacks. Traditionally, phishing emails were the go-to vector for spreading malware, but attackers have adapted to newer, more subtle methods of infiltration. By exploiting tools like Google Calendar, which are integral to the workflow of millions of users, attackers are finding ways to bypass conventional email filters and reach their targets with greater ease.

Penetration Testing OpenWRT: A Comprehensive Guide for Penetration Testers and Network Architects

27 February 2025 by Krishna

OpenWRT, while highly customisable, is not immune to the common security flaws that affect embedded devices. These can range from default configurations to poorly secured web interfaces

ACRStealer Exposed: How Cybercriminals Are Exploiting Google Docs for Malware Attacks

23 February 2025 by Krishna

What is ACRStealer?

ACRStealer is an **info stealer malware** designed to **extract sensitive information** from infected systems, including:

– **Antivirus identification** – determining which security solutions are present to evade detection.
– **Crypto wallet theft** – targeting stored cryptocurrency assets.
– **Login credentials theft** – stealing usernames and passwords for financial services, corporate accounts, and personal data.
– **Browser information extraction** – harvesting stored passwords, cookies, and browsing history.
– **File Transfer Protocol (FTP) credential theft** – compromising access to cloud and remote servers.
– **Text file harvesting** – reading and extracting information from text documents.

While information stealers are not new, **ACRStealer stands out** due to its **stealth tactics, sophisticated distribution, and abuse of legitimate cloud platforms**.

OWASP Top 10 API Security Risks – 2023: API10:2023 – Unsafe Consumption of APIs

21 February 2025 by Krishna

The term “unsafe consumption of APIs” refers to the practice where developers trust data received from third-party APIs more than they trust user input, leading to weaker security standards for the data coming from these integrated services. Typically, this occurs because third-party APIs are seen as more “trusted” than direct user input, so developers may not apply the same level of scrutiny or security measures when consuming data from these external sources.

Improper-API-Inventory-Mgmt-KrishnaG-CEO

OWASP Top 10 API Security Risks – 2023: API9:2023 – Improper Inventory Management

20 February 2025 by Krishna

Improper inventory management refers to the failure to adequately track and manage the lifecycle of APIs within an organisation. This includes:

– Keeping track of all deployed API versions.
– Documenting endpoints, their functions, and access control requirements.
– Managing deprecated or unused versions.
– Ensuring that sensitive or debug information is not exposed via endpoints.
– Auditing and monitoring API usage regularly.

When APIs are not properly inventoried, organisations may unknowingly expose insecure or deprecated API versions to the public. This can lead to serious security issues, as older versions may lack critical patches or expose debugging functionality that provides attackers with valuable information.