PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Recon Hacker’s Opinion: How Human Ingenuity Uncovers More Attack Surface

bugcrowd.com | blog | #attack-surface | #automation | #attack-surface-management | #bugcrowd | #recon | #human-intuition
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part 4 of Bugcrowd's ASM series argues automation alone is incomplete: human researchers excel at scope judgment, tailoring recon to organizational rhythms, and verifying ambiguous assets.
Published
Collected

Related coverage

blog · yeswehack.com
‘People think I’m all about automation, but I only automate recon’: how rabhi became our all-time #1 Bug Bounty hunter
YesWeHack interviews Issam Rabhi, its all-time #1 bug bounty hunter, on his path from reverse engineering to top rankings, his recon-first automation methodology, favourite vulnerability types, notable finds, and advice for aspiring hackers.
blog · netspi.com
2021 Cyber Security Predictions: A Forecast for the Future
A NetSPI director offers eight predictions for 2021: automation paired with human context, security hiring and budgets, risk-based security, insider threats, and external attack surface management.
blog · netspi.com
Analyzing DNS TXT Records to Fingerprint Online Service Providers
Analyzes leftover domain-validation TXT records across a million domains to fingerprint the online service providers a company uses, releasing a PowerShell script to automate the reconnaissance.
blog · projectzero.google
Windows Sandbox Attack Surface Analysis
Analyzing the attack surface of user-mode sandboxed applications helps find elevation of privilege bugs; automating the enumeration matters for initial analysis and detecting regressions.
blog · bugcrowd.com
Behind the scenes of PHP2Shell: What the last 72 hours taught us
PHP2Shell hit fast. Bugcrowd’s CISO shares what 72 hours of response taught us, plus three lessons for CISOs facing the next critical vulnerability.
blog · bugcrowd.com
CISA’s VDP platform: Five years of collaborative defense
CISA’s VDP Platform marks five years with nearly 45,000 submissions and 5,300+ vulnerabilities fixed across 60+ federal agencies. See the key findings.
Back