PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Otto Support - Testing MCP Servers

bishopfox.com | blog | #ai-security | #pentesting | #agentic-ai | #vulnerability-research | #mcp | #nmap | #nuclei | #broken-access-control | #mcp-inspector
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Closing the otto-support series, the team uses nmap, a Nuclei template, and MCP Inspector to expose an authorization gap that lets any unprivileged user delete other users' tickets.
Published
Collected

Related coverage

blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
tool · github.com
SpecterOps Skills: Open-Source LLM Agent Skills & MCP Plugin Marketplace for Red Teaming and AppSec
As AI-assisted offensive security evolves from simple prompting to multi-agent architectures, SpecterOps standardizes security craft into declarative skills and MCP interfaces, allowing operators to safely orchestrate complex red team tradecraft and reverse engineering directly through LLM agents.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
blog · bishopfox.com
8 Network Pen Testing Tools for Your Hacker Arsenal
Bishop Fox lists eight network penetration testing tools for a hacker's arsenal—Nmap, Pompem, NP, Arp-Scan, and Wifite2 among them—with notes on why each earns a spot in the toolkit.
blog · bishopfox.com
The Pen Testing Tools We’re Thankful for in 2020
Bishop Fox's favorite pen-testing tools of 2020: Nuclei for fast community-driven scanning, Spyse for security-focused OSINT, Smuggler for request smuggling, GoBuster, and other standouts.
Back