PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

From Dial Tone to Throne: IVR Testing in the Spirit of The King of NYNEX

bishopfox.com | blog | #denial-of-service | #penetration-testing | #enumeration | #ivr | #telephony-security | #voice-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

IVR systems are an under-tested attack surface: Bishop Fox covers phone-tree pentesting — account and PIN enumeration, call-flooding DoS, data disclosure — plus steps to harden voice response systems.
Published
Collected

Related coverage

blog · bishopfox.com
Traefik | Version Through 3.7.11
Bishop Fox found that Traefik's request read timeout is not applied to HTTP/3, letting unauthenticated clients hold upstream connections open indefinitely; releases since 2.8.2 are affected.
blog · bishopfox.com
SonicWall Sonicos Versions 7.1.x and 8.0.x
Bishop Fox found an unauthenticated DoS in SonicWall's SSL VPN (CVE-2025-32818): crafted API requests crash and reboot NSv appliances, taking the VPN offline. Patch to 7.2.0/8.0.1 or disable it.
blog · bishopfox.com
Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications
Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.
blog · bishopfox.com
CA Single Sign-On Software Update: Stay Secure
Mike Brooks found two high-risk vulnerabilities in CA Single Sign-On (formerly SiteMinder) enabling denial-of-service and access to sensitive user data; CA shipped a defense-in-depth patch.
blog · portswigger.net
[V13P] Content discovery
Burp v1.3 adds configurable content discovery, combining name guessing, spidering and harvested naming conventions to uncover hidden files and directories in a defined scope.
blog · projectblack.io
Bypassing EDR with Local AI
A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.
Back