Do You Know Where Your Data Is?

Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.

Indirect prompt injection hides malicious instructions in content LLMs later read—email footers, PDFs, web pages. Real Microsoft 365 Copilot attacks make defense in depth and AI monitoring essential.

Part two of an anti-scraping series applies rate limits, generic errors, and data caps to a demo message board, then shows how scrapers adapt, proving defense in depth beats any single control.

Details a bypass of Mimecast URL Protection and file inspection found during a social engineering pentest, responsibly disclosed to Mimecast, underscoring why layered defenses remain essential.

Introduces dataLoc, a standalone tool that scans live MSSQL databases for payment card data using pattern scoring and Luhn checks instead of keywords, aimed at DBAs, auditors, and testers.

Uses MSSQL's native string functions to rule out tables and columns that cannot hold cardholder data, pairing card-number patterns and Luhn validation to cut the cost of cardholder data discovery.