Twitxy
Saved
@SecurIT360's profile picture
View on X

SecurIT360

@SecurIT360

We measure against industry standards, advise how to align with security standards, and train staff to effectively understand and practice information security
Birmingham, AL securit360.com Joined October 2012
158 Following 553 Followers 436 Posts

Latest posts 5

SecurIT360 @SecurIT360
Client-side validation is not a security control. It is a usability feature.

The attacker isn't using your browser. They turned JavaScript off and they're tampering with the request in Burp.

Validate on the server, or you haven't validated at all.
offsec.blog/owasp-top-10-p…
offsec.blog OWASP Top 10 Part 5: Injection Attacks and Real Pen Test War Stories | Ep 199 - Offensive Security... Explore OWASP Top 10 injection attacks through real penetration testing war stories, practical examples, and expert security insights.
SecurIT360 @SecurIT360
Saying let's do security is like saying let's do health. It's too big to start. What happens after Susie in accounting gets compromised? That's a question you can actually answer. @kamakauzy @techspence
offsec.blog/your-employee-…
offsec.blog Your Employee Got Hacked. Now What? | Ep 198 - Offensive Security Blog - SecurIT360 When an employee gets hacked, every second counts. Learn the first steps to contain the breach, protect data, and reduce further risk.
SecurIT360 @SecurIT360
Our password list is 180GB. With mutation rules that is about 4 quadrillion permutations. We have cracked 20+ character passphrases built from Bible verses and popular songs on a gaming PC.
offsec.blog/we-cracked-you… @techspence
offsec.blog We Cracked Your 20-Character Service Account Password | Ep 194 - Offensive Security Blog - SecurI... Learn why poorly secured service accounts can become the fastest route to Domain Admin—and how to reduce privilege escalation risk.
3 replies 9 reposts 65 likes 23K views View on X
SecurIT360 @SecurIT360
1/ Attackers didn't get more capable. We just kept adding things for them to attack.

OWASP built a framework around the opposite idea: what can you delete that erases the attack path entirely? We call it Subtractive Security. Here's the breakdown. 🧵