Cyber Security

  Introduction Everyone in the IT Industry is alarmed by the discovery of a 0-day vulnerability in the famous Log4j, java logging framework. It's been assigned with a CVSS score of 10, which means any application using a vulnerable version of Log4j can be exploited by anyone. Such is the the severity of this vulnerability. It's imperative to fix this vulnerability and there are various threads out there on how to fix this issue and there are different third-party tools to find the usage of vulnerable log4j jars. This blog will not talk about this and is talking about the importance of keeping track of your IT Assets to stay resilient when attacks of such scale emerge in the future.  Know Your Attack Surface Attack Surface - Different Points in the IT landscape of an organization, through which an attacker can attack your IT Infrastructure.  With the increase in the IT complexity and the presence in the IT Landscape, the Attack surface of any organization is growing day by...

 Nuclei by Project Discovery Nuclei is an automation tool built by Project Discovery. The tool is open source and has various CVE Templates bundled with it. Also, the templates are updated on a regular basis. You can also create a customized template for your needs.    Why I chose Nuclei as a DAST tool? I've been doing Product Security Testing for one of my targets. We have found various categories of bugs manually, and considering the fact that the product is a growing one and the same bug may pop-out again, we have decided to automate the security cases that we have found earlier. The tools that I considered are Burp, ZAP automation, and later I got to know about Nuclei.  I'm using the free version of Burp and it doesn't support automation, otherwise an excellent tool. ZAP is an open source tool, and it has so many options available but I feel it to be little complicated and find it difficult to use on a regular basis.  On surfing Twitter and YouTube, I got to...