Benjamin Harris

We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI

Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries. Summary What started out as a bit of fun between colleagues while avoiding the Vegas heat and $20 bottles of water in our Black Hat hotel rooms - has now seemingly become a

ProjeQtOr - <10.2.2 Direct Object Injection Vulnerability

As part of our Continuous Automated Red Teaming and Attack Surface Management technology within the watchTowr Platform, we perform zero-day vulnerability research in technology that we see across the attack surfaces of organisations leveraging the watchTowr Platform. This enables proactive defence for our clients and provides forward visibility of vulnerabilities

The Perils of Expired Domains: We're Reading Your Email

When we think about attack surfaces, historical thinking has thrown us at network services, web applications, APIs and other 'fuller stack' technology layers to review for high-impact weaknesses. But, as real attackers, we look at organisations holistically and consider anything that is exposed to the Internet or could