Learning To Crawl (For DockerHub Enthusiasts, Not Toddlers) - Docker Container Images (3/4)
This post is the third part of a series on our recent adventures into DockerHub. Before you read it, you are advised to look at the part other parts of
Research archive, page 7
Earlier vulnerability research from watchTowr Labs. Page 7 of 7.
Layer Cake: How Docker Handles Filesystem Access - Docker Container Images (2/4)
This post is the second part of a series on our recent adventures in DockerHub. Before you read it, you may want to check out the other posts of this
"I don't need no zero-dayz" - Docker Container Images (1/4)
This post is the first part of a series on our recent adventures into DockerHub. You may be interested in the next instalments, which are:
* Layer Cake: How Docker Handles
We're Out Of Titles For VPN Vulns - It's Not Funny Anymore (Fortinet CVE-2022-42475)
As part of our Continuous Automated Red Teaming and Attack Surface Management capabilities delivered through the watchTowr Platform, we analyse vulnerabilities in technology that are likely to be prevalent across
Why It's Not Worth Goading Us On A Friday - CVE-2022-36537 At Scale
At watchTowr, the security of our client's external systems is of priority. And as hackers, bugs are our passion. It's our job to understand emerging weaknesses,
Text4Shell++ - Where There’s Smoke, There’s Fire
(Or at least some ash)
As part of our Attack Surface Management capabilities delivered through the watchTowr Platform, we analyse vulnerabilities in technology that is likely to be prevalent across
OpenSSL 3.0.7 - Otherwise Known As, The Hype That Was Not
Finally, it is midnight (in my timezone, at least) and the wait is over - OpenSSL have published details of their second ever critical severity, nope high-severity (**amended after disclosure)
CVE-2022-44889 - Text4Shell Analysed
As part of our Attack Surface Management capabilities delivered through the watchTowr Platform, we analyse vulnerabilities in technology that is likely to be prevalent across the attack surfaces of our
Walled Off: Handling DNS Poisoning At Scale
As part of the Adversary Sight engine that powers visibility within the watchTowr Platform - we collect troves of attack surface data about our clients for continued and continuous review - providing
All Around The World: The Common Crawl Dataset
At watchTowr, we're big believers that data is power, and ultimately data drives security initiatives - like Attack Surface Management, which we then use to power continuous security testing
The Perils of Expired Domains: We're Reading Your Email
When we think about attack surfaces, historical thinking has thrown us at network services, web applications, APIs and other 'fuller stack' technology layers to review for high-impact
Seasons In The Abyss - Diving into OpenVPN Access Server
Here at watchTowr, we like to proactively audit security-critical codebases which we notice our clients rely on. This feeds our ability to keep external attack surfaces secure, as we
1x Enterprise IAM vs 1x Slanty Boi
OpenAM CVE-2022-34298
As part of our Attack Surface Management capabilities delivered through the watchTowr Platform, we perform zero-day vulnerability research in prevalent technology that we see across