Skip to content

Threat Research

Unveiling SSL / TLS Vulnerabilities: A Red Teamer's Guide to Exploiting Weaknesses with SSLScan and TestSSL

Unveiling SSL/TLS Vulnerabilities: A Red Teamer’s Guide To Exploiting Weaknesses With SSLScan And TestSSL

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols that ensure secure communication over the internet. They provide data encryption, authentication, and integrity verification to protect sensitive information transmitted between a user’s web browser and a website, or between servers. This security is crucial for online transactions, sensitive data exchange,… Read More »Unveiling SSL/TLS Vulnerabilities: A Red Teamer’s Guide To Exploiting Weaknesses With SSLScan And TestSSL

NoSQL, means “not only SQL,” refers to a broad category of database technologies that are intended to manage huge volumes of unstructured and semi-structured data.

Detecting NoSQL Injection

SQL Injection is an evergreen vulnerability being discovered on a regular basis in enterprise products and open source libraries as shown by the below chart. Apart from SQL Injection, there are multiple types of injection vulnerabilities such as Command Injection, Nosql injection, OS injection, HTML injection etc. Over the past 10 years, NoSQL databases have… Read More »Detecting NoSQL Injection

How do attackers utilize .git

How Do Attackers Utilize .git For Fun And Profit?

Security teams are busy fixing CVEs, SQLi, and other critical vulnerabilities. However, exposing .git can potentially leak credentials, source code and other sensitive information. In this blog, we will uncover the dangers of hidden exposed .git, and how to identify and mitigate the relevant risk. Introduction In the realm of software development, Git stands as… Read More »How Do Attackers Utilize .git For Fun And Profit?

FC Attacking Modern Web Applications

Attacking Modern Web Applications

In the realm of contemporary of Modern web applications, the prevalent architectural framework of choice often takes the form of microservices architecture. In this context, what appears to be a unified front-end application is essentially an amalgamation of numerous small, distinct micro-services on the back end, interconnected through a reverse proxy mechanism. Consider, for instance,… Read More »Attacking Modern Web Applications

SSTI to RCE Blog

Cybersecurity Puzzle: From Server-Side Template Injection (SSTI) to Remote Code Execution (RCE)

In the ever-evolving landscape of cybersecurity, vulnerabilities continue to emerge, putting critical systems and sensitive data at risk. One such threat that has gained notoriety in recent years is the Server-Side Template Injection (SSTI) vulnerability. While SSTI on its own is a concerning issue, what makes it even more perilous is its potential to escalate… Read More »Cybersecurity Puzzle: From Server-Side Template Injection (SSTI) to Remote Code Execution (RCE)

Use Cases
Technology
About
Partner
Resources

FireCompass – An EC Council Ecosystem Company.
©2025 . All Rights Reserved.

Firecompass ranked #1 AI on HackerOne. Read more →