#offensivesecurity — Public Fediverse posts

🎤 DEF CON and Black Hat US stories incoming! And we’re making the next Office Hours session all about them.

Robert Tanase, our Lead Product Manager, just got back from putting AI Pentests in front of two of the toughest crowds in security. Next Wednesday, he joins Jan Pedersen to tell the story.

🗣️ what came up most at each event, and where the two crowds didn't agree
🧭 how it's shaping where AI Pentests goes next
📊 plus the research that started it all: 88% of security practitioners using AI to generate findings hit results needing significant manual validation

30 minutes live. 15 minutes of open Q&A. One session.

Wednesday, August 26
8:00 AM Los Angeles
11:00 AM New York
4:00 PM London
6:00 PM Bucharest

Register here: https://zoom.us/webinar/register/5417815287714/WN_m3AgyHW2TxSFuHr1J5mQZA

#penetrationtesting #offensivesecurity #cybersecurity

You had an idea of what working in #infosec would be before you started. Some of it was accurate.

But what still doesn't match what you expected? Vote here.

What still surprises you about working in infosec?

#offensivesecurity #cybersecurity

251,000 people are running real scans on real targets with the Pentest-Tools.com Free Edition. real targets, real findings, no catch.

Some of that curiosity turns into deeper work over time. not because free isn't real, but because the job grows: more assets, more compliance pressure, more "just double check this one" requests.

When that happens, the paid plans add, on the same scan standard:

✅ authenticated scans, including multi-step logins
✅ API and CMS coverage beyond OWASP Top 10
✅ Sniper: Auto-Exploiter, earning "confirmed" through live exploitation
✅ editable DOCX and Google Doc reports, ready to send

Full breakdown: https://pentest-tools.com/product

Here's to the next 251,000. 🥂

#infosec #offensivesecurity

In my role in #incidentresponse I have run across criminal networks, C2 backends, influence networks, fraud networks and have to remind my team that we do not attack these entities even though it would have been very easy.

Corporate policy and regional laws prohibit official counter attacks.

One question I have about this is, it may be legal in the US with permission, but what about the foreign country.

Lets say there is a pay for click fraud network in Vietnam or Philippines (allegedly backed by gov entities) and my US company takes it down, could those Governments retaliate?

Probably not against the US Gov but as a responder I may not want to travel to Asia, or would my company be negatively impacted in those markets?

What if my computer security company takes down a Russian affiliated entity. Would I feel safe traveling to Europe?

I suspect corporate legal departments may have something to say about potential liability from Global entities.

https://therecord.media/trump-cyber-crime-offensive

#offensivesecurity #infosec #ransomware

One month. That's all CRA is giving you.

Your product needs to be free of known exploitable vulnerabilities, not just at launch, but for the next five years. No extensions, no snooze button.

One month from now, if a vulnerability's being actively exploited, you get 24 hours to raise the flag, 72 hours for the full report, 14 days for the final one. And CRA doesn't grade your company, it grades each product. One pentest a year doesn't cover five years of proof. That's not coverage, that's a coin flip.

Here's where Pentest-Tools.com helps:

✅ Detection - scans run on your release schedule, tracked per product
✅ Validation - findings come with proof, not guesses
✅ Remediation - retests confirm the fix actually worked
✅ Monitoring - ongoing scans catch anything that slips back in

One month on the clock. Better to start the evidence chain now than scramble when it runs out.

Full CRA evidence chain: https://pentest-tools.com/usage/compliance/cra

#CRA #offensivesecurity #infosec

A hardcoded secret. A directory traversal. A SQL injection. Individually, they're just low/medium findings. Chained together, they're a path to critical compromise.

Learn how Autonomous Attack Path Discovery finds the exploit chains traditional scanners miss.

https://xbow.com/whitepapers/the-sum-of-the-parts?utm_source=conference&utm_medium=referral&utm_campaign=defcon-appsec-village

Thank you to XBOW for supporting AppSec Village™ as our Platinum Sponsor at DEF CON 34 and throughout the year!

#AppSec #Cybersecurity #OffensiveSecurity #DevSecOps #DEFCON34

Adversary Wars CTF starts at 10:00 AM PDT tomorrow!
Step into the role of an adversary and put your offensive security skills to the test in the Capture the Flag competition at Adversary Village at @defcon 34.
Location: Contest Area, Adversary Village, Las Vegas Convention Center (LVCC)
Registration is available onsite only.
CTF access is available exclusively at the venue.
More info: https://adversaryvillage.org/adversary-wars-ctf/adversary-wars-6.0/
#AdversaryVillage #DEFCON34 #AdversaryWars #CaptureTheFlag #CyberSecurity #InfoSec #OffensiveSecurity #RedTeam #Hacking

We're taking Specter to DEF CON this year, our first booth ever (1407, West Hall, Aug 6–9). It's an autonomous web app pentesting agent, still in beta, and we're bringing it specifically to get it in front of people who'll try to break it.

Also shipped this month:

Sniper added four exploits: wp2shell (WP Core SQLi), an RCE in Adobe ColdFusion, an RCE in Apache ActiveMQ, and last month's Joomla JCE RCE, now exploitable end to end.

57 new Network Scanner detections, plus a filter to scan only CISA KEV CVEs.

Asset export now includes more detail, and finding status can be updated via the API with a reason attached.

Published pages on how our evidence lines up with DORA, NIS2, SOC 2, CRA, and ISO 27001.

Full changelog: https://pentest-tools.com/change-log
DEF CON page: https://pentest-tools.com/events/defcon-34-2026

Stay sharp, stay human.

#infosec #offensivesecurity

#PanelDiscussion
Adversary Village at @defcon 34!
Join Abhijith B R (Founder, Adversary Village), Bryson Bort (Founder & CEO, Scythe | GRIMM and Co-Founder, ICS Village), Sanne Maasakkers (Threat Intelligence Analyst, Mandiant - Google)and Adam Pennington (ATT&CK Lead, MITRE) for the Adversary Village Kick-Off Keynote.
More info: https://adversaryvillage.org/adversary-events/DEFCON-34/
#AdversaryVillage #DEFCON34 #CyberSecurity #InfoSec #OffensiveSecurity #PanelDiscussion #ThreatIntelligence

Adversary Village proudly presents Adversary Wars CTF at @defcon 34!
Step into the role of an adversary and put your offensive security skills to the test. In this CTF, participants will emulate real-world adversarial tactics and replicate attacks against different elements of a target organization.

CTF Schedule
7 August 2026: 10:00–18:00 PDT
8 August 2026: 10:00–18:00 PDT
9 August 2026: 10:00–12:00 PDT
Location: Contest Area, Adversary Village, Las Vegas Convention Center.
CTF access is available exclusively at the venue!

More info:
https://adversaryvillage.org/adversary-wars-ctf/adversary-wars-6.0/
#AdversaryVillage #DEFCON34 #AdversaryWars #CaptureTheFlag #CyberSecurity #InfoSec #OffensiveSecurity #RedTeam #Hacking

We surveyed 158 security practitioners on AI-assisted vulnerability testing. 88% of them still end up validating results by hand.

The pattern: AI gets heavy use in scanning and discovery (74%), a lot less in exploitation and attack chaining (37%), and even less in post-exploitation (25%). The riskier the phase, the less anyone trusts it to work unsupervised.

The time it saves up front doesn't disappear. It just shows up later, as triage.

Other findings: false positives and hallucinated exploits were the top named frustration, business logic understanding is the gap AI still can't close, and only 20% of teams have a workflow built to handle high volumes of AI-generated findings.

Full survey results, free, no account needed:
https://pentest-tools.com/insights/ai-pentesting-survey

#infosec #offensivesecurity #penetrationtesting

Adversary Village at @defcon 34!
A huge thank you to our sponsors and supporters, @offsec, Security Risk Advisors, HTX, @fortraofficial Cobalt Strike, @plextrac and @alteredsecurity for supporting Adversary Village at DEF CON 34.
Your support helps make hands-on activities, technical talks, adversary tool demos, panel discussions, and the CTF experience possible, bringing the offensive security community together.
Adversary Village schedule: https://adversaryvillage.org/adversary-events/DEFCON-34/
#AdversaryVillage #DEFCON34 #Cybersecurity #InfoSec #OffensiveSecurity #Community

We have 3 reasons for building AI Pentests - the autonomous web app pentesting capability we're launching at DEF CON next week:

1. Doing a successful pentest with AI needs a lot more than good prompts.
2. Your team deserves more than a wrapper around an LLM.
3. AI is only as good as the #offensivesecurity knowledge behind it.

We explain what it does, why we named it Specter, and how to get early access right here: https://pentest-tools.com/features/ai-pentests

#PanelDiscussion
Adversary Village at @defcon 34!
Phillip Wylie (Chief Evangelist and Senior Consultant, Suzu Labs), Michael Bell (Founder and CEO, Suzu Labs), Ed Skoudis (President, SANS Institute and Founder, Counter Hack), and Jon Chase (Lead Security Consultant, LevelBlue) are joining the panel discussion “Offensive Security, AI, and You: What Does the Future Hold?” on 8 Aug 2026 at the Adversary Village Workshop Stage.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
#AdversaryVillage #DEFCON34
#PanelDiscussion #AISecurity #OffensiveSecurity
#Cybersecurity #RedTeam

We are excited to bring Adversary Village to @blackhat USA 2026 in Las Vegas!
Join us at The Interface, Business Hall, Mandalay Bay, from 4–6 August 2026, where we will be hosting hands-on activities focused on offensive cybersecurity and adversary simulation.
Explore our interactive challenge stations, including #AttackOfTheAPTs and #AdversaryCTF, meet the team, connect with the community, and have some fun along the way.
Interface area activity schedule: https://blackhat.com/us-26/features/schedule/index.html?track%5B%5D=the-interface
More info: https://adversaryvillage.org/adversary-events/BlackHat-USA-2026/
#AdversaryVillage #BlackHatUSA #BlackHat #CyberSecurity #OffensiveSecurity #AdversarySimulation #CTF

#HandsOnActivity
Adversary Village at @defcon 34!
Gregory Carpenter, DRPH, Principal Partner at CW PenSec, and Len Noe, Transhuman and Solutions Architect at @BeyondTrust are hosting “Augmented Offense: Open-Source Subdermal Implants as Hacking Tools” on 8 Aug 2026 at the Adversary Village Hands-on Activity Stage.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session: https://adversaryvillage.org/adversary-events/DEFCON-34/Gregory-Carpenter-DrPH
#AdversaryVillage #DEFCON34
#HandsOnActivity #OffensiveSecurity #HackingTools
#OpenSource #AdversaryTactics

Hello Fedi! My employer went through my #PostCovid time with me. Now that I'm back to work full time, they suddenly decided to let me go. 🤷‍♀️ I'm a #pentester with 5 years of experience in the field, before that 3 years of software dev in the #infosec field as well. Got a Bsc. in Computer Sience with emphasis on infosec and networke systems. In my #homelab I'm selfhosting on #proxmox and #k8s. I've been daily driving #linux for the past 20 years, first #gentoo, then #fedora. I'm pretty good with it, but no certs. I'm looking to continue in #offensivesecurity, but would be happy to pivot into infra/network or any other adventure given it's interessting or a good cause. Happy to invest in my skillset. Hybrid in north-eastern #Switzerland fully remote anywhere else.

#getfedihired #fedihired

#TechnicalTalk
Adversary Village at @defcon 34!
Robert Pimentel, Director, Offensive Security at Humana, Inc., will be speaking on “Microsoft and Amazon are my Favorite C2 Providers” on 8 Aug 2026 at DEF CON Creator Stage 3.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session: https://adversaryvillage.org/adversary-events/DEFCON-34/Robert-Pimentel
#AdversaryVillage #DEFCON34
#TechnicalTalk #OffensiveSecurity #CommandAndControl
#CloudSecurity #AdversaryTactics

An AI tool handed one pentester 300 findings. 250 of them were junk.

That's a line from our own research: a survey of 158 security practitioners on how AI is actually changing pentesting. The part that surprised us most wasn't speed, it was trust. Almost 9 in 10 practitioners using AI for finding generation still need real manual validation before they'll trust the output, and hallucinated findings, not cost or integration, are the top frustration they named.

Next Wednesday, Jan Pedersen hosts Office Hours with Robert Tanase, our Lead Product Manager, to break down the triage tax, the trust problem, and what we built in response, benchmark numbers included, not just a claim.

30 minutes live, 15 minutes of open Q&A.

Wednesday, July 29
8:00 AM Los Angeles / 11:00 AM New York / 4:00 PM London / 6:00 PM Bucharest

Register: https://zoom.us/webinar/register/5417815287714/WN_kMwWqNEwQJa8NvfsFw89vw

#offensivesecurity #penetrationtesting

Nolan's Odyssey just hit theaters, and honestly, Odysseus had it easy. Ten years, one long trip, and he was done.

ISO 27001 wants the trilogy every single year: detection, validation, remediation. Three-year cycle, a surveillance audit checking your homework annually. No one-and-done epic here.

Pentest-Tools.com is ISO/IEC 27001:2022 certified. We run the same evidence trail on ourselves:

✅ Detection - CVE, severity, date, logged automatically
✅ Validation - confirmed findings, not just a score
✅ Remediation - retests prove the fix held
✅ Monitoring - scheduled scans, all three years long

No sirens, no Cyclops, just a surveillance audit that stays a review instead of turning into its own odyssey.

Full ISO 27001 evidence chain: https://pentest-tools.com/usage/compliance/iso-27001

#ISO27001 #offensivesecurity #infosec

We are excited to have HTX join us as a Silver Sponsor of Adversary Village at @defcon 34!
HTX is the world’s first Science and Technology agency that integrates a diverse range of scientific and engineering capabilities to innovate and deliver transformative, operationally ready solutions for public safety.
Thank you to the HTX team for your support of Adversary Village. We truly value your partnership and are grateful to have you helping make this year’s event possible.
More about HTX: https://www.htx.gov.sg/
For more information about Adversary Village at DEF CON 34: https://adversaryvillage.org/adversary-events/DEFCON-34/
#HTX #DEFCON34 #AdversaryVillage #CyberSecurity #OffensiveSecurity #PublicSafety #Innovation

We kept getting asked the same handful of questions before people would trust us with a scan against prod.

So we answered them properly instead of one at a time on sales calls.

Non-destructive by default. Our own detection engines, not a wrapper around someone else's open source tools. Findings come with evidence, not just a severity label. Data stays on EU infrastructure, workspaces isolated.

Full FAQ: https://pentest-tools.com/product/faq

#offensivesecurity #pentesting

#HandsOnActivity
Adversary Village at @defcon 34!
Jun Miura, Offensive Security Researcher at Fujitsu Ltd, is hosting “Reconstructing Red Team Engagements: Developing Your Own Red Agent” on 9 Aug 2026 at the Adversary Village Hands-on Activity Stage.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session: https://adversaryvillage.org/adversary-events/DEFCON-34/Jun-Miura
#AdversaryVillage #DEFCON34
#HandsOnActivity #RedTeam #OffensiveSecurity
#RedAgent #AdversaryEmulation #OffensiveTradecraft

We are proud to have Security Risk Advisors as a Gold Sponsor of Adversary Village at @defcon 34!
Security Risk Advisors (SRA) provides specialized cybersecurity services, including Penetration Testing, VECTR™ Purple Teams, Cloud Security, Resilience, Cyber Physical Systems Security, Engineering, and 24×7×365 Cybersecurity Operations.
Thank you to the Security Risk Advisors team for partnering with us and helping make Adversary Village at DEF CON 34 a success.
More about SRA: https://sra.io/
For more information about Adversary Village at DEF CON 34: https://adversaryvillage.org/adversary-events/DEFCON-34/#workshop-schedule
#SecurityRiskAdvisors #SRA #DEFCON34 #AdversaryVillage #OffensiveSecurity #CyberSecurity #PurpleTeam #PenetrationTesting

#HandsOnWorkshop
Adversary Village at @defcon 34!
Michael Ortiz, Red Team Engineer at Red Cell, US Department of State, and Michael Kim, Senior Consultant, Offensive Security, Proactive Services, are leading the hands-on workshop “redStack: Boot-To-Breach Red Team Platform” on 9 Aug 2026 at the Adversary Village Workshop Stage.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session and speakers: https://adversaryvillage.org/adversary-events/DEFCON-34/Michael-Ortiz
https://adversaryvillage.org/adversary-events/DEFCON-34/Michael-Kim
#AdversaryVillage #DEFCON34
#HandsOnWorkshop #RedTeam #OffensiveSecurity
#AdversaryEmulation #RedStack #OffensiveTradecraft #AdversaryTradecraft

#TechnicalTalk
Adversary Village at @defcon 34!
Nikos Vourdas, Senior Offensive Security Consultant at EY, takes the stage with “Yet Another Walking Dead of Active Directory” on 7 Aug 2026 at @defcon Creator Stage 3.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session: https://adversaryvillage.org/adversary-events/DEFCON-34/Nikos-Vourdas
#AdversaryVillage #DEFCON34
#TechnicalTalk #ActiveDirectory #OffensiveSecurity #OffensiveTradecraft
#RedTeam #AdversaryTactics

#WordPress admins - we got you covered! 🫡 → We've just shipped detection for #wp2shell through our Network Scanner. ⚡️ The fastest way to use it is to:

◉ run a single-CVE scan for CVE-2026-63030 - which also covers CVE-2026-60137 - the SQL injection flaw that chains to give attackers RCE
◉ Based on your scan results, either patch or confirm you're already on 6.8.6, 6.9.5, or 7.0.2.
◉ Re-scan to confirm remediation and rule out residual exposure across your other assets.

Remember: updating your main install doesn't cover *every* WP instance you own. Using Pentest-Tools.com means you can expand visibility across your wider attack surface, not just the site you remember exists.

Technical CVE details below. ↘︎↘︎↘︎

See why an estimated 500+ million websites running WP are vulnerable to this critical vulnerability: https://pentest-tools.com/vulnerabilities-exploits/wordpress-core-69-701-pre-auth-blind-sql-injection-batch-route-confusion_29451

#vulnerabilityassessment #ethicalhacking #offensivesecurity