On Saturday, October 18th, 2025, OWASP Ottawa conducted the "Pentest 101" workshop.

The workshop was delivered by Chris Shepherd, an important member of our volunteer team, and led 38 attendees through the lifecycle of a web application penetration test. Chris covered reconnaissance (gathering information about our target web application), testing security controls using browser and dev tools only (testing for SQL Injection), and then using ZAP proxy to intercept and replay requests to perform attacks such as XSS and SSRF. Chris also walked attendees through how to prepare a professional write-up for these findings so that technical and non-technical people can understand the details and impact of these findings.

OWASP Ottawa would like to officially thank our workshop sponsors for supporting this event (in no-particular order):
1. @uottawa Faculty of Engineering and the uOttawa-IBM Cyber range for providing the required infrastructure to host the event.
2. @owasp for providing the OWASP Juice Shop application used as the targeted web application and SWAG
3. Packetlabs for providing pizza and SWAG
4. DeviousPlan for providing beverages

Lastly, OWASP Ottawa would like to thank all the attendees for attending this workshop and the volunteers who dedicated their time to make this workshop a success.

If you would like for OWASP Ottawa to organize more such workshops, please leave a comment below indicating what workshops you would like us to organize.

Missed one of my past conference talks? Let’s fix that.

I’m sharing my favorites—packed with real-world advice, lessons, and a few laughs.

“DIY Azure Security Assessment" - with Teri Radichel
https://twp.ai/4ipHDg

What does @cR0w say? Hack more AI shit or something?

Well, here ya go. (Actually gonna play with this tomorrow on POINT's AI, Chiron.)

https://arxiv.org/abs/2508.17155

I have never had to do more than turn on burp waf bypass to solve this, but on some sites (the drug compounding site, for instance) it would be a great tool! Some sites are SUPER picky.

https://www.darknet.org.uk/2025/09/thermoptic-chrome-perfect-http-fingerprint-cloaking-for-red-team-web-ops/

WebClient is a common targeted service for NTLM relay attacks. This post covers if it is possible to start the service remotely as a low privileged user

https://specterops.io/blog/2025/08/19/will-webclient-start

You’ve probably heard of Cold Boot attacks [1], but have you ever seen a practical example? If not, I recommend reading this report https://www.securitum.com/public-reports/medical-company-en.pdf (point 002, page 15).

There is even more: for example, as a bonus, in point 001 there’s an interesting analysis concerning the incorrect configuration of PCR banks of the disk encryption process using LUKS.

[1] https://en.wikipedia.org/wiki/Cold_boot_attack

Mini Pen Test Diaries story, happened in the last couple of years. The debrief meeting went like this:

“In your report you said you we’re able to crack the domain admin account instantly because the password was stored using the LM hash?”

“That’s right, yes.”

“But we’ve had LM hashing disabled for like 15 years, that can’t be possible?!”

“When was the last time that password was changed?”

“Well it’s been the same since I got here, 20 years ago.”

“And what hashing mechanism do you think was used back then?”

“Oh no."

For more, less mini stories like this, check out https://infosecdiaries.com.

Missed one of my past conference talks? Let’s fix that.

I’m sharing my favorites—packed with real-world advice, lessons, and a few laughs.

“DIY Azure Security Assessment" - with Teri Radichel
https://twp.ai/4ipUKe

Missed one of my past conference talks? Let’s fix that.

I’m sharing my favorites—packed with real-world advice, lessons, and a few laughs.

“DIY Azure Security Assessment" - with Teri Radichel
https://twp.ai/4iodU5

Here's a new-to-me password spray tool that looks a hell of a lot more functional that Burp Intruder.

https://github.com/blacklanternsecurity/TREVORspray

A friend is looking for an ICS pentesting gig in the UK. He has lots of experience in maritime, power, water, gas OT & SCADA.

He's also excellent on internal inf / red team especially when there's an OT element to the org and you need a safe pair of hands.

If you have any leads please message me and I'll hook you up.

ParrotOS 6.4 is out now!

This release sets the stage for Parrot 7 with upgraded tools, security fixes, and system improvements

Upgrade via sudo parrot-upgrade or grab a fresh install from the official site

Click the link down below and read more on the changelog

https://parrotsec.org/blog/2025-07-07-parrot-6.4-release-notes

Hi everyone! I recently released 3 blog posts!
All of them are writeups on CTFs where I make some scripts and tools in bash and golang!

I'll leave you the link of the blog posts and if you have any suggestions or interact with me, don't hesitate to comment or DM me!

I hope you all can enjoy reading them!

https://blog.jackrendor.dev/posts/tryhackme-securityfootage/

https://blog.jackrendor.dev/posts/tryhackme-bugged/

https://blog.jackrendor.dev/posts/tryhackme-eavesdropper/

How Mouse Without Borders can be use lateral movement and data exfiltration

https://0xsultan.github.io/dfir/Exfiltrate-Without-Borders

Missed one of my past conference talks? Let’s fix that.

I’m sharing my favorites—packed with real-world advice, lessons, and a few laughs.

“DIY Azure Security Assessment" - with Teri Radichel
https://twp.ai/4in9rU

LLM as Hackers: Autonomous Linux Privilege Escalation Attacks with AI Agents.

https://arxiv.org/pdf/2310.11409v4

AI-powered features are the new attack surface! Check out our new blog in which LMG Security’s Senior Penetration Tester Emily Gosney @baybedoll shares real-world strategies for testing AI-driven web apps against the latest prompt injection threats.

From content smuggling to prompt splitting, attackers are using natural language to manipulate AI systems. Learn the top techniques—and why your web app pen test must include prompt injection testing to defend against today’s AI-driven threats.

Read now: https://www.lmgsecurity.com/are-your-ai-backed-web-apps-secure-why-prompt-injection-testing-belongs-in-every-web-app-pen-test/

So, a client hit me with this today: "We've got tons of security tools, so we *must* be safe, right?" My face: If only it were that simple...

Here's a wild stat for you: a staggering 61% of companies have been breached, even though they're juggling an average of 43 security tools. This just goes to show, piling on more tools doesn't automatically boost your security. What's the real game-changer? It's all in the **configuration!**

As a pentester, I see this scenario play out constantly. Businesses will pour money into the latest and greatest tools, but then the foundational stuff? Often overlooked. Seriously, getting regular pentests (and I'm talking thorough ones, not just some automated scans!) is absolutely vital. Plus, "Security by Design" isn't just a trendy phrase; it’s a mindset you actually have to live and breathe.

Over to you: what are the most common security tool configuration blunders you've come across? And on the flip side, which tools are your saviors for getting things optimized? Let's hear it!

Yikes, just stumbled upon some news about new Go modules floating around GitHub that can seriously wreck Linux systems!

So, here’s the scoop: Three particularly nasty Go modules have been spotted. When executed, they're designed to completely trash the system. How? Basically, they use obfuscated code to fetch a payload, and *that* payload proceeds to overwrite `/dev/sda` (your primary hard drive!) with zeros. Poof! Your data is gone. Keep an eye out for these repos: `github[.]com/truthfulpharm/prototransform`, `github[.]com/blankloggia/go-mcp`, and `github[.]com/steelpoor/tlsproxy`.

The really scary part? This is a stark reminder of how supply-chain attacks can turn even code you *think* you trust into a major threat.

And honestly, this isn't an isolated incident. Think about those malicious npm packages caught stealing crypto keys, or PyPI packages abusing Gmail for data exfiltration. Unfortunately, the list goes on.

What steps can you take?
* **Always** double-check package authenticity. Look into the publisher's history and verify GitHub links.
* Make it a habit to regularly review your dependencies. What are you *really* pulling into your project?
* Implement strict access controls, especially for private keys. Don't make it easy for attackers.
* Keep tabs on unusual outbound network connections, *particularly* SMTP traffic.
* Don't just blindly trust a package because it's been around for a while. Age isn't always a guarantee of safety.

Speaking as a pentester, these supply-chain attacks are genuinely tricky and folks often underestimate the danger. Sure, automated scans can catch some things, but nothing beats staying vigilant and truly understanding the risks involved. I see it all the time – clients sometimes get a false sense of security just because something is "open source."

Have you encountered anything similar? What tools or strategies are you using to lock down your supply chain? Drop your thoughts below!

Mini Pen Test Diaries Story:

During the open source enumeration phase of an external footprint test, I found a virtual machine that bore the name of the client in its NetBIOS response in Shodan.

Connecting to the machine over HTTP, I found a web app that was very relevant to the industry of the client - so I knew it was likely related.

The strange thing, however, was that Shodan was telling me NetBIOS and SMB were open (that’s how I found the machine in the first place), but I was unable to connect to it over SMB. Port scan showed closed.

I needed to figure out why Shodan was telling me one thing, but my reality was different.

The machine was hosted in Azure, so I figured I’d try rerunning my port scan from a source IP in my own Azure account, to see if I’d get a different result.

Sure enough, SMB was open when scanned from an Azure machine. They’d opened it up to any IP in Azure. No auth. Just an open file share accessible to anyone who was connecting to it from an Azure public source IP.

I reported it, and it turned out that the machine was hosted by a vendor on behalf of the client.

The vendor was insistent that my description of “public access to SMB share” was wrong, since technically it wasn’t open to the internet - just to Azure.

I then pointed out that hey, Azure is a famous example of a “public” cloud for a reason.

They fixed it.

Lesson: always try from different perspectives - such as from within the same providers IP space, you might find what I found.

For more, slightly less mini stories like this ones check out https://infosecdiaries.com