Загрузка видео...

Не удалось загрузить видео

На главную

Offense at scale starts with an API. Today, we’re launching the XBOW Public API in Public Preview. Autonomous pentesting gave teams expert-level assessments in hours. But turning that capability into infrastructure required one more piece: programmatic access. Teams can now trigger and manage pentests across their entire portfolio; start,...

12,257 просмотров • 5 месяцев назад •via X (Twitter)

Комментарии: 0

Нет доступных комментариев

Здесь появятся комментарии из оригинального поста

Похожие видео

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

217,051 просмотров • 6 месяцев назад

Possibly the biggest change in Microsoft Teams history? Teams without the Teams? Public preview in November to desktop, mobile, iOS, and Android. Here is what you need to know: 🟣 Microsoft is introducing a new combined chat and channels experience. Meaning chat and teams/channels will show up under the "Chat" sidebar icon. No more dedicated Teams sidebar button. 🟣 Teams and Channels will have their own section in chat. 🟣 Group your chats and/or channels however best works for you with favourites and custom sections (up to 50 sections and 50 items per section) 🟣 “Unread,” “Chat,” “Channels,” “Meetings,” and “Muted” Filters 🟣 New message can initiate a new chat or new channel post 🟣 New Mention view gathers all your mentions into a single interactive list. 🟣 At launch, a self-service, guided onboarding will help users discover the new experience and configure it to their preferences (on or off) 🟣 Users who prefer to keep chat and channels separate can easily do so during the onboarding process or at any time later. So far, it looks like there are no IT/tenant-level override controls. This experience change is targeted at getting more users using teams/channels. Most Teams users live in "chats", not teams/channels. There will undoubtedly be some pushback from users who use teams/channels well and like having the mental separation of teams/channels vs chats. I've been fortunate to be using it for a while, and I'm personally a big fan; my use of the correct channels has gone way up, and now I can find them all in one place in the app, particularly on mobile. I'm now much more likely to see channel conversations I need to see. What do you think? #MicrosoftTeams #Microsoft365

Tom Arbuthnot

64,520 просмотров • 1 год назад

Mansa AI is an enterprise-grade AI + Web3 platform designed to move artificial intelligence from experimentation into real-world execution. Built for creators, developers, and businesses, it focuses on deploying AI that actually works across modern digital systems, not just in isolated demos. 🚀 Production-ready AI infrastructure Mansa AI enables teams to deploy AI systems designed for live environments, handling real workflows, real data, and real operational demands without constant manual oversight. 🧠 Autonomous AI agents At its core, Mansa AI allows users to build autonomous agents that automate decision-making, coordinate tasks, monitor live signals, and execute complex workflows across dynamic environments. ⚙️ Fully customizable logic Agents can be configured with custom behaviors, triggers, and responses. From content generation and analytics to operational automation and intelligent orchestration, logic adapts to specific business strategies. 🔗 Web3 and off-chain integration Mansa AI bridges blockchain ecosystems with traditional systems, enabling cross-chain coordination, smart contract interactions, and seamless integration with existing enterprise infrastructure. 📊 Real-world use cases The platform supports automation for operations, customer engagement, analytics, data pipelines, content workflows, and AI-driven optimization across products and teams. 📈 Built for scale Whether launching as a startup or deploying across enterprise systems, Mansa AI is designed to scale AI operations without adding complexity or fragmentation. Mansa AI transforms artificial intelligence into deployable infrastructure. By combining autonomy, customization, interoperability, and scalability, it enables teams to own, operate, and grow intelligent systems that deliver real value in production environments.

King

155,637 просмотров • 7 месяцев назад

I just vibe-coded a Meta Ads Bulk Uploader in Claude Code that uploads dozens of Facebook and Instagram ads in minutes 🤯 Drag and drop your creatives, connect your live Meta account, publish directly through the Marketing API. Built 100% in Claude Code. Perfect for media buyers and DTC brands who are still uploading ads one at a time in Ads Manager. If you're a media buyer spending 10+ hours a week uploading ads one at a time in Ads Manager — attaching videos, picking thumbnails, naming ads, toggling enhancements, repeating 50 times ... This eliminates the entire workflow: → Drag and drop dozens of images/videos at once → Add multiple primary texts, headlines, and descriptions per batch → Pick your campaign and ad set directly from your live Meta account → Clone existing ad sets with one click → Upload custom thumbnails, pick your CTA, launch paused or active No uploading ads one by one. No 2-3 hours of clicking. No $99/month SaaS subscription. What this tool does: → A bulk uploader that publishes directly through Meta's Marketing API → Full creative control — thumbnails, CTAs, ad names, enhancements — all in one shot → Ad set cloning so you can scale winning setups instantly → A free alternative to the $99/month tools that do the exact same thing I'm giving away every prompt I used to build it so you can vibe-code the whole thing yourself. Want all the prompts? > Like this post > Comment "BULK" And I'll send it over (must be following so I can DM)

Mike Futia

42,576 просмотров • 4 месяцев назад

Today at Yoast we’re shipping something I've actually wanted to see on the web for some time (even before working at Yoast) and am now honored to be part of the team to bring this to the masses... Built in collaboration with the Open Source and NLWeb team at Microsoft lead by R.V.Guha (co-creator of RSS, RDF and other web standards) - we're introducing the Schema Aggregation feature: a "schemamap" endpoint that outputs your site's entire structured data map in one place. ​ Under the hood, we now provide a standardised, deduplicated map of your entities via a single endpoint. An agent no longer needs to crawl all individual pages to understand its meaning but can now ingest an entire entity map with ease. ​ A few details to note about the endpoint: - It's is cacheable with sub‑100ms responses - It respects existing privacy and indexing settings - It aggregates all indexable content without navigation noise - It merges duplicate entities so your "Author X" or "Article Y" exist as a single node instead of being re‑discovered on every URL. - If you're using one of our paid plugins that extends schema even more (such as Yoast WooCommerce SEO adds product schema) this will be populated within the endpoint too - If you already extend Yoast’s Schema API, or use partners like events or recipe plugins, their entities are pulled into the same map automatically. ​ For me, this is one of the first major ways the agentic web can ingest a site at scale, and with much more efficiency and context. It has also been so much fun to work with this alongside the team at Yoast, particularly the genius mind of Alain Schlesser. Lastly, we have also launched a schema visualisation tool to view how everything is output. You can enable this feature today with the free version of Yoast SEO.

Alex Moss

15,316 просмотров • 4 месяцев назад