正在加载视频...

视频加载失败

Offense at scale starts with an API. Today, we’re launching the XBOW Public API in Public Preview. Autonomous pentesting gave teams expert-level assessments in hours. But turning that capability into infrastructure required one more piece: programmatic access. Teams can now trigger and manage pentests across their entire portfolio; start,...

12,257 次观看 • 5 个月前 •via X (Twitter)

0 条评论

暂无评论

原始帖子的评论将显示在这里

相关视频

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

217,252 次观看 • 7 个月前

Possibly the biggest change in Microsoft Teams history? Teams without the Teams? Public preview in November to desktop, mobile, iOS, and Android. Here is what you need to know: 🟣 Microsoft is introducing a new combined chat and channels experience. Meaning chat and teams/channels will show up under the "Chat" sidebar icon. No more dedicated Teams sidebar button. 🟣 Teams and Channels will have their own section in chat. 🟣 Group your chats and/or channels however best works for you with favourites and custom sections (up to 50 sections and 50 items per section) 🟣 “Unread,” “Chat,” “Channels,” “Meetings,” and “Muted” Filters 🟣 New message can initiate a new chat or new channel post 🟣 New Mention view gathers all your mentions into a single interactive list. 🟣 At launch, a self-service, guided onboarding will help users discover the new experience and configure it to their preferences (on or off) 🟣 Users who prefer to keep chat and channels separate can easily do so during the onboarding process or at any time later. So far, it looks like there are no IT/tenant-level override controls. This experience change is targeted at getting more users using teams/channels. Most Teams users live in "chats", not teams/channels. There will undoubtedly be some pushback from users who use teams/channels well and like having the mental separation of teams/channels vs chats. I've been fortunate to be using it for a while, and I'm personally a big fan; my use of the correct channels has gone way up, and now I can find them all in one place in the app, particularly on mobile. I'm now much more likely to see channel conversations I need to see. What do you think? #MicrosoftTeams #Microsoft365

Tom Arbuthnot

64,526 次观看 • 1 年前

Mansa AI is an enterprise-grade AI + Web3 platform designed to move artificial intelligence from experimentation into real-world execution. Built for creators, developers, and businesses, it focuses on deploying AI that actually works across modern digital systems, not just in isolated demos. 🚀 Production-ready AI infrastructure Mansa AI enables teams to deploy AI systems designed for live environments, handling real workflows, real data, and real operational demands without constant manual oversight. 🧠 Autonomous AI agents At its core, Mansa AI allows users to build autonomous agents that automate decision-making, coordinate tasks, monitor live signals, and execute complex workflows across dynamic environments. ⚙️ Fully customizable logic Agents can be configured with custom behaviors, triggers, and responses. From content generation and analytics to operational automation and intelligent orchestration, logic adapts to specific business strategies. 🔗 Web3 and off-chain integration Mansa AI bridges blockchain ecosystems with traditional systems, enabling cross-chain coordination, smart contract interactions, and seamless integration with existing enterprise infrastructure. 📊 Real-world use cases The platform supports automation for operations, customer engagement, analytics, data pipelines, content workflows, and AI-driven optimization across products and teams. 📈 Built for scale Whether launching as a startup or deploying across enterprise systems, Mansa AI is designed to scale AI operations without adding complexity or fragmentation. Mansa AI transforms artificial intelligence into deployable infrastructure. By combining autonomy, customization, interoperability, and scalability, it enables teams to own, operate, and grow intelligent systems that deliver real value in production environments.

King

155,637 次观看 • 7 个月前

I just vibe-coded a Meta Ads Bulk Uploader in Claude Code that uploads dozens of Facebook and Instagram ads in minutes 🤯 Drag and drop your creatives, connect your live Meta account, publish directly through the Marketing API. Built 100% in Claude Code. Perfect for media buyers and DTC brands who are still uploading ads one at a time in Ads Manager. If you're a media buyer spending 10+ hours a week uploading ads one at a time in Ads Manager — attaching videos, picking thumbnails, naming ads, toggling enhancements, repeating 50 times ... This eliminates the entire workflow: → Drag and drop dozens of images/videos at once → Add multiple primary texts, headlines, and descriptions per batch → Pick your campaign and ad set directly from your live Meta account → Clone existing ad sets with one click → Upload custom thumbnails, pick your CTA, launch paused or active No uploading ads one by one. No 2-3 hours of clicking. No $99/month SaaS subscription. What this tool does: → A bulk uploader that publishes directly through Meta's Marketing API → Full creative control — thumbnails, CTAs, ad names, enhancements — all in one shot → Ad set cloning so you can scale winning setups instantly → A free alternative to the $99/month tools that do the exact same thing I'm giving away every prompt I used to build it so you can vibe-code the whole thing yourself. Want all the prompts? > Like this post > Comment "BULK" And I'll send it over (must be following so I can DM)

Mike Futia

42,669 次观看 • 4 个月前