ReconnaissanceAug 25, 20265 min read
How to map your external attack surface without missing the obvious
Forgotten subdomains, stale DNS records, and open ports are not exotic edge cases. They are the normal way external attacks start.
Read postBlog
Notes on attack surface security.
Practical write-ups from the scanner side: the findings we see most often, why they matter, and how to fix them without wasting a week on false positives.
Web reconnaissanceAug 20, 20264 min read
Why a public .js.map file is more than a minor leak
A sourcemap is not just a debugging aid. Left public, it gives an attacker a readable map of your frontend, internal routes, and sometimes secrets.
Read postVulnerability triageAug 15, 20265 min read
Why your Apache version and Debian's CVE list don't agree
Banner-version CVE matching against Debian packages creates noise because maintainers backport fixes without changing the version string.
Read post