Public Exposure

PHP Version Check - Cold LAMPin' Your IT

Lari Huttunen
Date : December 13, 2022
Categories : Public exposure

Running a LAMP server used to be what the cool kids did. Nowadays, cold lampin’ it ain’t cutting it no more. Setting the Cultural Context To me, “It Takes a Nation of Millions to Hold Us Back” represents the epitome of rap music that speaks out about the cultural division of US society, which has only polarized in recent years. Why I dare say that I know something about it in practice, is the fact that to me, a white, privileged Nordic teenager, living in the periphery of Detroit in 1990 highlighted the the black versus white dichotomy in a concrete way: affluent versus poor country club buffets versus food stamps. More importantly, the lyrics of Carlton Douglas Ridenhour, have been the cultural inspiration for the name of this blog, Public Exposure. In a sense, he represents the attitude to speak out cold truths about the reality in which you live in, which in the context of this blog relates to the poor state of cyber security of the Internet as a whole.

How to Identify Attack Surface that Must be Addressed

Juhani Eronen
Date : November 8, 2022
Categories : Public exposure ,External attack surface

Some time in January 2022, I promised to Lari to write up some thoughts on attack surface management. I thought I’d perhaps have material for a single blog post. Now two posts later, we will still have to dig into some of the most difficult problems in the process. If you haven’t read my earlier posts, the first covered asset discovery and the second focused on exposure assessment. Should you have adopted an attack surface identification process such as the one I have outlined in my previous posts, by this point you will have a lot of data. In a larger assignment, I usually end up using a couple of online services, half a dozen open source tools, and numerous ad-hoc scripts. The result is a hot mess of JSON files, tool-specific text files, files with HTTP headers, and HTML content. Some integrated scanning frameworks or third-party services might make things easier for you.

WordPress Version? Make Sure You're Running the Latest Supported

Lari Huttunen
Date : October 11, 2022
Categories : Public exposure ,Vulnerability research ,Cyber threat ,External attack surface

It all started with Miles Davis in 2004, when WordPress 1.0 was released that is. Since then, the popular open source content management system’s releases have been named after a prominent Jazz musician. Researching this topic from a security perspective makes it quite clear why Jazz musicians are apt denominators for releases, since securing WordPress and keeping it secure over time must indeed feel like a jamming session at your local Jazz club. What does this mean in practice? Quoting WordPress Codex: The only current officially supported version is WordPress 6.1.1. Previous major releases before this may or may not get security updates as serious exploits are discovered. Which means that if you’re a WordPress admin, you should bookmark the WordPress Codex supported versions page to check which actual release contains the latest and greatest fixes. This is important, as from the project’s standpoint only the latest named release and its subsequent minor releases are guaranteed to get the appropriate security fixes.