Service
Introducing TantoSec’s Build Pipeline Security Assessment
We attack your CI/CD pipeline the way an adversary would, to show how far a malicious or compromised developer could get.
Deep Cuts
Stay informed with the latest research, security insights and updates from the Tanto Security team.
Posts
Tool
One Shell to Rule Them All
oneshell needs little more than echo to start a reverse shell built so that nobody on the network can read or hijack it.
Vulnerability
docAssembling Exploits for RCE
An unauthenticated path traversal in Docassemble gives up its secrets, and a second look at the same code leads to RCE.
Vulnerability
Judge0 Sandbox Escape
A submission could write files outside Judge0’s sandbox and gain root on the host, even after the first patch.
Vulnerability
Dompdf RCE via Phar Deserialisation
A font URL protocol check didn’t stop when it failed, allowing a TrueType-Phar polyglot to reach code execution.
Methodology
Is Pentesting Dead?
We don’t think so, but perhaps the one-size-fits-all pentest should be. Why automated pentesting mostly isn’t pentesting, and what to ask of your provider.
Methodology
Why White Box?
An attacker has as long as it takes to learn your system, and a pentester has days. Source code and documentation even up the ledger.
Compliance
CORIE: Regulating for Advanced Cyber Security Services
How Australia’s financial regulators want institutions red teamed, guided by threat intelligence.