Picking the Low-Hanging Fruit – Easy Pentest Wins
summary
Show demos of easy, repeatable fixes: a live nmap scan finds a publicly exposed Redis and SSH banner leaks exact versions, an SSH audit flags weak ciphers while switching to ed25519 keys and fail2ban improves access control, unattended upgrades and internal package mirrors automate patching, testssl.sh and Qualys/SSL Labs validate an A+ TLS posture, headers (HSTS preload, CSP, SameSite) and bcrypt/argon2id for passwords are configured and verified so pentesters stop reporting trivial misconfigurations.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:34Typical deployment stack
- 4:18Attacker mindset
- 6:04Cloud security controls
- 7:51Instance firewalls
- 9:15Network exposure with nmap
- 10:00Secure SSH config
- 12:49Automating OS updates
- 13:09Web server TLS
- 14:34HTTP security headers
- 17:23Validating security headers
- 21:12Live demo of tools
- 24:24Reviewing results
- 27:59App-level security
- 30:45Frontend escaping
- 31:50Security as process
related talks
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
34mBeating the pentester
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
13mFreedom of Security
51mOrion's Quest: Modern Pentesting
43m50 Shades of AppSec
01h 00mA Security Tester's Toolbox
41mLive Hacking: Breaking into Your Web App