Top Sites>DDepth Security

User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php

Generated by All in One SEO v4.9.6.2, this is an llms.txt file, used by LLMs to index the site.

# Depth Security

A Konica Minolta Service

## Posts

- [Weaponization Of Nessus Plugins](https://www.depthsecurity.com/blog/weaponization-of-nessus-plugins/) - Depth Security walks through how to twist a Nessus plugin, meant to test only for the existence of an RCE vulnerability, into a weaponized exploit.
- [Obfuscating Malicious, Macro-Enabled Word Docs](https://www.depthsecurity.com/blog/obfuscating-malicious-macro-enabled-word-docs/) - Learn more about malicious word documents from the Depth Security team in this blog post. Depth Security provides an experienced take on the subject.
- [Common Endpoint (NGAV/EDR) Mistakes And How To Avoid Them](https://www.depthsecurity.com/blog/common-endpoint-ngav-edr-mistakes-and-how-to-avoid-them/) - Depth Security performs hundreds of security engagements like penetration testing every year. Learn more about common endpoint mistakes that the team finds.
- [Medical Exploitation: You Are Now Diabetic](https://www.depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic/) - Avoid medical explotation and keep data safe. Learn more about how Depth Security recommends improving safety for sensitive data.
- [The First Five Things You Should Do As A New CISO](https://www.depthsecurity.com/blog/the-first-five-things-you-should-do-as-a-new-ciso/) - In the case of CISOs, the average tenure (according to industry research) is 24 to 48 months, with many CISOs changing companies even more frequently.
- [Introducing Armory: External Pentesting Like A Boss](https://www.depthsecurity.com/blog/introducing-armory-external-pentesting-like-a-boss/) - Depth Security introduces Armory, a tool that adds a database backend to popular external and discovery tools. Now, you can run tools directly from Armory.
- [Selecting A Penetration Testing Provider – PART 1](https://www.depthsecurity.com/blog/selecting-a-penetration-testing-provider-part-1/) - What should you look for in a penetration testing provider? Depth Security covers everything you need to know when making a decision.
- [Bypassing App Locker & CLM While Evading EDR](https://www.depthsecurity.com/blog/bypassing-app-locker-clm-while-evading-edr/) - Creating AppLocker bypasses using default AppLocker policies and finally using MSBuild with an arbitrary csproj file. Learn more in this blog by Depth Security.
- [Securing Wireless Infrastructure - Part 1](https://www.depthsecurity.com/blog/securing-wireless-infrastructure-part-1/) - The wireless security landscape has remained unchanged since the development WPA/WPA2. Learn more about common infrastructure configurations and their weaknesses.
- [Indicators Of Poor Assessment Work](https://www.depthsecurity.com/blog/indicators-of-bad-assessment-work/) - In the 11+ years Depth has been in business we've had the opportunity to see some less than stellar work as far as assessment services go. Our clients often send us assessment reports they've received from other security firms. Sometimes they want us to check remediation status on a single item. Other times they aren't
- [Spray 365: A New Twist On Office 365 Password Spraying](https://www.depthsecurity.com/blog/spray-365-a-new-twist-on-office-365-password-spraying/) - Learn more about how password spraying Office 365 accounts could benefit from new approaches to bypassing protection policies.
- [Classic API Unhooking To Bypass EDR Solutions](https://www.depthsecurity.com/blog/classic-api-unhooking-to-bypass-edr-solutions/) - API hooking is a technique that is used by anti-virus and EDR solutions in an attempt to monitor process and code behavior in real time.
- [Reflective DLL Injection In C++](https://www.depthsecurity.com/blog/reflective-dll-injection-in-c/) - Depth Security covers reflective DLL injection in this blog. Learn more about the process and how it can apply to your industry today.
- [Selecting A Penetration Testing Provider – PART 2](https://www.depthsecurity.com/blog/selecting-a-penetration-testing-provider-part-2/) - Learn more about what you need to look for in a penetration testing provider. Depth Security walks you through all the information you need to make a decision.
- [When Multi-Factor Authentication Is Actually Single-Factor: The Enrollment Security Gap](https://www.depthsecurity.com/blog/when-mfa-is-actually-sfa/) - A common security gap in many MFA implementations is the enrollment process where a user is allowed to enroll in MFA with only a password if they have not previously registered. With this article, I am hoping to describe what this issue is, provide typical examples of the types of users affected, and provide some recommended mitigations to address this security gap.
- [Conditional Access Policies for Dummies](https://www.depthsecurity.com/blog/conditional-access-policies-for-dummies/) - Your Entra ID tenant looks bulletproof. Users are required to authenticate with MFA. You've checked all the boxes. Then a threat actor compromises a user with a weak password and walks right in. No MFA prompt. No blocked sign-in. But how did they do it? Somewhere in your tangled web of conditional access policies a misconfiguration left the door wide open.
- [Using NTLM Reflection to Own Active Directory (CVE-2025-33073)](https://www.depthsecurity.com/blog/using-ntlm-reflection-to-own-active-directory/) - The goal I’d like to achieve with this blog is to inform attackers and defenders alike that this issue is far more serious than it was given credit for, and the exploitation primitives are not as restrictive as was initially believed. Numerous techniques and bypasses for relaying to a myriad of different protocols from SMB are possible when dealing with NTLM reflection vulnerabilities. Some of these are specific to reflection issues.
- [Revenge of the Zombie Networks](https://www.depthsecurity.com/blog/revenge-of-the-zombie-networks/) - It is well known now that setting up a secure wireless network can be tricky to get right. Most organizations do not do this optimally on their first attempt and set up an insecure network just to get what they need connected. Often later, lessons are learned and the older networks are decommissioned, with newer, more secure networks set up in their place.
- [Introducing RelayKing – Relay To Royalty](https://www.depthsecurity.com/blog/introducing-relayking-relay-to-royalty/) - If you’re anything like me and/or an offensive security professional, you’re probably very, very familiar with NTLM relaying attacks against Active Directory environments. NTLM relay attacks are anything but novel; pentesters and hackers alike have been forcing blue teams and sysadmins all around the world for decades to pull their hair out as they attempt to mitigate this class of issue. This blog will not explain what this issue is – if you want more information, a quick Google search for “ntlm relaying” will yield numerous excellent blog posts explaining the core issue.
- [Why Most Password Policies are Weak: The Filtering Problem](https://www.depthsecurity.com/blog/weak-password-policies-filtering-problem/) - Compromised credentials can quickly snowball into complex kill chains that can cripple entire networks and the speed of compromise has only gotten faster over time, leaving defensive teams scrambling to keep up.
- [Indicators Of Poor Assessment Work](https://www.depthsecurity.com/blog/indicators-of-poor-assessment-work/) - Clients often send assessment reports they've received from other security firms. Depth Security specializes in assessing work to determine cost and viability.
- [Polycom VVX-Series Business Media Phones Path Traversal Vulnerability](https://www.depthsecurity.com/blog/polycom-vvx-series-business-media-phones-path-traversal-vulnerability/) - An overview of Polycom Vulnerability in the VVX-Series Business Media Phones from Depth Security. Read the blog to learn more.
- [Hashing Horror](https://www.depthsecurity.com/blog/hashing-horror/) - Depth Security ran into a myriad of issues while reviewing a client's hashing. The way hashes are stored is more important than many people realize.
- [CVE-2017-6079 – Blind Command Injection In Edgewater Edgemarc Devices](https://www.depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices/) - Read the blog to learn more about Depth Security's recommendations and review on blind command injection in Edgewater Edgemarc devices.
- [Unauthorized FLIR (Lorex) Cloud Access](https://www.depthsecurity.com/blog/unauthorized-flir-lorex-cloud-access/) - How secure are your remote systems? Depth Security walks through potential vulnerabilities and solutions in this blog including unauthorized cloud access.
- [Using Python To Get A Shell Without A Shell](https://www.depthsecurity.com/blog/using-python-to-get-a-shell-without-a-shell/) - In this blog, Depth Security walks you through using Python to get a shell without a shell. Learn more with our custom walkthrough.
- [Exploiting Custom Template Engines](https://www.depthsecurity.com/blog/exploiting-custom-template-engines/) - When performing an application assessment, one of the areas within an app Depth Security pays particular attention to is any ability to define custom templates.
- [Video: Hacking WEP-128, WPA2-PSK, And 802.1x/PEAP In Under 5 Minutes](https://www.depthsecurity.com/blog/video-hacking-wep-128-wpa2-psk-and-802-1x-peap-in-under-5-minutes/) - In this video, Depth Security compromises access to three separate wireless networks using three separate authentication and encryption schemes.
- [When 802.1x/PEAP/EAP-TTLS Is Worse Than No Wireless Security](https://www.depthsecurity.com/blog/when-802-1x-peap-eap-ttls-is-worse-than-no-wireless-security/) - Is 802.1x with PEAP or EAP-TTLS worse than open wireless with no authentication or encryption? Learn more on the Depth Security blog.
- [Tool Review - Fierce By RSnake](https://www.depthsecurity.com/blog/tool-review-fierce-by-rsnake/) - Fierce is a simple but very useful DNS reconnaissance tool written by Robert Hansen (RSnake) that we use on virtually every security assessment.
- [Super-Persistent Cookies - Evercookie JavaScript API](https://www.depthsecurity.com/blog/super-persistent-cookies-evercookie-javascript-api/) - Want to keep track of users even after they remove their cookies, switch browsers, clear cache, or whatever? Learn more about how you can with Depth Security.
- [SMS (Short Message Severance)](https://www.depthsecurity.com/blog/sms-short-message-severance/) - Collin Mulliner and Nico Golde gave a very interesting SMS DOS presentation at the 27th Choas Communication Congress. Read the summary from Depth Security.
- [Real-World Attack Scenario: From Blind, Timing-Based SQL Injection To Windows Domain Administrator](https://www.depthsecurity.com/blog/real-world-attack-scenario-from-blind-timing-based-sql-injection-to-windows-domain-administrator/) - Learn more about how Depth Security utilizes real world attack scenarios to find any vulnerabilities wherever they might be.
- [New Details On CitiGroup Compromise](https://www.depthsecurity.com/blog/new-details-on-citigroup-compromise/) - The Daily Mail has a short article about how the recent compromise of 200,000+ Citigroup accounts occurred. Could this have been easily prevented?
- [HBGary Incident - Anatomy Of The Attack](https://www.depthsecurity.com/blog/hbgary-incident-anatomy-of-the-attack/) - CEO Aaron Barr decided to unmask who he thought was behind the leadership of attacks against MasterCard, Visa, and other perceived enemies of WikiLeaks.
- [Exploitation: XML External Entity (XXE) Injection](https://www.depthsecurity.com/blog/exploitation-xml-external-entity-xxe-injection/) - During the course of our assessments, we sometimes come across a vulnerability that allows us to carry out XML eXternal Entity (XXE) Injection attacks.
- [Blind SQL Injection & BurpSuite - Like A Boss](https://www.depthsecurity.com/blog/blind-sql-injection-burpsuite-like-a-boss/) - SQL injection used to be a lot easier a few years ago when it was less known, web application security was less mature, and errors were often exposed.
- [More SQL Injection: Barracuda Networks Hacked](https://www.depthsecurity.com/blog/more-sql-injection-barracuda-networks-hacked/) - Barracuda Networks is latest on the list of security vendors/service providers to be compromised. Learn more about what happened with Depth Security.
- [Why Perform Authenticated Web Application Security Assessments?](https://www.depthsecurity.com/blog/why-perform-authenticated-web-application-security-assessments/) - A main difference between Basic and Standard web application security assessment services is that for Basic assessments we only perform unauthenticated testing.
- [Assessing The Multiple Security Postures Of Targets](https://www.depthsecurity.com/blog/assessing-the-multiple-security-postures-of-targets/) - The majority of our assessment clients choose a full-disclosure approach to security assessments to maximize results for a given cost.
- [Multiple Context XSS Vector](https://www.depthsecurity.com/blog/multiple-context-xss-vector/) - Gareth Heyes of The Spanner came up with an XSS payload that works in multiple contexts and browsers. As always mileage will vary by vector and browser.
- [Twitter Input Validation Issues (XSS)](https://www.depthsecurity.com/blog/twitter-input-validation-issues-xss/) - Someone started a re-tweet XSS worm on Twitter. They embedded a span class and provided an "Onmouseover" event that re-tweets the post when hovered over.
- [10 Security Tools You May Not Know About](https://www.depthsecurity.com/blog/10-security-tools-you-may-not-know-about/) - Fierce is one of the best DNS enumeration tools that we have used at Depth Security. It's great for DNS servers that do not allow anonymous zone transfer.
- [RSA Breached By Advanced Persistent Threat](https://www.depthsecurity.com/blog/rsa-breached-by-advanced-persistent-threat/) - RSA has announced that they have been compromised by an "extremely sophisticated cyber attack" of which details are not clear.
- [How To Get Properly Owned](https://www.depthsecurity.com/blog/how-to-get-properly-owned/) - Learn more about what can happen when you do not take any security precautions on networks and apps. Depth Security tells you what not to do!
- [Fun With PSEXEC Scanner Metasploit Module](https://www.depthsecurity.com/blog/fun-with-psexec-scanner-metasploit-module/) - One of the first things a lot of folks will do on a meterpreter session on some Windows machine is escalate to SYSTEM. Learn more about Depth Security's take.
- [Dahua DVR Authentication Bypass - CVE-2013-6117](https://www.depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117/) - Dahua network-enabled DVR is available from hundreds of vendors. Depth Security found the "network-enabled" part of the DVR to be vulnerable.
- [OS Command Injection In Infoblox NetMRI Products - CVE-2014-3418 + CVE-2014-3419](https://www.depthsecurity.com/blog/os-command-injection-in-infoblox-netmri-products-cve-2014-3418-cve-2014-3419/) - Read the blog to learn more about how Depth Security discovered an OS command injection vulnerability in an Infoblox NetMRI appliance.

## Pages

- [Home](https://www.depthsecurity.com/) - Depth Security, Konica Minolta Service, uses expert offensive services to discover weaknesses, simulate real-world attacks, and build better defenses.
- [Active Directory Security Essentials Review](https://www.depthsecurity.com/pen-testing/active-directory-security-essentials-review/) - Our Active Directory Security Essentials Review service provides invaluable insights into AD footholds, privilege escalation, lateral movement, and more.
- [Turning the Tide on Cyber Threats in Manufacturing](https://www.depthsecurity.com/cyber-threats-in-manufacturing/) - The manufacturing sector continues to face significant cybersecurity challenges, making it a prime target for cyberattacks. In 2023, 25% of global cyberattacks targeted this sector, marking the third consecutive year it has been the most targeted (IBM X-Force Threat Intelligence Index 2024).
- [Tides of Protection: Safeguarding Your Law Firm from Rising Cyber Threats](https://www.depthsecurity.com/safeguarding-your-law-firm-from-rising-cyber-threats/) - From phishing attacks to more sophisticated ransomware campaigns, cyber threats are evolving, and law firms must stay vigilant. By understanding these common threats—how they work and their impact—firms can implement best practices to protect their data and maintain robust cybersecurity.
- [The 6 Silent Killers in Your Active Directory Setup (That Attackers Love to Find)](https://www.depthsecurity.com/six-silent-killers-in-your-active-directory-setup/) - Active Directory (AD) is one of the most critical and targeted components of any IT environment. It manages authentication, enforces access control, and defines the identity structure across your organization. Despite its importance, AD is often quietly misconfigured. These issues do not break systems or trigger alerts, which is why they frequently go unnoticed for years. But behind the scenes, they create ideal conditions for attackers to gain credentials, escalate privileges, move laterally, cross trusts and gain full forest control.
- [The Penetration Testing Playbook: Closing the Gaps in Security Misconfigurations Across Industries](https://www.depthsecurity.com/the-penetration-testing-playbook/) - In every penetration test, certain weaknesses appear repeatedly. Despite new tools, policies, and awareness campaigns, the same foundational misconfigurations continue to provide attackers with their easiest wins. This report distills findings from hundreds of penetration testing and adversary-emulation engagements across four major industries: Healthcare, Manufacturing, Financial Services, and Legal.
- [Adversary Emulation](https://www.depthsecurity.com/pen-testing/adversary-emulation/) - Adversary Emulation, also called Red Team Testing, is a real-world test of security controls to improve an organization's security posture.
- [Where Financial Network Complexity Creates Real Attack Paths](https://www.depthsecurity.com/financial-network-complexity/) - Financial institutions operate some of the most mature security programs in the private sector, with formal governance, layered controls, and continuous oversight that are standard. Even in these environments, penetration testing continues to identify material risks that arise from the interaction of systems rather than from the absence of security tools.
- [The Interconnected Factory: Understanding Cyber Risk in Modern Manufacturing](https://www.depthsecurity.com/cyber-risk-in-modern-manufacturing/) - Manufacturing security programs often mature around reliability, safety, and uptime. Production systems must remain operational, supplier relationships must function continuously, and planet networks frequently contain specialized equipment that cannot be patched or replaced on the same cycle as traditional IT infrastructure.
- [Active Directory Password Security Analysis](https://www.depthsecurity.com/pen-testing/active-directory-password-review/) - Our Active Directory Password Security Analysis gives organizations the ability to identify all crackable passwords and implement positive changes to prevent future breaches.
- [Penetration Testing](https://www.depthsecurity.com/pen-testing/) - At Depth Security, we offer advanced penetration testing strategies to bolster your infrastructure’s weaknesses so that operations are more secure.
- [Network Penetration Testing](https://www.depthsecurity.com/pen-testing/network-penetration-testing/) - Our network penetration testing services provide the most effective way to understand the real-world risks facing your infrastructure, applications, and users.
- [Application Penetration Testing](https://www.depthsecurity.com/pen-testing/application-penetration-testing/) - Your applications provide a door to your most sensitive data. Keep them secure. Our application security assessment services are designed to identify vulnerabilities before they can be exploited.
- [Cybersecurity vs. Cyber Resilience The Dual Approach to Protecting Your Digital Assets](https://www.depthsecurity.com/cybersecurity-vs-cyber-resilience/) - Cybersecurity and cyber resilience are often discussed together, but they serve distinct purposes. One is about stopping threats, and the other is about continuing to operate when those threats succeed. Together, they form a complete strategy to safeguard operations, protect stakeholders, and ensure long-term digital trust.
- [Inside the Biggest Cybersecurity Breaches of 2023–2025: What They Reveal About Modern Security Gaps](https://www.depthsecurity.com/biggest-cybersecurity-breaches/) - As a penetration testing firm, we’ve analyzed some of the most high-profile cybersecurity incidents between 2023 and 2025 to distill lessons that can help businesses better prepare, detect, and defend against modern threats.
- [In the Eye of the Cyber Storm: Shielding Financial Institutions from Online Threats](https://www.depthsecurity.com/shielding-financial-institutions-from-online-threats/) - The financial industry is a treasure trove for cybercriminals, making it a prime target for increasingly sophisticated attacks. With vast amounts of sensitive data and valuable assets at stake, the financial industry remains vulnerable to a variety of cyber threats.
- [Healthcare Under Siege](https://www.depthsecurity.com/healthcare-under-siege/) - As healthcare organizations face an increasing number of cyber threats, the landscape is becoming more complex, with both familiar and evolving risks impacting patient care and organizational stability. These risks not only compromise patient data but also disrupt critical operations. Here’s a closer look at the four main threats facing the sector.
- [10-Point Active Directory Password Security Checklist for Real-World Risk Reduction](https://www.depthsecurity.com/ten-point-active-directory-checklist/) - Weak passwords continue to be a leading cause of cybersecurity incidents. According to Verizon’s Data Breach Investigations Report, over 80% of breaches involve brute-force attacks or stolen credentials, often targeting Active Directory environments. Even organizations with MFA in place are still at risk. If users are creating weak or reused passwords, and those credentials are never audited, attackers can walk right in using the front door. So, how can you tell if your AD password policies are actually working?
- [Adversary Emulation Explained: Testing Detection and Response Against Realistic Threats](https://www.depthsecurity.com/adversary-emulation-explained/) - What penetration testing does not fully evaluate is how an attacker would behave once access is established, or how defenders would respond when activity unfolds in realistic scenarios. That distinction becomes increasingly important as attacks rely less on obvious exploitation and more on abusing trust, identity, and legitimate tooling. Adversary emulation, or Red-Team Testing, is designed to answer those questions.
- [Penetration Testing](https://www.depthsecurity.com/industries/finance/) - Depth Security provides banking and finance organizations with Penetration Testing services for regulatory compliance, data protection, and overall security.
- [Where Threat Intelligence Meets Action: Adversary Emulation & Simulation in Practice](https://www.depthsecurity.com/adversary-emulation-and-simulation/) - Not all attacks are created equally, and your defenses should not be either. That is why we go beyond basic testing to simulate real-world threats at Depth Security. Through adversary emulation and adversary simulation, we create immersive, authentic scenarios designed to challenge your defenses on every level.
- [Blog](https://www.depthsecurity.com/resources/blog/) - Read the Depth Security blog and learn more about the world of cyber security from our experienced team. Contact us today to learn more about our services!
- [Industries](https://www.depthsecurity.com/industries/) - Depth Security servies multiple industries including healthcare, governments, legal, finance, and more with our site and application security services.
- [Penetration Testing](https://www.depthsecurity.com/industries/legal/) - Depth Security provides penetration testing for the legal industry to prevent data breaches and protect sensitive information from potential security threats.
- [Contact Us](https://www.depthsecurity.com/contact-us/) - The Depth Security team is ready to solve your cyber security needs. Contact us today and learn more about how we can help you.
- [Resources](https://www.depthsecurity.com/resources/) - Depth Security offers a myriad of resources on the aspects of cyber security. Explore our library today and draw from our years of experience.
- [Cybersecurity Awareness Month](https://www.depthsecurity.com/cybersecurity-awareness-month/) - October is Cybersecurity Awareness Month, a time dedicated to raising awareness about the critical importance of cybersecurity in our increasingly digital world. At Depth security, we believe that fostering a culture of awareness and preparedness is the foundation of a secure digital environment.
- [Careers](https://www.depthsecurity.com/careers/) - At Depth Security offers careers in cyber security for those with passion, willingness, and aptitude. Join our experienced team today!
- [Who We Are](https://www.depthsecurity.com/who-we-are/) - Depth Security, a service of Konica Minolta, has the expertise and knowledge to provide cyber security services, such as penetration testing for all industries.
- [Penetration Testing](https://www.depthsecurity.com/industries/manufacturing/) - Depth Security provides manufacturers with penetration testing services to solve for data protection and security against incoming attacks.
- [Penetration Testing](https://www.depthsecurity.com/industries/healthcare/) - Our Penetration Testing services for hospitals and healthcare organizations solve for HIPAA compliance, data protection, and security against incoming attacks.
- [Penetration Testing](https://www.depthsecurity.com/penetration-testing/) - We simulate real world attacks executed by an advanced adversary. Penetration Testing exposes weaknesses in infrastructure & applications & how to resolve them.
- [Application Security Testing](https://www.depthsecurity.com/app-testing/) - Our Application Security Testing assessments help organizations identify weaknesses within web, mobile, thick-client applications and web services.

## Categories

- [Blog](https://www.depthsecurity.com/category/blog/)