The latest cybersecurity insights and news from Naunet.https://naunet.eu/https://naunet.eu/blog/openclaw-when-a-helpful-assistant-becomes-an-attack-surface/https://naunet.eu/blog/openclaw-when-a-helpful-assistant-becomes-an-attack-surface/OpenClaw is an open source AI assistant that runs on your machine and connects to chat apps like Telegram, Discord, and Slack. It is useful because it collapses message intake, web access, tool invocation, and stored authority into one runtime. These features make it a very inviting application however that is also the core danger.Thu, 02 Apr 2026 00:00:00 GMTMate Torokhttps://naunet.eu/blog/how-to-use-evilginx-3-with-custom-certificates/https://naunet.eu/blog/how-to-use-evilginx-3-with-custom-certificates/Two ways to use Evilginx 3 community edition with custom (even wildcard) certificates.Mon, 31 Mar 2025 00:00:00 GMTBence Szabohttps://naunet.eu/blog/how-not-to-land-in-spam-during-your-phishing-campaign/https://naunet.eu/blog/how-not-to-land-in-spam-during-your-phishing-campaign/Last year, I conducted a phishing campaign as part of a red team assessment. Let me share what I learned about SPAM filters. I also had access to the internal mailing system, allowing me to test my theories on the target.Fri, 28 Mar 2025 00:00:00 GMTBence Szabohttps://naunet.eu/blog/stealthier-than-nmap-shadowprobe/https://naunet.eu/blog/stealthier-than-nmap-shadowprobe/ShadowProbe is a custom-made, TCP-only port scanner designed for multiple targets, featuring an inbuilt scheduler. It is a tool intended to run for days or even weeks once started.Fri, 28 Mar 2025 00:00:00 GMTBence Szabohttps://naunet.eu/blog/legolad-a-stealthier-approach-to-active-directory-enumeration-for-red-teams/https://naunet.eu/blog/legolad-a-stealthier-approach-to-active-directory-enumeration-for-red-teams/LegolAD is an enumeration tool that allows configurable network traffic for LDAP requests in Active Directory. It can be configured for scope, pagination, and jitter. The idea behind it was to evade detection by custom monitoring systems.Thu, 27 Mar 2025 00:00:00 GMTBence Szabohttps://naunet.eu/blog/effective-penetration-testing-matching-business-needs-with-the-right-approach/https://naunet.eu/blog/effective-penetration-testing-matching-business-needs-with-the-right-approach/In this article, we’ll explore the different types of penetration tests—compliance-driven, penetration testing as a service (PTaaS), and threat-led testing. We’ll discuss when and why each type is necessary, who benefits from them, and how to determine the best option for your organization’s specific security needs.Fri, 21 Mar 2025 00:00:00 GMTNaunethttps://naunet.eu/blog/aims-ecrew-authorization-bypass-cve-2024-44450/https://naunet.eu/blog/aims-ecrew-authorization-bypass-cve-2024-44450/Access control vulnerabilities are still the most common problems in web applications. This blog post summarizes several access control issues we found in our target web application.Mon, 03 Mar 2025 00:00:00 GMTNorbert Bajkohttps://naunet.eu/blog/email-security-part-1-the-fundamentals-of-spf-dkim-and-dmarc/https://naunet.eu/blog/email-security-part-1-the-fundamentals-of-spf-dkim-and-dmarc/Email remains the primary attack vector for phishing and ransomware, making robust authentication essential for protecting organizations. This article introduces SPF, DKIM, and DMARC—three key technologies that help verify sender identity, prevent spoofing, and enhance email security.Thu, 20 Feb 2025 00:00:00 GMTNorbert Bajkohttps://naunet.eu/blog/configuring-burp-suite-for-testing-vaadin-based-applications/https://naunet.eu/blog/configuring-burp-suite-for-testing-vaadin-based-applications/Vaadin-based applications rely on synchronization values to maintain UI state. During security testing, missing or incorrect values can terminate sessions, making automated scans ineffective. This article explores how to navigate these challenges using Burp Suite.Fri, 07 Feb 2025 00:00:00 GMTNorbert Bajko