SilentGrid Blog

Ghost in the Pipelines

Ghost in the Pipelines

We recently had the opportunity to work with a client that had a technology stack that differs from the usual enterprise environment that uses Active Directory, Entra ID and a mix of on-premise and cloud infrastructure. Being an organisation whose staff are mostly developers, all of their infrastructure was cloud

Generative AI (LLM) Security Assessments

Generative AI (LLM) Security Assessments

At SilentGrid Security, we've observed increased interest in security testing for applications using generative AI Large Language Models (LLMs). These models, which power platforms like ChatGPT, offer compelling business benefits but require careful security consideration. This post outlines our approach to LLM security testing and examines key considerations

Purple Teaming - Intelligence Driven Assurance

Purple Teaming - Intelligence Driven Assurance

You don't know, what you don't know Most organisations have adopted an annual cyber security programme which commonly includes penetration testing of internet facing systems and the "internal" network. These tests are valuable exercises which provide assurance that the environment is not affected by

AI CTF Adventures with Vexbot

Introduction At the recent BSides Canberra, we ran a Capture the Flag (CTF) for visitors to our sponsor's booth. With recent interest in AI, we decided to create a Large Language Model based CTF; one that didn't require any custom tools, one that you could play

Breaking Down Office Security: What We Discovered During Our "Break-In"

Breaking Down Office Security: What We Discovered During Our "Break-In"

When you think of office security, you probably picture high-tech firewalls and complex passwords, right? But what about the simpler tools we rely on daily, like lanyards and RFID cards? Sometimes, the real weak spots aren’t in the IT infrastructure at all - they’re in the everyday interactions

Navigating a SQL injection attack

penetration test

Navigating a SQL injection attack

SilentGrid delves into the impact of a SQL injection that affected a healthcare application, which claimed to adequately protect the privacy of its users

Hands-On Modbus Security

ot

Hands-On Modbus Security

In the realm of industrial control, Industrial Control Systems (ICS) play a crucial role in overseeing complex processes, with the widely used Modbus protocol serving as a key player in communication. This blog will delve into the security concerns surrounding ICS, placing a particular focus on the Modbus protocol, which

Local File Read to RCE

rce

Local File Read to RCE

During a recent engagement against a web application, a known vulnerability, CVE-2020-35340 was exploited to gain remote code execution on the server hosting the application

Simulated Attack Infrastructure - Building Modules (Part 2)

adversary simulation

Simulated Attack Infrastructure - Building Modules (Part 2)

Attack Infrastructure Automation Part 2 - Terraform module design, software setup and configuration, and operator experience

Remote compromise: XXE injection on thin client’s web services

xxe

Remote compromise: XXE injection on thin client’s web services

During one of our perimeter assessment exercises, we identified and exploited a vulnerability in an in-house developed thin client

Never Miss an Update

Stay informed with our expert articles and practical advice. Subscribe to our blog today.