NIS2 means stricter rules and steep fines. Penetration testing is key to proving compliance & improving security, uncovering flaws before attackers do. Our latest blog explains why you need it now: blog.compass-security.com/2025/09/ensu... #CyberSecurity #NIS2 #Pentesting

The final episode of our Kerberos deep dive is live! RBCD opens new attack paths in Kerberos. Learn how misconfigs enable privilege escalation and how to defend. youtu.be/l97RDnzdrXY?... #Kerberos #ActiveDirectory

Episode 5 of our Kerberos deep dive is live. Constrained delegation isn’t bulletproof. See how attackers exploit it, and how to defend with monitoring & best practices. youtu.be/rnhr02eKU0I?... #Kerberos #ActiveDirectory

Episode 4 of our Kerberos deep dive is live. Unconstrained delegation can expose critical credentials. Learn how attackers abuse it. And how to lock down your systems. youtu.be/_6FYZRTJQ-s?... #Kerberos #ActiveDirectory

Episode 3 of our Kerberos deep dive is live. AS-REP Roasting abuses accounts without pre-auth. Learn the risks, how attackers exploit it, and how to defend. youtu.be/56BjmyOTN5o?... #Kerberos #ActiveDirectory

We use @jameskettle.com Burp extension Collaborator Everywhere daily. Now our upgrades are in v2: customizable payloads, storage, visibility. Perfect for OOB bugs like SSRF. Find out more here: blog.compass-security.com/2025/09/coll... #AppSec #BurpSuite #Pentesting

Episode 2 of our Kerberos deep dive is live. Kerberoasting lets attackers steal AD service account credentials. See how it works and how to protect your systems: youtu.be/PhNspeJ0r-4?... #Kerberos #ActiveDirectory

Kerberos powers auth in Windows and hides big security risks. We’re launching a 6-part deep dive: from protocol basics to attacks plus how to stop them. Starts today → blog.compass-security.com/2025/09/tami... → Subscribe to our channel! #Kerberos #ActiveDirectory

Calling all bug hunters! schulNetz by Centerboard AG is now in scope! Help protect over 100k users in schools. Are you ready to make the grade and earn bounties? Program: bugbounty.compass-security.com/bug-bounties... #bugbounty #cybersecurity #ethicalhacking

Passwords are dead, long live passkeys! 🔑 In our latest blog, we go hands-on: real-life setups, plus tips for recovery and avoiding pitfalls. blog.compass-security.com/2025/08/into... #Passkeys #CyberSecurity #Authentication

Burp collaborator just got a bunch a new features. Credits go to our @compass-security.com Basel team member, Andreas 🙏

We've just released a massive update to Collaborator Everywhere! This is a complete rewrite by @compass-security.com which adds loads of features including in-tool payload customization. Massive thanks to Compass for this epic project takeover. Check out the new features:

LLM-based vuln hunting just leveled up with xvulnhuntr - a fork of vulnhuntr with support for: C#, Java, Go. Read @rationalpsyche.bsky.social's blog post and go grab the project on GitHub. blog.compass-security.com/2025/07/xvul...

Exploiting the @ubiquiti.bsky.social AI Bullet camera for #Pwn2Own made us sweat more than once. But persistence paid off. Our detailed blog post is now live: blog.compass-security.com/2025/06/pwn2... #penetrationtest #pentest #iot #embedded #cybersecurity www.compass-security.com/en/services/...

Azure IAM is meant to protect your infrastructure. But misconfigurations do the opposite. 5 critical IAM & Entra ID risks - and how to mitigate them: blog.compass-security.com/2025/06/the-...

Thrilled for #TROOPERS25 Thursday! Emanuele & @yvesbieri.bsky.social share #Pwn2Own wins on #surveillance cams. Method, #exploit, lessons. Drop in, trade war-stories! Talk: troopers.de/troopers25/t... Compass pentest: www.compass-security.com/en/services/... #cybersecurity #iot #hw #fw #ot

LinkedIn: your job history and your attacker’s roadmap. In his latest blog post, Ivano Somaini shows how malicious actors could mine profiles, badges, and more. Learn from our experienced Social Engineer: blog.compass-security.com/2025/06/link...

Primate traits run deep at Teleboy smart, curious, and always evolving. If that sounds like you, challenge the boundaries of their infra and secure streaming, internet, and phone experience of 400'000+ users. #bugbounty #ethicalhacking #cybersecurity bugbounty.compass-security.com/bug-bounties...

Many CI/CD tools promise to keep your dependencies up to date - but if misconfigured, they can expose your organization. From token leaks to MR hijacks, Jan's latest blog post shows how bad configuration can turn a security tool into an attack vector. 🛠️💣 blog.compass-security.com/2025/05/reno...

In his latest blog post, Marc Tanner @brain-dump.org shows how to bypass BitLocker using BitPixie (CVE-2023-21563) and signed Microsoft components only. Check out the blog post for a PoC and a demo. #BitLocker #RedTeam blog.compass-security.com/2025/05/bypa...

Tired of sifting through Entra ID manually? EntraFalcon is a PowerShell tool that flags risky objects configs & privileged role assignments with ⚡ Scoring model 📊 HTML reports 🔒 No Graph API consent hassle. Get it now: blog.compass-security.com/2025/04/intr... #EntraID #IAM

3 milliseconds to admin — Our analyst John Ostrowski turned a DLL hijacking into a reliable local privilege escalation on Windows 11. He chained opportunistic locks, and API hooking to win the race to CVE-2025-24076 & CVE-2025-24994. Read his blog post: blog.compass-security.com/2025/04/3-mi...

Security analysts Stephan Sekula and Dennis Henke identified vulnerabilities in Ibexa DXP CMS: www.compass-security.com/en/news/deta...

How can I become a Red Team Operator? – Yours sincerely, A recent graduate. We break down what it takes and why there's no shortcut, and why pentesting is the place to start: blog.compass-security.com/2025/04/i-wa... #redteam #infosec #pentest #career

Security researcher Raphaël Arrouas (XeL) identified zero-day vulnerabilities in the BOINC server and responsibly reported details through our Managed Bug Bounty Program: www.compass-security.com/en/news/deta...

Dear #bughunter, gear up! dEURO launches its program. Hunt for vulnerabilities, secure the oracle-free #stablecoin, and get rewarded. #API, mobile apps and solidity contract in scope. Max. bounty at CHF 10'000. Ready to mint your victory? 🚀 #DeFi bugbounty.compass-security.com/bug-bounties...

No system is perfect! In part 4 of his blog series, @emanuelduss.ch shows how detection mechanisms of web filters can be bypassed: blog.compass-security.com/2025/03/bypa... #pentest #network

Web filters can often be bypassed in various ways. In part 3 of his blog series, @emanuelduss.ch explains how Domain Fronting works, how attackers use it to evade restrictions and how you can detect it. Read the blog post to find out: blog.compass-security.com/2025/03/bypa... #pentest #network

IT-Security kann stressig sein – wir sorgen für Entspannung! Besuchen Sie uns auf der #secIT2025 und holen sich eine kleine Auszeit. #CyberSecurity #ITSecurity #secit #StaySafe

Still think your web filter is secure? Host Header Spoofing might prove otherwise. In part 2 of his post series, @emanuelduss.ch breaks down this bypass technique - how it works and how to stop it. Check it out: blog.compass-security.com/2025/03/bypa... #pentest #network

Think your web filter is foolproof? Think again. Our blog series explores SNI spoofing, Host header spoofing, and Domain Fronting—techniques attackers use to slip past restrictions. Learn how they work and how to stop them! blog.compass-security.com/2025/03/bypa...

Passwords are a thing of the past! Dario Caluzi’s latest blog post explains why passkeys are the future of authentication. They offer a faster, more secure way to log in - no passwords, no phishing risks, just seamless authentication. blog.compass-security.com/2025/02/pass... #Passkeys #Passwordless

Avoid LDAP monitoring by leveraging local registry data with certipy parse! Check out our latest pull request and read Marc Tanner’s (@brain-dump.org) blog post: blog.compass-security.com/2025/02/stea...

Die Kunst des Penetrationstests: Von der Risikobewertung über die Planungsphase und die rechtlichen Rahmenbedingungen bis hin zur Interpretation der Testberichte - Erfahre, wie du die IT-Sicherheit durch gezielte Tests stärkst. Live auf der secIT. 👉 Gleich anmelden: secit-heise.de/tickets#kaufen

Unlock the power of BloodHound Community Edition! 🚀 We’ve updated our custom queries to help you uncover misconfigurations and attack paths in AD. Read @emanuelduss.ch’s blog post for tips and tricks to get started. blog.compass-security.com/2025/01/bloo... #BloodHoundCE #ActiveDirectory

8 tiny bits kept our team from pwning the Alpine IVI and winning ~$10,000 at #pwn2own #automotive. 🥲 Their dedication, hard work and late night sessions were unmatched. This is the passionate hacker's journey: trial & error, learning, & growing. 💪❤️ www.thezdi.com/blog/2024/1/...

The #Pwn2Own schedule is out. Compass folks will show off their exploit Thursday, January 23th, 10:00 Swiss time (CET). Also wishing bsky user @sinsinology.bsky.social success in pwning the Alpine IVI. www.zerodayinitiative.com/blog/2025/1/...

The Compass #Pwn2Own team will be targeting the Alpine iLX-507 In-Vehicle Infotainment at Pwn2Own Automotive #P2OAuto in Tokyo. Turns out it’s a popular target and our colleagues were drawn by @thezdi.bsky.social to attempt an exploit as 8th out of 10 groups targeting the device. Schedule tba

Flying out to Tokyo for #Pwn2Own Automotive 2025! Stay tuned for the schedule and results!

🚨 Phishing-Alarm! Ein Klick auf den falschen Link und der Angreifer ist im Unternehmensnetz. Und jetzt? 🤔 In unserem #EthicalHacking-Workshop auf der SecIT erlebst du die Angriffsphasen hautnah und lernst, wie du Schwachstellen erkennst und sicherst! 👉Gleich anmelden: pretalx.com/secit-by-hei...

At the Black Alps conference 2024, our colleague Emanuele talked about the journey to successfully hacking the Synology BC500 security camera at Pwn2Own. You can now watch the recording of his talk online: youtu.be/geSjdcibAvA

Avoid the pitfalls and make #managed #cybersecurity services a win-win situation with our hitchhiker's guide👍 From detection gaps to communication breakdowns, we've seen it all. Managed services depend on their alignment with an organization's needs. Tips: blog.compass-security.com/2025/01/hitc...

🎙️📺 ch media, home to 70+ brands including radio stations, TV channels, news outlets, and digital platforms, is launching a #bug #bounty program! Earn up to CHF 5’000 for securing Switzerland’s media backbone. Ready to make headlines? #bugbounty program at bugbounty.compass-security.com

We adopted the 5+2 framework (swiss armed forces crisis management) for #cyber incidents! 🚨 ✅ Clear phases: Problem Capture → Decision ✅ Factors: Timeline, Business, IT, Stakeholders, TA Refined and ready to be applied in upcoming cyber #crisis. #incident #response #management #cybersecurity

👏 Huge thanks to @dirkjanm.io for an exceptional Azure & Entra security training! The nitty-gritty, and real-world examples resonated strongly among our class of 25 security analysts. Thank you! #microsoft #azure #entra #cyber #security #training #cybersecurity

Ups and downs of #redteam engagements. When the standard payloads don’t cut it, innovation wins. Learn how we misused a screenshot tool to load shellcode… at the fifth attempt!… blog.compass-security.com/2024/12/a-ni...

🚀 Workshop tickets for Insomni'hack 2025 are on sale now! Level up with: 💻 Windows Defense 📱 Mobile App Attacks 🌐 Web Security 🤖 AI SecureOps ☁️ Entra ID Security 🎟️ Limited seats! Get yours: insomnihack.ch/workshops-20... #INSO25 #Cybersecurity #Switzerland #CyberEvent

⚡ Calling all #bughunter! The utility EBL is live with a managed #bugbounty program. Up to CHF 5,000 for reports that strike like lightning! Targets hide and protect #OT and #SCADA components. Let’s secure the energy grid together. Are you up for a challenge? www.compass-security.com/en/services/...

Call a cyber-plumber, your CI/CD is leaking secrets 💧 Meet Pipeleak, the tool that catches GitLab pipelines leaks before they hurt your org. #DevSecOps #GitLab blog.compass-security.com/2024/12/harv...

Starting today, December 2nd, rewards up to CHF 10,000 are offered for reports that enhance the security of vestr’s fintech solutions. We’re proud to manage everything from first discovery to zero-day fixes for vestr. #cybersecurity #bugbounty bugbounty.compass-security.com/bug-bounties/