We design, build and hack—so you don’t have to Software services agency for SMEs working in security, development & design.
Lahore, Pakistan
Joined June 2022
- Tweets310
- Following1
- Followers19
- Likes165
Pinned Tweet
Book a 100% FREE consultation with us to know how Tecvity can help your business 👇
Link: tecvity.zohobookings.com/
Did you hear about RCE vulnerability in @wazuh?
We've done research on it for you to understand what went wrong and how can you make sure you're not affected by it!
Read the blog at tecvity.co/blogs/unsafe_dese…
#CyberSecurityAwareness
In our practice, we see a lot of hacked WordPress sites. A LOT!
We've put together a list of actions that you should apply on your WordPress website to ensure it's safe from security breaches.
Thread 🧵👇
1. Keep your WordPress version updated
2. Use strong password & MFA -- NO-BRAINER!
3. Enable auto-updates of plugins
4. Disable file modification in wp-config.php
5. Take regular backups
6. Disable XML-RPC -- Tell us why you need it if it's enabled?
#ApplicationSecurity
7. Scan your website often using @_WPScan_ -- It's 100% free I
f you follow these tips, you'll make your WordPress site a lot secure.
If you want to know how these things can actually be done, step-by-step. Watch this video: youtube.com/watch?v=D0Q6448F…
#cybersecuritytips
We came across a security issue in one of the Pakistan's law enforcement agency's website 🚩 🎯
Our talented engineer found the vulnerability of Local File Inclusion, that allows the attacker to read any file on the server.
We have responsibly reported this security issue to the relevant department, and awaiting their response regarding the fix.
We're thriving to make internet a securer place! #ApplicationSecurity #ResponsibleDisclosure #Cybersecurity
People, AI is not going to make your product do wonders by default.
Use AI wisely and only if required else dont bother adding it at first place.
#PublicServiceMessage #ArtificialIntelligence
Tecvity retweeted
Why being 'Nice' was costing us time and money"
We weren’t getting client feedback on time and it was killing our workflow.
Turns out, being 'nice' was the problem.
I sent this to my team after clients kept delaying feedback.
Here’s how we fixed it…
Last week a terrible security breach happened that caused $1.5 billion of theft from Ethereum cold wallet.
(While there was social engineering involved, but that's just one piece of the puzzle)
In a recent post by @The_Cyber_News it has been revealed that...
Thread 🧵👇
in the kill-chain there was exploitation of Atlassian Critical CVE involved.
To start off, attackers compromised CVE-2023-22527 which is a critical server side vulnerability in Atlassian Confluence servers.
There can't be a better example to explain the significance of patching your systems, where an unpatched Atlassian Version lead to loss of $1.5 Billion
and hey, it's Patching Tuesday tomorrow, so let's take the initiative to patch before some bad happens
#CybersecurityAwareness
Our team member @njmulsqb2 has worked on @zaproxy and fixed the issue of false positive of timestamps on it.
We believe in contributing back to community!
Here's the PR Link: github.com/zaproxy/zap-exten…
#ApplicationSecurity #AppSec #Opensource
I have just published walkthrough of @PwnedLabs's "Intro to Azure Recon with Bloodhound" here: youtu.be/gPaIpXZZHg0?si=Rina…
#Azure #CloudSecurity
How do you make sure your infrastructure is unhackable?
Looking forward to some unorthodox approach to cybersecurity 😈
OAuth is becoming more & more popular
(With which the amount of OAuth related vulnerabilities are rising too)
One should not assume that adopting OAuth means your authentication mechanism is fool proof. Nah!
There are a number of vulnerabilities that can...
Thread 🧵👇
arise in misconfigured OAuth integrations like:
- CSRF
- Redirect Attacks
- Mutable Claims Attack
- Client Confusion Attack
- Scope Upgrade Attack
- Redirect Scheme Hijacking
- ...
But don't worry, they can be fixed if your development team stays...
just a little bit proactive and implement OAuth properly.
This article by @Doyensec outlines the details of these vulnerabilities and their fixes: blog.doyensec.com/2025/01/30…
~ Stay Cyber Secure!
#OAuth #Cybersecurity #ApplicationSecurity
Threat Modeling is paramount to maintain security posture of your applications
(but what if we want to threat model public clouds?)
There are multiple frameworks for Threat Modeling applications but very few are out there to achieve the same goal...
Thread 🧵👇
on cloud environments.
That doesn't means that threat modeling is not needed in clouds, instead it's an untapped area where work is needed.
Here's a link to UCTM: securosis.com/wp-content/upl…
Repost to share this information with others ♻ #CloudSecurity #ThreatModeling