A stack overflow in FatPipe's privileged authentication helper looked like the hard path to root. Tracing its web reachability exposed a second flaw in the middle: unauthenticated command injection in xtremed.
CVSS scoring disputes often come down to mixing intrinsic vulnerability severity with deployment assumptions, exploit-development effort, remediation pressure, and bounty economics. This guide explains how to keep those factors in the right metrics.
I remember watching Simon Scannell's REcon 2023 talk, You Have Become the Very Thing You Swore to Destroy, and being deeply impressed by how he turned ClamAV's own detection logic into an oracle for exploiting a service with no direct output channel. I remember hoping that, someday, I might have the opportunity to [...]
Unless you've been living under a rock, you're probably aware frontier large language models (LLMs) have been keenly focused on automating software development, vulnerability discovery, and most recently exploit development. The most publicized instance of this was Anthropic's marketing campaign around the release of Mythos. What better way to drum up business than [...]
We're excited to share that Reverge 1.2.0 is out. This release includes a major architectural change under the hood: the AI assistant is now powered by Goose, the open-source agent framework from Block (formerly Square). This is a big step forward for automation, extensibility, and the long-term direction of AI-assisted recon in Reverge. [...]
N-Able Windows Software Probe Remote Code Execution Recently I was performing a penetration test using Reverge when an interesting service caught my attention. The banner reported “ms .net remoting services” listening on port 10004. For those unfamiliar, .NET Remoting is an older Microsoft framework that allows applications to expose [...]
Introducing the Reverge AI Assistant This month, we rolled out one of reverge's most anticipated features: an integrated AI assistant that transforms how reverge users can interact with the platform. While AI tools have become commonplace in many industries, we trained reverge's AI assistant specifically for the unique challenges of attack surface [...]
What are reverge collectors? Collectors serve as the distributed job engine for the reverge platform. Operating as a remote collection agent, it receives scanning tasks from the reverge server and executes various tools. This client-server architecture enables scalable reconnaissance operations across multiple environments while maintaining centralized coordination and data aggregation. [...]
From POC to RCE with reverge Last month, Securifera publicly launched our attack surface management tool, reverge, on the AWS Marketplace. While we’re still planning to publish blog posts and videos to guide users through setup and usage, we wanted to give an example of what reverge can do by demonstrating how [...]
Introducing Reverge: An Attack Surface Management Platform by Securifera In today’s complex digital ecosystems, organizations struggle to maintain visibility over sprawling infrastructure, cloud services, and third-party integrations. Traditional vulnerability management tools often fall short in providing real-time, actionable insight into an organization's external exposure. That’s why we’re excited to introduce Reverge, Securifera’s [...]
