Skip to content

Commit

Permalink
deploy: e2432df
Browse files Browse the repository at this point in the history
  • Loading branch information
@TalAstrix
TalAstrix committed Dec 23, 2024
1 parent 24e571f commit 867d96e
Show file tree
Hide file tree
Showing 12 changed files with 24 additions and 24 deletions.
2 changes: 1 addition & 1 deletion 2025/1-improper-offboarding/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -745,7 +745,7 @@ <h1 id="nhi12025-improper-offboarding">NHI1:2025 Improper Offboarding<a class="h
<tr>
<td>Exploitability: <strong>Easy</strong></td>
<td>Prevalence: <strong>Widespread</strong><br>Detectability: <strong>Hard</strong></td>
<td>Technical Impact: <strong>Severe</strong></td>
<td>Technical: <strong>Severe</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Exploiting an improperly offboarded NHI greatly depends on context. Considering the case of an inside threat, it’s quite simple to identify what necessary credentials are needed to exploit the improperly offboarded identity.</td>
Expand Down
2 changes: 1 addition & 1 deletion 2025/10-human-use-of-nhi/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -743,7 +743,7 @@ <h1 id="nhi102025-human-use-of-nhi">NHI10:2025 Human Use of NHI<a class="headerl
<tr>
<td>Exploitability: <strong>Hard</strong></td>
<td>Prevalence: <strong>Common</strong><br>Detectability: <strong>Hard</strong></td>
<td>Technical Impact: <strong>Low</strong><br>Business: <strong>Specific</strong></td>
<td>Technical: <strong>Low</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Successfully exploiting Human use of NHI requires the threat agent first to gain access to the environment. Therefore, Human use of NHI attacks depends on a separate initial access vector.</td>
Expand Down
6 changes: 3 additions & 3 deletions 2025/2-secret-leakage/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -743,9 +743,9 @@ <h1 id="nhi22025-secret-leakage">NHI2:2025 Secret Leakage<a class="headerlink" h
</thead>
<tbody>
<tr>
<td>Exploitability - <strong>Easy</strong></td>
<td>Prevalence - <strong>Common</strong> : Detectability - <strong>Hard</strong></td>
<td>Technical - <strong>Severe</strong> : Business - <strong>Specific</strong></td>
<td>Exploitability: <strong>Easy</strong></td>
<td>Prevalence: <strong>Common</strong><br>Detectability: <strong>Hard</strong></td>
<td>Technical: <strong>Severe</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Successfully exploiting a Leaked Secret is extremely easy given the fact that the secret enables the attacker to authenticate as the legitimate application.</td>
Expand Down
6 changes: 3 additions & 3 deletions 2025/3-vulnerable-third-party-nhi/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -743,9 +743,9 @@ <h1 id="nhi32025-vulnerable-third-party-nhi">NHI3:2025 Vulnerable Third-Party NH
</thead>
<tbody>
<tr>
<td>Exploitability - <strong>Average</strong></td>
<td>Prevalence - <strong>Common</strong> : Detectability - <strong>Hard</strong></td>
<td>Technical - <strong>Severe</strong> : Business - <strong>Specific</strong></td>
<td>Exploitability: <strong>Average</strong></td>
<td>Prevalence : <strong>Common</strong><br>Detectability: <strong>Hard</strong></td>
<td>Technical: <strong>Severe</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Finding a vulnerable 3rd-party application is not trivial and requires some work to achieve. However, once breached, access to the 3rd-party customers/users/clients is simple.</td>
Expand Down
2 changes: 1 addition & 1 deletion 2025/4-insecure-authentication/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -745,7 +745,7 @@ <h1 id="nhi42025-insecure-authentication">NHI4:2025 Insecure Authentication<a cl
<tr>
<td>Exploitability: <strong>Easy</strong></td>
<td>Prevalence: <strong>Widespread</strong><br>Detectability: <strong>Easy</strong></td>
<td>Technical Impact: <strong>Moderate</strong><br>Business: <strong>Specific</strong></td>
<td>Technical: <strong>Moderate</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Once an attacker detects an NHI using insecure authentication, they can utilize known techniques and tools to abuse and compromise the NHI.</td>
Expand Down
6 changes: 3 additions & 3 deletions 2025/5-overprivileged-nhi/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -743,9 +743,9 @@ <h1 id="nhi52025-overprivileged-nhi">NHI5:2025 Overprivileged NHI<a class="heade
</thead>
<tbody>
<tr>
<td>Exploitability - <strong>Hard</strong></td>
<td>Prevalence - <strong>Widespread</strong> : Detectability - <strong>Average</strong></td>
<td>Technical - <strong>Severe</strong> : Business - <strong>Specific</strong></td>
<td>Exploitability: <strong>Hard</strong></td>
<td>Prevalence: <strong>Widespread</strong><br>Detectability: <strong>Average</strong></td>
<td>Technical: <strong>Severe</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Successfully exploiting an overprivileged NHI requires the threat agent to first gain access to the environment. Therefore, Overprivileged NHI is dependent on a separate initial access vector.</td>
Expand Down
2 changes: 1 addition & 1 deletion 2025/6-insecure-cloud-deployment-configurations/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -745,7 +745,7 @@ <h1 id="nhi62025-insecure-cloud-deployment-configurations">NHI6:2025 Insecure Cl
<tr>
<td>Exploitability: <strong>Average</strong></td>
<td>Prevalence: <strong>Common</strong><br>Detectability: <strong>Easy</strong></td>
<td>Technical Impact: <strong>Severe</strong><br>Business: <strong>Specific</strong></td>
<td>Technical: <strong>Severe</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Generally, discovering misconfigured pipelines is difficult because they are set up within the organization's confines. However, once a threat actor gains simple read access, they can relatively easily reconnoiter the environment and discover vulnerable configurations.</td>
Expand Down
6 changes: 3 additions & 3 deletions 2025/7-long-lived-secrets/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -743,9 +743,9 @@ <h1 id="nhi72025-long-lived-secrets">NHI7:2025 Long-Lived Secrets<a class="heade
</thead>
<tbody>
<tr>
<td>Exploitability - <strong>Hard</strong></td>
<td>Prevalence - <strong>Widespread</strong> : Detectability - <strong>Easy</strong></td>
<td>Technical - <strong>Severe</strong> : Business - <strong>Specific</strong></td>
<td>Exploitability: <strong>Hard</strong></td>
<td>Prevalence: <strong>Widespread</strong><br>Detectability: <strong>Easy</strong></td>
<td>Technical: <strong>Severe</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Successfully exploiting a Long-Lived Secret requires the threat agent to first gain access to the secret value. Therefore, Long-Lived Secret attacks depend on a separate initial access vector.</td>
Expand Down
6 changes: 3 additions & 3 deletions 2025/8-environment-isolation/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -743,9 +743,9 @@ <h1 id="nhi82024-environment-isolation-nhi">NHI8:2024 Environment Isolation NHI<
</thead>
<tbody>
<tr>
<td>Exploitability - <strong>Average</strong></td>
<td>Prevalence - <strong>Uncommon</strong> : Detectability - <strong>Hard</strong></td>
<td>Technical - <strong>Moderate</strong> : Business - <strong>Specific</strong></td>
<td>Exploitability: <strong>Average</strong></td>
<td>Prevalence: <strong>Uncommon</strong><br>Detectability: <strong>Hard</strong></td>
<td>Technical: <strong>Moderate</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Successfully exploiting an unisolated NHI requires the threat agent to first gain access to the test environment. That said, test environments tend to have significantly less protections in place than production environments.</td>
Expand Down
6 changes: 3 additions & 3 deletions 2025/9-nhi-reuse/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -773,9 +773,9 @@ <h1 id="nhi92025-nhi-reuse">NHI9:2025 NHI Reuse<a class="headerlink" href="#nhi9
</thead>
<tbody>
<tr>
<td>Exploitability - <strong>Hard</strong></td>
<td>Prevalence - <strong>Widespread</strong> : Detectability - <strong>Hard</strong></td>
<td>Technical - <strong>Low</strong> : Business - <strong>Specific</strong></td>
<td>Exploitability: <strong>Hard</strong></td>
<td>Prevalence: <strong>Widespread</strong><br>Detectability: <strong>Hard</strong></td>
<td>Technical: <strong>Low</strong><br>Business: <strong>Specific</strong></td>
</tr>
<tr>
<td>Successfully exploiting a Re-used NHI requires the threat agent to first gain access to the environment. Therefore, NHI Reuse is dependent on a separate initial access vector.</td>
Expand Down
2 changes: 1 addition & 1 deletion 2025/release-notes/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -618,7 +618,7 @@ <h1 id="release-notes">Release Notes<a class="headerlink" href="#release-notes"
<li>2024-Dec-20: NHI:8 - Environment Isolation page uploaded</li>
<li>2024-Dec-20: NHI:2 - Secret Leakage page uploaded</li>
<li>2024-Dec-23: NHI:7 - Long-Lived secret page uploaded</li>
<li>2024-Dec-23: Meta pages uploaded.</li>
<li>2024-Dec-23: Meta pages uploaded</li>
<li>2024-Dec-24: The OWASP NHI Top 10 2025 Project is live!</li>
</ul>

Expand Down
2 changes: 1 addition & 1 deletion 2025/search/search_index.json
View file

Large diffs are not rendered by default.

0 comments on commit 867d96e

Please sign in to comment.