Learning from mistakes: The Yahoo hack

TL;DR Belan’s observed offensive traits were as follows: He identified peripheral web servers via Google and Linkedin searches Used known WordPress flaws and custom bugs to compromise PHP sites Linux authentication mechanisms were altered to capture credentials Nmap was used to identify exposed network services internally Corporate Wikis revealed administrative workflows and VPN details Ticketing, […]