<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Alain Mowat &#8211; SCRT Team Blog</title>
	<atom:link href="/author/alainmowat/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Wed, 04 Jun 2025 13:59:15 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>Alain Mowat &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>SonicDoor &#8211; Cracking SonicWall&#8217;s SMA 500</title>
		<link>/2025/06/04/sonicdoor-attacking-sonicwalls-sma-500/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Wed, 04 Jun 2025 09:36:07 +0000</pubDate>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=6642</guid>

					<description><![CDATA[While attempting to compare the security level of various VPN vendors, I kept falling down the path of searching for vulnerabilities instead. This blog post details the ones I discovered in SonicWall&#8217;s SMA 500, which were patched in December 2024. This post has been delayed to coincide with my talk at SecurityFest on this exact &#8230; <a href="/2025/06/04/sonicdoor-attacking-sonicwalls-sma-500/" class="more-link">Continue reading <span class="screen-reader-text">SonicDoor &#8211; Cracking SonicWall&#8217;s SMA 500</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Arbitrary web root file read in Sitecore before v10.4.0 rev. 010422</title>
		<link>/2024/11/25/arbitrary-web-root-file-read-in-sitecore-before-v10-4-0-rev-010422/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Mon, 25 Nov 2024 13:34:08 +0000</pubDate>
				<category><![CDATA[Exploit]]></category>
		<category><![CDATA[Research]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=5725</guid>

					<description><![CDATA[As part of our continuous pentesting offering, we try to identify solutions used by multiple clients to guide our research efforts to deliver the greatest impact. That is why, recently, we spent some time searching for vulnerabilities within Sitecore to find what we initially thought to be a 0-day, but ended up having been already &#8230; <a href="/2024/11/25/arbitrary-web-root-file-read-in-sitecore-before-v10-4-0-rev-010422/" class="more-link">Continue reading <span class="screen-reader-text">Arbitrary web root file read in Sitecore before v10.4.0 rev. 010422</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Getting code execution on Veeam through CVE-2023-27532</title>
		<link>/2024/09/10/getting-code-execution-on-veeam-through-cve-2023-27532/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Tue, 10 Sep 2024 13:32:28 +0000</pubDate>
				<category><![CDATA[Exploit]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=4313</guid>

					<description><![CDATA[While several blog posts have shown how to retrieve credentials through this vulnerability, we decided to dig deeper and see whether it was possible to execute arbitrary code through this issue. DISCLAIMER: This blog post was written a year and a half ago and we have postponed publication upon Veeam&#8217;s request, but given a recent &#8230; <a href="/2024/09/10/getting-code-execution-on-veeam-through-cve-2023-27532/" class="more-link">Continue reading <span class="screen-reader-text">Getting code execution on Veeam through CVE-2023-27532</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Exploiting stale ADIDNS entries</title>
		<link>/2023/09/25/exploiting-stale-adidns-entries/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Mon, 25 Sep 2023 09:46:07 +0000</pubDate>
				<category><![CDATA[Pentest]]></category>
		<category><![CDATA[Research]]></category>
		<guid isPermaLink="false">/?p=4365</guid>

					<description><![CDATA[The correct IP address is sometimes all you need to exploit a remote target. Background I realise this article will not help me with my colleagues who believe I just happen to get lucky on every assessment I’m on. Nevertheless, during a recent internal pentest, our first objective was to attempt to bypass the Network &#8230; <a href="/2023/09/25/exploiting-stale-adidns-entries/" class="more-link">Continue reading <span class="screen-reader-text">Exploiting stale ADIDNS entries</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Producing a POC for CVE-2022-42475 (Fortinet RCE)</title>
		<link>/2023/03/14/producing-a-poc-for-cve-2022-42475-fortinet-rce/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Tue, 14 Mar 2023 10:24:13 +0000</pubDate>
				<category><![CDATA[Exploit]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=3776</guid>

					<description><![CDATA[Late last year a new remote code execution vulnerability was discovered in Fortinet&#8217;s SSLVPN service. Given the relative lack of information surrounding it at the time, and the fact I&#8217;d have some uninterrupted research time due to a lengthy flight, I decided to attempt to produce a POC for the vulnerability. Background information I started &#8230; <a href="/2023/03/14/producing-a-poc-for-cve-2022-42475-fortinet-rce/" class="more-link">Continue reading <span class="screen-reader-text">Producing a POC for CVE-2022-42475 (Fortinet RCE)</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Internal security recommendations survey</title>
		<link>/2021/10/11/internal-security-recommendations-survey/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Mon, 11 Oct 2021 13:11:57 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=3223</guid>

					<description><![CDATA[During the first wave of Covid and most people locked up at home, I wanted to engage with my colleagues in various departments here at SCRT by having them answer a simple survey. The survey related to what actions they would recommend and prioritize in order to secure the information system of a random company, &#8230; <a href="/2021/10/11/internal-security-recommendations-survey/" class="more-link">Continue reading <span class="screen-reader-text">Internal security recommendations survey</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Stealing user passwords through a VPN&#8217;s SSO</title>
		<link>/2021/02/25/stealing-user-passwords-through-a-vpns-sso/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Thu, 25 Feb 2021 15:57:36 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=2831</guid>

					<description><![CDATA[Last year I got this idea that I should attempt to pay for my holidays to Japan by hunting for bounties in security appliances while in the plane. A full 10 hours of uninterrupted focus on one solution seemed like it should yield interesting results. So I started reverse engineering the Firewall of a relatively &#8230; <a href="/2021/02/25/stealing-user-passwords-through-a-vpns-sso/" class="more-link">Continue reading <span class="screen-reader-text">Stealing user passwords through a VPN&#8217;s SSO</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>State of Pentesting 2020</title>
		<link>/2020/12/28/state-of-pentesting-2020/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Mon, 28 Dec 2020 08:04:07 +0000</pubDate>
				<category><![CDATA[Pentest]]></category>
		<guid isPermaLink="false">/?p=2769</guid>

					<description><![CDATA[To many people, pentesting (or hacking in a broader sense) is a dark art mastered by some and poorly understood by most. It has evolved quite substantially throughout the years, guided by new vulnerabilities, changing behaviours and maybe most importantly the development and release of new tools, be they offensive or defensive. In this blog &#8230; <a href="/2020/12/28/state-of-pentesting-2020/" class="more-link">Continue reading <span class="screen-reader-text">State of Pentesting 2020</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Continuous Pentesting</title>
		<link>/2020/08/26/continuous-pentesting/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Wed, 26 Aug 2020 08:39:22 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Pentest]]></category>
		<guid isPermaLink="false">/?p=2757</guid>

					<description><![CDATA[At SCRT, we have been performing penetration tests for nearly 20 years now and have always tried to improve our methodologies to match client expectations and deliver the most accurate and useful results from each test we undertake. Over the last few years, Bug bounty programs have been making a name for themselves as they &#8230; <a href="/2020/08/26/continuous-pentesting/" class="more-link">Continue reading <span class="screen-reader-text">Continuous Pentesting</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>SCRT on Covid-19 and Remote Access / Working From Home</title>
		<link>/2020/04/14/scrt-on-covid-19-and-remote-access-working-from-home/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Tue, 14 Apr 2020 13:26:51 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=2573</guid>

					<description><![CDATA[Like everybody, SCRT has been adjusting to life under Covid-19 over the last weeks. Thankfully, we&#8217;ve been prepared for working from home for quite some time now as many of us do so during normal circumstances anyways. This is however not the case for all companies and we&#8217;ve unfortunately been called in to help some &#8230; <a href="/2020/04/14/scrt-on-covid-19-and-remote-access-working-from-home/" class="more-link">Continue reading <span class="screen-reader-text">SCRT on Covid-19 and Remote Access / Working From Home</span></a>]]></description>
		
		
		
			</item>
	</channel>
</rss>
