Insomnia - SAST DAST Network AD

Insomnia - SAST DAST Network AD Contact information, map and directions, contact form, opening hours, services, ratings, photos, videos and announcements from Insomnia - SAST DAST Network AD, Computers & Internet Website, San Ramon, Palo Alto, CA.

CyberSecurity Solution: The Insomnia: 275+ modules across web, API, network, Active Directory, OSINT and mobile - one workflow, one UI, one license, and reports in a single click.

10/16/2026

A JSON web token is three pieces of base64. The middle one isn't encrypted - anyone holding the token can read it.

JWT Auditor pulls it apart and checks the design, not the content: HS256 with one shared secret, no key id so the key can't be rotated, no audience, no issuer, an expiry ten years out, and the role and email sitting in the payload in the clear.

The signature verifies. So the only question left is what signed it. A wordlist answered that in one pass - the secret was a dictionary word.

Then the forge builds a new token with a new role, signed with the key we just recovered. The live target returns 200.

Nobody stole a session. We made one.

10/15/2026

Broken Access Control is the one class of bug a scanner cannot guess at. It has to ask the same question as somebody else.

Authorization Testing takes three identities - Admin, a regular user, Anonymous - and a list of endpoints from Swagger, the crawler, or your history. It flags the admin paths on its own and tells you why it flagged each one.

Then it sends every endpoint again, as every role, and compares the responses.

The matrix is the whole answer. Green where access was refused. Red where it came back anyway.

A regular user could change another account's role. Anonymous could read the admin user list. A regular user could pull somebody else's invoice and kill their sessions.

Nobody broke in. They just asked, and it said yes.

10/09/2026

This extension colours your tabs. That is the whole product.

Browser Extension Scanner takes a CRX, XPI or ZIP — or pulls it straight from the Chrome Web Store by ID — and reads everything it ships: API keys, secrets, URLs and endpoints, vulnerabilities, libraries, CSP issues and content scripts.

52 findings. 2 critical. It asks to read and change data on every site you visit, read your cookies, and inspect your network requests. A bot token sits on one line of the background script, not obfuscated, just left in.

Then the part that matters: the scanner doesn't stop at the pattern. It asks the provider. Slack answered 200 OK — team, scopes, write access. The key is live.

Pattern matching guesses. A provider response doesn't.

10/08/2026

A firmware image is just a file. Everything the device trusts is already inside it.

Firmware Security Auditor takes a .bin or ELF image and reads it: hardcoded credentials, crypto weaknesses, known vulnerabilities, strings — and deep extraction unpacks the filesystem so it can read what the vendor left behind.

74 findings. 4 critical. A root password hash at a fixed offset in /etc/shadow. Telnet starting at boot. An account nobody documented. A private key shipped inside the image.

Entropy 1.00 across a packed block — unpacked anyway. MIPS32, SquashFS, built in 2019, 23 CVEs matched behind the components.

That key is not on one device. It's in every device built from the same image.

10/07/2026

A container is supposed to be a wall between the app and the host.

Docker Audit connects to the Docker host over SSH and runs seven phases read-only: daemon config, container security, image and layer analysis, network, the CIS Docker Benchmark, container escape vectors, and host privesc recon.

27 findings. 3 critical. The docker socket mounted straight into a container, another one running privileged with every capability, and the daemon API listening with TLS off.

It reports the path out of the container. It does not take it.

10/06/2026

A server you can't reach directly.

Host Security Audit builds a hop chain through a bastion, jump-exec mode carries you to the target, and the host is read in read-only. Nothing gets installed on the machine, nothing gets changed.

212 packages behind. 27 findings, 3 critical. openssl 1.0.2k still sitting there.

And if there's no SSH at all — the agent runs on the target host and calls back through a tunnel.

Hard to reach is not the same as safe.

Address

San Ramon
Palo Alto, CA

Opening Hours

Monday 11am - 9pm
Tuesday 11am - 9pm
Wednesday 11am - 9pm
Thursday 11am - 9pm
Friday 11am - 9pm

Telephone

+380930827777

Website

Alerts

Be the first to know and let us send you an email when Insomnia - SAST DAST Network AD posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Insomnia - SAST DAST Network AD:

Shortcuts

Share

Category