Copyright © 2019 CyStack Security.

The future of Cybersecurity

An all-in-one platform that provides solutions to company’s cyber-threats.
Powered by Artificial Intelligence & Crowdsourced Security.
Get started

Trusted by 100+ customers

Our customers

Products

Explore our cyber-security products for your enterprise

DEFENSE

CyStack WhiteHub CyStack WhiteHub

Detect critical vulnerabilities in applications at low cost. Powered by Crowdsourced Security.

Learn more

CyStack WebShield CyStack WebShield

Automatically monitor website, detect fundamental vulnerabilities and prevent cyber attacks.

Learn more

DATA PROTECTION

CyStack CRM CyStack CRM

Monitor and detect abnormal events on CRM software using AI.

Learn more
Out platform

THREAT PREVENTION

CyStack Server CyStack Server

Detect and prevent illegal activities on server infrastructure.

Learn more

CyStack Enterprise CyStack Enterprise

Detect and prevent illegal activities & malware on local networks.

Learn more

DATA PROTECTION

CyStack CRM CyStack CRM

Monitor and detect abnormal events on CRM software using AI.

Learn more

Start for free

Request a DEMO

Case study

vntriplogo

Vntrip

Vntrip has protected their top-secret data including 500,000 users and 10,000 partners.

getflylogo

Getfly

Getfly has taken advantage of WhiteHub to ensures their system's continuation.

luxstaylogo

Luxstay

Luxstay has well-secured their customers' sensitive infomation from hackers.

News

9/12/2019

D-Link DNS-320 ShareCenter <= 2.05.B10 - Unauthenticated Remote code execution

CyStack Advisory IDCSA-2019-03CVE IDsCVE-2019-16057SeverityCriticalSynopsis CyStack security discovered a remote code execution vulnerability in the D-Link DNS-320 ShareCenter [http://sharecenter.dlink.com/products/DNS-320]device which its version is lower or equal 2.05.B10 . By exploiting the vulnerability, a remote, unauthenticated attacker can access to all application commands with root permission. This device is a popular network storage device and interestingly, in the past, it was also re

8/11/2019

Subdomain takeover - Chapter two: Azure Services

As I described in the chapter one [https://blog.cystack.net/subdomain-takeover/] , we can control the content of a sub-domain d by  controlling the content of domain d1 that d points to through its CNAME record. Azure [https://azure.microsoft.com/en-us/], a popular cloud service offer many services that can create such a d1. In this article, I will go details about services of Azure that can be vulnerable and how I exploited in the wild, including: Traffic Manager Profile, Web App, Virtual M

7/13/2019

Trape 2.0 SQLi and stored XSS

CyStack Advisory IDCSA-2019-02CVE IDsCVE-2019-13488, CVE-2019-13489Severity MediumTrape [https://github.com/jofpin/trape] is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It is a quite popular project, with 4k stars on Github, and a presentation at Black Hat Asia 2018. Recently, I have discovered 2 security vulnerabilities within this project. In this article, I will describe how I found these vulnerabilities,