NetSPI Blog

Jake Reynolds

Jake Reynolds graduated with a Bachelors Degree in Computer Science from the University of Minnesota, Twin Cities with a focus on enterprise web development. In his role at NetSPI, Jake is responsible for leading Resolve's product strategy and ensuring it exceeds the needs of our customers. Previous to this role Jake was a Principal Security Consultant helping lead internal R&D and application penetration testing services at NetSPI.

Jake Reynolds
March 27th, 2018

Please Stop Giving Me Your Passwords – Part 1

I found myself in the office on Saturday night, mainly because the frozen pizza selection is more expansive than mine at home, and I wanted to get a head start on my project for this week. It was a normal Static Application Security Test (SAST), which follows a mostly pre-defined process, with embellishments depending on […]

Jake Reynolds
December 19th, 2017

NetSPI SQL Injection Wiki

As penetration testers, the tools, information, and knowledge we have available to us directly correlates to the amount of entry points we can identify and exploit in any environment. The longer we spend researching and developing individual escalation paths reduces the amount of time for digging into other parts of the network or application. Below […]

Jake Reynolds
September 26th, 2017

DNS Tunneling with Burp Collaborator

DNS tunneling, in my opinion, is the niftiest data exfiltration method there is. For those not familiar, check out Section 3 from SANS’s “Detecting DNS Tunneling” whitepaper here. Our Mobile Application Practice Lead, Aaron Yaeger, recently taught me how easy it is to use Burp Collaborator for DNS tunneling. Exfiltrating data like that was a bit […]

Jake Reynolds
May 16th, 2017

Beautifying JSON in Burp

Most penetration testers know the pain of trying to view and modify an unparsed JSON string. This Burp extension removes that burden and allows live editing of beautified JSON strings.

Jake Reynolds
April 25th, 2017

SQL Injection to Help You Sleep at Night

If there’s anything to be learned from Gitlab’s recent downtime (which they handled amazingly well), it’s that production databases need to be pampered.  They aren’t something to play around with and as penetration testers that responsibility extends to us. Many companies will allow testing in production, it can be argued that it is the responsible […]

Jake Reynolds
February 21st, 2017

Defeating CSRF Protections Through Expired cross-domain.xml Domains

When someone buys a domain name the usual purchase length is one year, with certain DNS providers allowing multi-year purchases.  Large entities can quickly lose track of all their domains and keeping track of when those domains expire can be an even bigger hassle.  When you add Flash integration into the mix it starts becoming […]