An employee opens a company service portal, searches the knowledge base, and drops a file onto a ticket. Someone who never signed in can send a request to that same portal and get records back. Bishop Fox ran that test across 166 ServiceNow instances during authorized penetration tests. The firm published the results along with the Go tool it used, Snowpick. Findings came back from 31% of the instances. Those instances returned records or confirmed … More →
The post Snowpick: Open-source ServiceNow exposure scanner appeared first on Help Net Security.