Insomnia - SAST DAST Network AD

Insomnia - SAST DAST Network AD Contact information, map and directions, contact form, opening hours, services, ratings, photos, videos and announcements from Insomnia - SAST DAST Network AD, Internet service provider, San Ramon, Palo Alto, CA.

CyberSecurity Solution: The Insomnia: 275+ modules across web, API, network, Active Directory, OSINT and mobile - one workflow, one UI, one license, and reports in a single click.

09/07/2026

Your scanner found 312 vulnerabilities. Your team fixed zero.

Not because they're lazy. Because the report was a list of
maybes.

Most scanners compare version numbers against a CVE list.
Your library says 2.14.1, the database says 2.14.1 is
affected, the report says HIGH. Nobody checked whether the
vulnerable code path is even reachable in your app, whether
the feature is enabled, whether the config that makes it
exploitable is set.

So the developer opens 312 findings, argues with the first
three, and closes the tab. That's not a tooling problem
anymore. That's a trust problem.

Insomnia doesn't compare versions. It sends the actual
payload and waits for a specific marker in the response.
Marker comes back, the finding is confirmed and there's
nothing to argue about. No marker, no finding.

Around 14,900 real proof-of-concept checks from the ExploitDB
corpus, and 98% of them actually send the payload and confirm
by the response.

One confirmed finding beats three hundred maybes. Your
developers will fix the one.

Free in Community.
insom.ai

09/04/2026

Your AWS key leaked months ago. Everyone shrugged.

An access key ID starts with AKIA. It's an identifier, not a
credential. On its own it opens nothing, so it gets ignored
in scans, in reviews, in postmortems.

The secret was in a different file. Two folders away, in a
config nobody grepped.

Put the two together and you don't have to guess whether
they work. You sign one request and ask AWS directly whose
key this is. AWS answers: the account, the user, the ARN,
and everything that user is allowed to do.

That's not a heuristic. That's a confirmation from the
provider.

Insomnia validates credential pairs live — AWS access key
plus secret via a signed STS call, Twilio SID plus token,
OAuth client id plus secret. If it reports a finding, the
provider already confirmed it.

And when you fix it: revoke the key. Deleting the file
doesn't revoke anything.

Free in Community.
insom.ai

09/02/2026

Nobody hacked your AI agent. Somebody wrote to it.

You gave the agent access to your systems and told it to
read incoming tickets. So I opened a ticket. Plain text.
No exploit, no password, no CVE.

The text was an instruction. The agent can't tell the
difference between the data it reads and the commands it
follows — so it read mine and ran it. With your permissions.

That's prompt injection. The bug isn't in the model.
The bug is the access you handed it.

Insomnia tests AI agents and LLM integrations for exactly
this: it sends the payloads, then shows you what your agent
did with them.

Rule of thumb: everything your model reads is untrusted input.
Ticket bodies. Emails. Web pages. Docs. All of it.

Free in Community.
insom.ai

09/01/2026

Your build asks for a package that doesn't exist.

acme-auth is internal. It lives in your private registry.
But your resolver also checks the public one — and on the
public one that name is free.

So I registered it. Thirty seconds, no exploit, no CVE.
Your next build pulled mine.

This is dependency confusion. It's not a bug in your code.
It's a name nobody claimed.

Insomnia's SCA flags every internal package name that
returns 404 on the public registry — the ones anyone
can still take. Results land in your GitHub Security tab.

Go read your lockfile. Count the names you don't own.

Free in Community.
insom.ai

08/31/2026

You deleted the key. Git didn't.

It's the tidiest feeling in the job. You spot a hardcoded credential in the code, delete the line, write "remove secret" in the commit message, push, close the ticket. Done.

Except git is a version control system. Keeping old versions is the entire point of it. That line is still sitting in the object store, in a blob that no longer appears in your working tree — and anyone who clones the repo gets the whole history with it. Every fork. Every mirror. Every laptop that ever pulled.

So we walk the history, not just the code. Every commit, every deleted blob, run through the same detectors.

And then the part that actually decides whether you care: we ask the provider. The key we pulled out of a commit from eight months ago answered. It's live. It still has the same access it had the day someone pasted it in.

Deleting a secret is not revoking it. Those are two different actions, and only one of them protects you.

If you have ever removed a key in a commit and considered it handled, that key is worth ten minutes today. Rotate it, then clean the history.

pip install sast — free, and it reads your history too.

Our bots don't sleep. 🌙 insom.ai

08/27/2026

Task Manager showed explorer.exe running normally. It was telling the truth. That was the problem.

Part 2 of our teardown of the github-software[.]su campaign — the one that started with a fake "Claude jailbreak" download and ended as a 14,000-host botnet.

Here is what actually happened on the machine, in about ten minutes:

An obfuscated PowerShell stage worked out where the victim was. Then came the single most important line of the whole campaign — a Windows Defender exclusion for the malware's own staging folder. Everything after that happened in a blind spot, by permission.

Then it did not hide on disk. It started a real, legitimate explorer.exe, suspended it, unmapped its code, wrote itself into the hole and resumed the process. Task Manager sees explorer.exe. Signed, expected, normal. The malware is running inside it.

From there: Windows Credential Manager, Chrome, Edge and Firefox, all emptied. 128,000+ credentials across the botnet. Then it went quiet for an average of 156 days.

None of this needed a zero-day. It needed a Defender exclusion and a process to wear.

Which is why signature detection was never going to catch it, and why the rules we published target behaviour instead. Two you can deploy today:

— alert on ANY non-admin process adding a Defender exclusion path. Legitimate software almost never does this.
— alert on code injection into explorer.exe, and on new svc_* folders appearing in %TEMP%.

The infrastructure is seized and sinkholed. The playbook is not. Full technical writeup, IOCs and detection rules on the blog.

Our bots don't sleep. 🌙 insom.ai

08/26/2026

Somebody went looking for a free Claude jailbreak. They found a botnet.

The bait worked because of who it targeted. A person hunting for a way to "remove all the restrictions" from an AI has already decided to ignore the warnings. That mindset was the exploit. There was no zero-day here — the malware just needed someone willing to click "Run anyway."

The file was a dropper. It geolocated the machine, told Windows Defender to stop scanning its own folder, unpacked an encrypted payload, hid itself inside explorer.exe, took everything stored in the browser and the credential manager, and went quiet.

For 156 days on average. Across 14,000+ machines. 128,000+ credentials.

There's an irony worth sitting with: the operators used jailbroken AI on their side too — to generate malware variants that slipped past signatures and to write the phishing. AI was both the bait and the toolkit.

Our threat intelligence team mapped all 312 command-and-control domains, took it to CISA, the FBI Cyber Division and Europol, and worked with the hosting providers and registrars directly. The infrastructure has been seized and sinkholed. github-software[.]su is gone. The botnet is offline.

We're publishing it so you recognise the trick if the crew rebrands and comes back.

Never run a "jailbreak" or a "crack". And if you have to run something unknown, scan it first — our static analyzer is free: pip install sast

Full writeup, indicators and detection rules on the blog. Our bots don't sleep.

🌙 insom.ai

08/25/2026

Finding a key is the easy part. Anyone can grep for one.

Your scanner returns forty hits and calls it a day. Most of them are dead. Some were never real — a placeholder, a test value, an example from the docs someone pasted in 2021. The findings sit in a backlog nobody trusts, because nobody knows which of the forty actually matters.

Insomnia does the part everyone skips: it asks the provider.

Slack auth.test. GitHub /user. Stripe /v1/balance. OpenAI /v1/models. Around forty services, checked against the real API — plus paired credentials like an AWS key and secret validated through STS. If the provider answers, the key is live and it still has your access. If it can't be proven, it says unverified instead of pretending.

One of the forty answered. That one is not a backlog ticket.

Go rotate it. Our bots don't sleep.

🌙 insom.ai

08/21/2026

Your app doesn't ask for scary permissions. It doesn't need to.

The key is already inside it.

An APK is a zip file. Anyone can download yours from the store, unpack it, and read every string your team compiled into it. That is not hacking — it is the format working as designed. And somewhere in there, more often than anyone admits, sits a live API key, a signing secret, a hardcoded endpoint that was only ever meant for internal use.

Nobody put it there maliciously. Someone was testing, it worked, it shipped, and the reviewer had four hundred other lines to look at.

Insomnia pulls your APK and IPA apart the same way an attacker would — static and dynamic analysis — and tells you what you published before somebody else finds it.

One app. Three hardcoded keys.

Go check what you shipped. Our bots don't sleep.

🌙 insom.ai

08/20/2026

wo people reviewed 40,000 lines in twenty minutes.

You know how it goes. The PR is huge, the sprint ends tomorrow, two colleagues scroll to the bottom and hit approve. Nobody read it. Nobody could have.

Insomnia reads all of it. AST taint tracking across 16 languages — it follows the data, not the keywords, so it knows which input reached which sink. SQLi, command injection, XSS, path traversal, SSRF, deserialization, hardcoded secrets. Then it checks your dependencies against OSV for known CVEs and flags dependency-confusion names an attacker could claim.

One line came back. Unescaped input going straight into a query.

Free. No signup. Runs in your terminal, your IDE and your CI:

pip install sast && sast .

Go check your last merge. Our bots don't sleep.

🌙 insom.ai

Address

San Ramon
Palo Alto, CA

Opening Hours

Monday 11am - 9pm
Tuesday 11am - 9pm
Wednesday 11am - 9pm
Thursday 11am - 9pm
Friday 11am - 9pm

Telephone

+380930827777

Website

Alerts

Be the first to know and let us send you an email when Insomnia - SAST DAST Network AD posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Insomnia - SAST DAST Network AD:

Shortcuts

Share

Category