The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
116 posts
Change the ID in the URL and you see somebody else’s data. Why IDOR is so common, how it is exploited, and why scanners are poor at finding it.
Read the post →OWASP’s MASTG is the closest thing mobile testing has to a standard. What the checklist covers, and where a penetration test goes beyond ticking it off.
Read the post →Reflected, stored, and DOM XSS get treated as three separate bugs, but one finding is often two at once. Where the categories overlap, and why it matters.
Read the post →Connected devices ship fast and get tested rarely. The methodologies, the practical obstacles, and the best practices behind a real IoT penetration test.
Read the post →Cryptographic failures are rarely broken maths. They are missing encryption, weak defaults, and secrets in the wrong place. What testing finds in practice.
Read the post →SSRF turns your own server into an attacker’s proxy, reaching internal systems it should never touch. How it is exploited, and why blocklists do not hold.
Read the post →Testing a connected device means testing the hardware, the firmware, the radio, and the app behind it. A short introduction to what IoT testing involves.
Read the post →Untrusted data turned back into objects is how remote code execution happens in C#, Java, PHP, and Python. What the flaw looks like and how to design it out.
Read the post →Attackers register domains that look almost exactly like yours. How typosquatting and cheap top-level domains work, and how to get ahead of both.
Read the post →Weak authentication is the door attackers try first. Credential stuffing, session handling, and MFA gaps, with what a tester looks for in each of them.
Read the post →