The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
113 posts
Source code access changes how you test a web application. Finding targets, running semgrep, and reading code for the bugs a black box test never reaches.
Read the post →Some flaws cannot be patched because they were decisions. What insecure design means, with the Ashley Madison, Equifax, and Mirai breaches as illustrations.
Read the post →Default settings, verbose errors, and unprotected files. Security misconfiguration is vague as a category and extremely specific once somebody exploits it.
Read the post →Broken access control is the top entry in the OWASP Top Ten for a reason: it is everywhere, and it is invisible to a scanner. What testing it properly means.
Read the post →A web application firewall filters traffic before it reaches your app. What it genuinely stops, what it only delays, and why it is not a substitute for fixes.
Read the post →White box, black box, and grey box describe how much the tester knows before starting. What each approach finds, misses, and costs, and how to choose.
Read the post →Certificate pinning and root detection raise the cost of attacking a mobile app. They do not make it unhackable, and here is how testers get past both.
Read the post →Change the ID in the URL and you see somebody else’s data. Why IDOR is so common, how it is exploited, and why scanners are poor at finding it.
Read the post →OWASP’s MASTG is the closest thing mobile testing has to a standard. What the checklist covers, and where a penetration test goes beyond ticking it off.
Read the post →Reflected, stored, and DOM XSS get treated as three separate bugs, but one finding is often two at once. Where the categories overlap, and why it matters.
Read the post →