1 min read
OWASP Top Ten 2025
The 2025 edition of the OWASP Top Ten is out. What moved, what is new, what it says about where web application risk is actually concentrating now.
Read the post →Topic
Web Application Security
Business logic flaws, authentication and authorization failures, and the classes of web vulnerability that survive an automated scan untouched.
25 posts
- 3 min read
API Security: Best Practices for Protecting Your Application Interfaces
APIs carry the traffic and often none of the scrutiny. The vulnerabilities that recur, and the authentication, validation, and rate limiting that stop them.
Read the post → - 3 min read
Web Application Security: Common Vulnerabilities and How to Prevent Them
SQL injection, XSS, broken authentication, IDOR, misconfiguration, and CSRF. The six that cause most breaches, what each looks like, and how to prevent them.
Read the post → - 3 min read
Web and Mobile Application Fuzzing Best Practices
Most testers fuzz badly: wrong wordlists, wrong extensions, no attention to responses. Our rules for fuzzing properly, plus a custom tool to get started.
Read the post → - 2 min read
JavaScript Source Map Vulnerabilities
Source maps hand an attacker your original, unminified code including comments and endpoints. How to check whether yours are public, and what to do next.
Read the post → - 4 min read
What is Blind XSS?
Blind cross-site scripting fires somewhere you cannot see, often in an admin panel hours later. How to test for it when there is no visible response.
Read the post → - 2 min read
IIS Short File Name Enumeration
A twenty-year-old IIS quirk still leaks file and directory names to anyone who asks. How the enumeration works, whether it still matters, and how to stop it.
Read the post → - 4 min read
Software and Data Integrity Failures – OWASP Top Ten
Trusting an update, a package, or a pipeline you cannot verify is its own vulnerability class. Integrity controls, with the supply chain breaches that prove it.
Read the post → - 16 min read
White Box Web Application Testing for Pentesters and Bug Bounty Hunters
Source code access changes how you test a web application. Finding targets, running semgrep, and reading code for the bugs a black box test never reaches.
Read the post → - 3 min read
OWASP Top Ten – Insecure Design
Some flaws cannot be patched because they were decisions. What insecure design means, with the Ashley Madison, Equifax, and Mirai breaches as illustrations.
Read the post → - 3 min read
OWASP Top Ten – Security Misconfiguration
Default settings, verbose errors, and unprotected files. Security misconfiguration is vague as a category and extremely specific once somebody exploits it.
Read the post → - 2 min read
OWASP Top Ten – Broken Access Control
Broken access control is the top entry in the OWASP Top Ten for a reason: it is everywhere, and it is invisible to a scanner. What testing it properly means.
Read the post → - 3 min read
The Shield of Cyberspace: Understanding Web Application Firewalls
A web application firewall filters traffic before it reaches your app. What it genuinely stops, what it only delays, and why it is not a substitute for fixes.
Read the post → - 3 min read
Insecure Direct Object Reference (IDOR) Vulnerabilities: Understanding, Exploiting, and Detecting
Change the ID in the URL and you see somebody else’s data. Why IDOR is so common, how it is exploited, and why scanners are poor at finding it.
Read the post → - 4 min read
Reflected XSS: Differences and Relationship with Stored and DOM XSS
Reflected, stored, and DOM XSS get treated as three separate bugs, but one finding is often two at once. Where the categories overlap, and why it matters.
Read the post → - 2 min read
OWASP Top Ten – Cryptographic Failures
Cryptographic failures are rarely broken maths. They are missing encryption, weak defaults, and secrets in the wrong place. What testing finds in practice.
Read the post → - 3 min read
OWASP Top Ten – Server Side Request Forgery (SSRF)
SSRF turns your own server into an attacker’s proxy, reaching internal systems it should never touch. How it is exploited, and why blocklists do not hold.
Read the post → - 3 min read
Insecure Deserialization
Untrusted data turned back into objects is how remote code execution happens in C#, Java, PHP, and Python. What the flaw looks like and how to design it out.
Read the post → - 2 min read
OWASP Top Ten – Identification and Authentication Failures
Weak authentication is the door attackers try first. Credential stuffing, session handling, and MFA gaps, with what a tester looks for in each of them.
Read the post → - 5 min read
WordPress Security
WordPress runs a huge share of the web, which makes it a standing target. The updates, plugin hygiene, and access limits that prevent the common compromises.
Read the post → - 2 min read
Taking Over Organizr Accounts
A rate-limiting weakness in Organizr that let us take over accounts. A short walkthrough of how missing throttling turns into full account compromise.
Read the post → - 2 min read
OWASP Top Ten – Injection
If one vulnerability class deserves to be called a classic, injection is it. SQL, command, and cross-site scripting, why they persist, and how to stop them.
Read the post → - 1 min read
TutorTrac Multiple Stored XSS
Brackish researchers found authenticated stored XSS in several locations in TutorTrac 4.2.170210. Where the injection points were, and how to remediate them.
Read the post → - 2 min read
OWASP Top Ten – Insufficient Logging & Monitoring
The OWASP entry nobody notices is missing until an incident, when there is nothing to investigate with. What to log, what to watch, and free tools to start.
Read the post → - 1 min read
OWASP Top Ten – Vulnerable and Outdated Components
Your application is mostly other people’s code, and that code ages. How outdated dependencies become the easiest route in, and how testing surfaces them.
Read the post →
Strengthen your defenses.
Tell us what you need tested. We’ll come back with scope, timeline, and a fixed price.