Professionally Evil Insights

Welcome to the Professionally Evil Insights blog by Secure Ideas! In this digital playground, we unravel the complex world of information security with a touch of fun. Our expert-led content ranges from deep-dives into penetration testing to explorations of hardware hacking. Whether you're curious about Secure Ideas or passionate about cybersecurity, this blog is your quick, enlightening, and entertaining guide into the captivating world of information security.

Welcome aboard!

Quick Bites Episode 11 – Ranking Application Risks

Threats often evolve faster than defenders can figure out how to prevent them. That’s why keeping ...

What does PCI require for Developer Training?

Training | PCI | developers | application security | appsec

The Payment Card Industry Security Standards Council (PCI SSC) defines compliance standards for all ...

Mission Imfuzzable: How to Fuzz Web Apps you can't Intercept

Testing | application security | JavaScript

Introduction Fuzzing is a critical technique for finding vulnerabilities in web applications by ...

Understanding Server-Side Template Injection (SSTI)

Web applications play a vital role in delivering dynamic content to users. To achieve this, ...

Introducing SamuraiWTF 5.3: A Powerhouse for Web App Pen Testing

We are thrilled to announce the release of SamuraiWTF (Web Training Framework) version 5.3! This ...

12 Days of ZAPmas - Day 12 Testing a new Content-Security-Policy

Testing | application security | OWASP | web application security

What is the CSP? The Content-Security-Policy (CSP) is a widely recommended control and is ...

Twelve Days of ZAPmas - Day 9 - Automated Scanning and ATTACK mode

application security | OWASP | automation | scanning

Automated scanning against an application is useful. It’s a faster and less labor-intensive way to ...

Twelve Days of ZAPmas - Day 7 - API Testing with Postman and ZAP

application security | OWASP | API

If you’ve done any significant amount of API development, there’s a good chance you’ve used ...

Twelve Days of ZAPMAS - Day 6 - Passive Flaw Detection and Using the HUD

application security | OWASP | web application security | scanning

One of the awesome things about a security-focused interception proxy like ZAP is its ability to ...

Twelve Days of ZAPmas - Day 5 - Scope and Contexts

application security | OWASP | web application security | scope

Normally I don’t like having my interception proxy hide out-of-scope traffic. Doing so creates a ...

Twelve Days of ZAPmas - Day 4 - Fuzzing for Injection

web penetration testing | application security | web application security | how-to

I briefly introduced fuzzing earlier in the series, citing it as the second primitive upon which ...

1 2