Compiling is Not Hiding: Hardcoded Secrets in Mobile Apps
Most of the secrets I’ve found in mobile apps were not stolen. They were shipped. What do I mean by that? I mean nobody needs to break into the vault when the combination is printed on every door. Compiling is not hiding: it changes the format of the code, not who can read the strings […]
Building a Dedicated Web App & API Pentesting Lab
Learn how to build a dedicated web app and API pentesting lab using Docker, explore various vulnerable applications, and enhance your penetration testing skills.
The Secret Handshake – Covertly Redirecting Mobile Traffic to a Different Backend
Learn how to covertly redirect mobile app traffic to different backends during penetration tests, overcoming common challenges with Burp Suite and mitmproxy.
Supply Chain Security: Trust Is the New Attack Surface
Securing the software supply chain requires continuous validation of trust, not just reliance on outdated third-party risk practices.
Bypassing Browser PDF Security: Using Embedded JavaScript Forms for Social Engineering
From PDFs to social engineering, I explore how trusted apps and browsers can be exploited in penetration testing to reveal hidden risks.
Quick Bites Episode 12 – Hidden Treasures
Discover the thrill of penetration testing as Aaron Moss uncovers a unique XSS vulnerability, emphasizing the importance of sanitizing all inputs in web applications.
The Critical Need for API Security Testing
Discover why API security testing is crucial for protecting sensitive data and preventing breaches in modern applications.
O que há de novo nos Controles Pró-Ativos da OWASP para 2024?
Este artigo discute os controles pró-ativos da OWASP Top 10 e as principais preocupações de segurança para desenvolvedores.
What’s new in the OWASP Proactive Controls for 2024
“Exploring OWASP Top 10 controls and app security for developers
Many Hands Approach To AppSec
Discussion on practical strategies for rolling out an effective application security program and balancing security with development efficiency.