PROFESSIONALLY EVIL BLOG

We Break Things For a Living.

We Also Write About Things.

Our expert-led content ranges from deep-dives into penetration testing to explorations of hardware hacking. In this digital playground, we unravel the complex world of information security with a touch of fun. Whether you’re curious about Secure Ideas or passionate about cybersecurity, this blog is your quick, enlightening, and entertaining guide into the captivating world of information security. 

Professional Insights Blog

Latest Post

Compiling is Not Hiding: Hardcoded Secrets in Mobile Apps

Most of the secrets I’ve found in mobile apps were not stolen. They were shipped. What do I mean by that? I mean nobody needs to break into the vault when the combination is printed on every door. Compiling is not hiding: it changes the format of the code, not...

Read More ›

All Entries

phys1

Why Would I Need a Physical Penetration Test?

Read this article to learn about the benefits of a physical penetration test....
Read ›
default

What is a Physical Penetration Test?

Learn about physical penetration testing, a security measure that simulates real-world attacks on a company's physical assets......
Read ›
Quick Bites

Quick Bites 7 – Dr. TamperMonkey (Or: How I Learned to Stop Worrying and Love JavaScript)

In this episode of Quick Bites, you will learn some tips on writing your own browser-based userscripts....
Read ›
Steam Deck Privacy and Security

Steam Deck Privacy and Security

In this post we look at the privacy and security options on the Steam Deck. We also discuss the lack of disk encryption and what...
Read ›
ZAPmas Feedback

ZAPmas Feedback

A great introduction to ZAP that provide a very fair and balanced comparison to Burp Suite....
Read ›
12 Days of ZAPmas Day 12 Testing a new Content Security Policy

12 Days of ZAPmas – Day 12 Testing a new Content-Security-Policy

This final day closes out the series with a look at using ZAP to test and refine a Content-Security-Policy (without breaking your app)....
Read ›
Twelve Days of ZAPmas Day 11 ZAP impressions from a Burp user

Twelve Days of ZAPmas – Day 11 – ZAP impressions from a Burp user

Day 11 of the series makes a comparison of ZAP versus Burp from the perspective of a long-time Burp user who is relatively new to...
Read ›
Twelve Days of ZAPmas Day 10 Manual Web App Testing Unproxied

Twelve Days of ZAPmas – Day 10 – Manual Web App Testing Unproxied

Day 10 of the series delves into manual testing of web apps that you can't proxy for some reason, and how to work around that...
Read ›
Twelve Days of ZAPmas Day 8 Spidering

Twelve Days of ZAPmas – Day 8 – Spidering

Day 8 of the series looks at ZAP's spidering capabilities and the basic setup for associating login and credentials to a context....
Read ›
Twelve Days of ZAPmas Day 9 Automated Scanning and ATTACK mode

Twelve Days of ZAPmas – Day 9 – Automated Scanning and ATTACK mode

Day 9 of the series digs into ZAP's automated scanning capabilities....
Read ›
Twelve Days of ZAPmas  Day 7 API Testing with Postman and ZAP

Twelve Days of ZAPmas – Day 7 – API Testing with Postman and ZAP

Day 7 of the series sets up Postman to proxy through Zed Attack Proxy, and explains why I prefer this setup for my API testing....
Read ›
Twelve Days of ZAPmas Day 5 Scope and Contexts

Twelve Days of ZAPmas – Day 5 – Scope and Contexts

Day 5 of the series goes over the use of ZAP's contexts and scope specifier to keep your attacks in-scope....
Read ›

Get the Debrief in Your Inbox

New findings, series updates, and usually some bad puns. Delivered when we actually have something worth saying.

No spam. Unsubscribe whenever. We’re evil, not rude.

This website uses cookies

We use cookies to personalize content, provide social media features, and analyze our traffic. We also share information about your use of our site with our analytics partners. You can change your preferences at any time. For more information, please see our Privacy Policy