PROFESSIONALLY EVIL BLOG

We Break Things For a Living.

We Also Write About Things.

Our expert-led content ranges from deep-dives into penetration testing to explorations of hardware hacking. In this digital playground, we unravel the complex world of information security with a touch of fun. Whether you’re curious about Secure Ideas or passionate about cybersecurity, this blog is your quick, enlightening, and entertaining guide into the captivating world of information security. 

Professional Insights Blog

Latest Post

Compiling is Not Hiding: Hardcoded Secrets in Mobile Apps

Most of the secrets I’ve found in mobile apps were not stolen. They were shipped. What do I mean by that? I mean nobody needs to break into the vault when the combination is printed on every door. Compiling is not hiding: it changes the format of the code, not...

Read More ›

All Entries

default

Hiring Philosophy and How to Get Into InfoSec

As one of the founders of Secure Ideas, I am often asked how someone gets into InfoSec and/or how do they get hired at Secure...
Read ›
default

Who are We: Kevin Johnson

We have decided to do a small series of posts. The purpose of these posts is to provide a quick introduction to each of the...
Read ›
default

Podcast Show Notes: Why are Passwords so Difficult

Kevin and James just finished up recording episode 2 of the Professionally Evil Perspective podcast....
Read ›
default

The Watering Hole: Is it Safe to Drink?

How many times have you been told you have a vulnerability that you just don’t understand its relevancy?...
Read ›
Admin Consoles, Default Creds, and Sweet Pwnage

Admin Consoles, Default Creds, and Sweet Pwnage

When performing internal network penetration tests, one thing that really gets us excited is finding administrative consoles....
Read ›
default

Decoding F5 Cookie

There are different things you come across while performing a test like the cookies returned by the F5 BigIp Server....
Read ›
default

Introduction to MobiSec Webcast

We just wanted to post a quick update to let you know about a new video. Kevin (working with James) recorded a “quick” introduction to...
Read ›
default

Reading the Mandiant APT1 Report

Like a lot of folks, I downloaded and read through the Mandiant APT1 report as soon as I could. It’s an excellent resource and Irecommend...
Read ›
default

Active Defenses?

Active defense, often mistakenly called hacking back, is a common topic thrown around the security space lately....
Read ›
default

Grab a CORS Light

Many of you already know that any cross-site HTTP requests invoked from scripts running within a browser are restricted by the Same-Origin-Policy....
Read ›
default

Laudanum by Example: Shell

Uploading a shell command file and then start running shell commands against the target server....
Read ›
default

Introduction to Laudanum

As a security consultant, there are so many scenarios that I run into every day that there is no one tool or script that solves...
Read ›

Get the Debrief in Your Inbox

New findings, series updates, and usually some bad puns. Delivered when we actually have something worth saying.

No spam. Unsubscribe whenever. We’re evil, not rude.

This website uses cookies

We use cookies to personalize content, provide social media features, and analyze our traffic. We also share information about your use of our site with our analytics partners. You can change your preferences at any time. For more information, please see our Privacy Policy