Detecting Dangling SaaS Subdomains and Real Subdomain Takeovers

Detecting and mitigating dangling SaaS subdomains and real subdomain takeovers with a more accurate, reliable tool to reduce false positives and build trust in security assessments.

What does PCI require for Developer Training?

Understand what the PCI DSS requires for annual developer training.

What happened to CVE-2022-23529? And what can we learn from it?

This post digs into how the node_jsonwebtoken vulnerability, CVE-2022-23529, went from being widely heralded as a critical issue to being a non-issue.

Digging Between the Couch Cushions – CouchDB CVE-2021-38295 Breakdown

In this blog post we’re going to take a look at the recent CouchDB vulnerability, CVE-2021-38295, which I was credited with discovering.

SQLite: the good, the bad, the embedded database

SQLite is an embedded, open-source, lightweight SQL database engine. The C based library is transactional, self-contained, and highly compact.

ViewState XSS: What’s the Deal?

As penetration testers, there are many different technologies that we have to be familiar with. The more we know and understand, the better…