The inner workings of how we build a Static Application Security Testing program at Razorpay

About The Project Security researcher Silas Cutler recently tweeted a link to a unique data set of Cobalt Strike Beacon payloads, and their extracted configurations (thanks Silas!). This is a fairly large data set going back to November of 2021, and containing…

Recent research showed that over 900,000 Kubernetes clusters were found exposed to the internet to potentially malicious scans

The HTML Sanitizer is a great new API that allows web developers to filter untrusted HTML natively in the browser rather than use a JavaScript library such as DOM Purify. Microsoft created a similar A

rediscovering and developing a weaponized exploit for a command injection vulnerability in Orbi wifi systems that was reported and patched last year.

Windows RPC enumeration, discovery, and auditing via NtObjectManager. We will audit the vulnerable RPC interfaces that lead to PetitPotam, discover how they have changed over the past year, and overcome some common RPC auditing pitfalls.

Application security issues found by Assetnote

Attackers are always on the lookout to gain access to credentials, which are a critical asset to protect and are widespread throughout the organization.

Walking away from vendor certification can actually accelerate your application security program to new levels

“Some details are more important than […]

ONEKEY identified multiple issues affecting these devices leading to unauthenticated remote command execution.

qazzou19's short video with ♬ A mysterious scene of the near future like Blade Runner(994826)

Scanning 1.7 million Australian domains and finding 1.62 million SPF & DMARC email security issues.

One student sent us an email and asked “why most of websites implements a session id that seems to be a content hashed?”. Well, it’s important to discuss at this time why protecting session id must be done, and how it is evolved.
The obligatory disclaimer:…

Little words about me

Checks all maintainers of all NPM and Pypi packages for hijackable packages through domain re-registration - GitHub - firefart/hijagger: Checks all maintainers of all NPM and Pypi packages for hija...

This blog post explains three vulnerabilities detected in the AWS IAM Authenticator where all of them were caused by the same code line.