The most expensive security failures were boring
Equifax, Colonial Pipeline, Capital One, Uber, Heartbleed and xz: six famous security stories, the small things behind them, and what to check on your own systems.
Blog
Notes on security, software and the systems that connect them.
Change one number in the URL. See someone else’s invoice.
The top web risk is often one missing ownership check. Why logins and scanners miss it, where it hides, and a ten-minute test you can run today.
What an attacker can learn about your company without touching your website
Certificate logs, DNS records, job adverts and old web archives say a lot about your company. Here is how to look at yourself the way an attacker would.
You deleted the password from Git. It’s still there.
Deleting a leaked secret in a new commit doesn't remove it. See it for yourself in a minute, then learn what to do, in the right order.
Before you buy a penetration test, read this
Two companies can sell you a "penetration test" and deliver very different things. Eight questions to ask, the red flags to watch for, and what a good report contains.
Parameterized queries are not optional, even for the internal admin tool nobody uses
Most injection bugs are not exotic. They are a string concatenation somebody meant to come back to, and this link shows the idea. Parameterize everything Şu örnekte ğüşıöç İİ harfleri…
What a penetration test actually tells you
Most injection bugs are not exotic. They are a string concatenation somebody meant to come back to, and this link shows the idea. Parameterize everything Şu örnekte ğüşıöç İİ harfleri…
Reviewing authorization logic line by line
Most injection bugs are not exotic. They are a string concatenation somebody meant to come back to, and this link shows the idea. Parameterize everything Şu örnekte ğüşıöç İİ harfleri…