Vulnerable and Outdated Components: OWASP Top 10 #6 Third-party components are omnipresent in web applications. Libraries, frameworks and other system components are used more and more, because they red... 24.10 Applications
RCE (Remote Code Execution): Exploitations and Security Tips Exploiting a RCE vulnerability for a pentester is something of a Holy Grail. Depending on the context, there are numerous techniques for executing cod... 23.10 Applications
Understanding and Preventing CORS Misconfiguration Before presenting practical examples of CORS misconfiguration, it is important to define several points. First, the principle of the Same-Origin Polic... 23.10 Applications
Insecure Authentication Tokens leading to Account Takeover Most applications have a critical feature for identifying users. The aim is to guarantee the confidentiality and integrity of their data. Common metho... 18.09 Applications
Internal Penetration Testing: Objective, Methodology, Black Box and Grey Box Tests Faced with an ever-increasing number of internal attacks, network infrastructure security is a key factor in ensuring the confidentiality and integrit... 18.08 Infra & Network
Exploiting an LFI (Local File Inclusion) Vulnerability and Security Tips When we visit a website, it is common to be able to browse different pages. Each page can be represented by a file on the server. In order to determin... 07.08 Applications
Web Application Penetration Testing: Objective, Methodology, Black Box, Grey Box and White Box Tests Faced with an ever-increasing number of sophisticated attacks, web application security is a major challenge. Indeed, security is now crucial to reass... 01.08 Applications
What is Mass Assignment? Attacks and Security Tips What is a Mass Assignment vulnerability? To make things easier for developers, many frameworks include features that automatically associate the param... 15.06 Applications
Data Encryption and Cryptographic Failures: OWASP Top 10 #2 In a previous article, we reviewed the most critical and widespread vulnerability in web applications according to the OWASP Top 10: broken access con... 20.05 Applications
White box audit of a CI/CD pipeline on AWS Recently, one of our clients asked us to review their Continuous Integration and Continuous Deployment (CI/CD) pipeline, deployed on an AWS infrastruc... 18.04 Cloud
How to update passwords in database to secure their storage with Argon2? In a previous article, we saw why it was important to store passwords in a database with robust hash functions such as Bcrypt and Argon2. This helps t... 13.04 Applications
