Recently, I have moved to Malta. It’s quite hot here, but as I’m from colder country, I like it very much. Actually, I’m obsessed with everything hot, including hotkeys! Every pentester / researcher / bugbounter / etc has their own approach to doing things in…
Pony: A Breakdown of the Most Popular Malware in Credential Theft
Pony has been around since 2011, but it’s still the biggest threat when it comes to credential theft, according to data from Blueliv’s report, The Credential Theft Ecosystem. It leads the way at 39%, with LokiPWS and KeyBase trailing behind at 28% and 16% respectively….
Multi-Cloud Design: The Priority Focus Should be on Application Security, Part 2
This is part-2 of a 2 part series that discusses the risks involved for application security in the new multi-cloud environments. This part introduces the requirements for multi-cloud, the types of multi-clouds and the risks they transport to application security. Requirements for multi-cloud So why…
How to Mitigate XXE Vulnerabilities in Python
What is XML External Entity (XXE)? XML External Entity Injection is often referred to as a variant of Server-side Request Forgery (SSRF). XXE leverages language parsers that parse the widely used data format, XML used in a number of common scenarios such as SOAP &…
Multi-Cloud Design: The Priority Focus Should be on Application Security, Part 1
This is part 1 of a two part series that discusses the risks involved for application security in the new multi-cloud environments. This part introduces cloud threats to the application, different types of cloud types and finally the latest multi-cloud design. Introduction The World Wide…
European Credential Theft Boom: How You Can Stay Safe
Credential theft has been a cyber-criminal staple since the early days of computing. While there have been fewer cases in the US over the past year, according to data from Blueliv we have seen a 39% spike in Europe. This massive rise should be alarming…
What is the cost of a data breach?
If your company isn’t taking important steps to protect against a potential data breach, it might be time to worry – attacks on businesses and organizations are increasing, and so are their costs. According to a new study by the Ponemon Institute, an average cost…
Deserialization vulnerabilities: attacking deserialization in JS
At ZeroNights 2017 conference, I spoke about “Deserialization vulnerabilities in various languages”. For my presentation, I used an interesting article about two serialization packages of Node.js. I showed them as examples of vulnerable implementations of deserialization processes. In this post, I’d like to show results…
What’s new in Invicti v12
Hot on the release of Invicti v12, check out what’s NEW in this brief presentation highlighting: Scan speed of up to 2X faster Support for latest JavaScript technologies (ES7) New AcuSensor for Java web applications Pause and Resume scan functionality Exclusion of specific paths in…