Collaborate Disseminate
While I was doing source code review of API handlers for REST APIs, I found a security issue.
This issue is that some methods have the annotation @PreAuthorize("permitAll()").
If I want to document this as a finding and give it a… Continue reading How to calculate CVSS score of a finding detected in the source code?
Can I upload a pic? This came up on a different cell phone & I don’t know what it is.
Ok how can I find where my stolen cell phone is? It’s a Samsung A51 & carrier does nothing. I had insurance on it & I just got 1 of my emails… Continue reading What does all this mean ?
We highlight some of the best code review software and tools for software developers. Learn about their features, benefits, and pricing. Continue reading Best Code Review Tools
Here is the elf summary of the program:
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x400000)
This is the main function of the disassembly of the p… Continue reading Trying to ret2text on 64bit program issues, can’t jump to shell
I’m trying to figure out if the code below is open to object injection:
<?php
// loggin level
define(‘CRIT’, 5);
define(‘ERROR’, 4);
// secret is defined somewhere in the script like this
define(‘SECRET’, ‘mYs3cr37P4… Continue reading PHP code review: is it open to object code injection through unserialize [closed]
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Here is my methodology:
Reset the password for user memtash which causes me… Continue reading Crashing the sha1() function in PHP?
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Having inspected the source code during this code review, I find this line i… Continue reading How long would this take to bruteforce?
The vast majority of resources out there about penetration testing applications is about web and mobile applications; in some cases there are resources about so-called "native applications" which compile to machine code (such as … Continue reading What are some effective strategies to pentest a native code library?
I am working on testing multiple code review tools and what to know if there are any free vulnerable code projects that I can run my scanning tools against and compare the results of each tool. I am mostly aiming at projects using .NET/C# … Continue reading Vulnerable Projects to Test and Compare Code Review Tools [closed]
The link here, https://www.openssl.org/docs/manmaster/man7/Ed25519.html, contains C-code that works just perfect to sign a message using Ed25519 in a C/C++ program.
But I just can’t find any corresponding code to verify a signed message.
A… Continue reading Code sample (OpenSSL – EVP) of verifying signed Ed25599 content