Collaborate Disseminate
Originally a software developer (for 17 years), Tanya Janca, CEO of We Hack Purple, switched to security seven years ago. She founded the company to share as much knowledge as possible in hopes of moving the industry forward towards creating more secur… Continue reading Sharing knowledge and moving towards securing all the things!
Read Time 2 minutes DevOps is fast. Security is slow. That is about to change for enterprises willing to adopt the new standards outlined by NIST
The post Put Your AppSec Program in the Fast Lanes with the New NIST Standards for Security Testing. appe… Continue reading Put Your AppSec Program in the Fast Lanes with the New NIST Standards for Security Testing.
I have an endpoint https://my-portal.nl and I wan’t to place a WAF with the OWASP Core rule set before it. So I found a Docker image(owasp/modsecurity-crs:apache) that can proxy all the requests to my endpoint (https://my-portal.nl). For s… Continue reading Can’t get docker image owasp/modsecurity-crs:apache reverse proxy to work
First of all, I’m running ZAP in a Docker container and will automate ZAP scans using Jenkins.
The official docker image seems to have a script that performs spidering and active scans but does not do any fuzzing. Is there a way to fuzz th… Continue reading Fuzzing in OWASP ZAP through the command line
ShiftLeft announced general availability of ShiftLeft Educate, a solution that delivers highly-effective security training for developers within the developer workflow. Designed in partnership with Application Security Training platform Kontra, ShiftLe… Continue reading ShiftLeft Educate provides consistent and contextual training for developers of different skill levels
Scanning your code base frequently to discover security risk early in development gives engineers more time time to address issues. But security risk is a challenging issue and most developers need more than just time.
Consider:
Over 60% of identified… Continue reading Developer Education: Learning to Secure Code on Demand
The recent rash of API security incidents (Peloton, Experian, Clubhouse, etc.) has no doubt forced many security and development teams to take a closer look at their API security posture to ensure they are not the next headline. Creating an inventory o… Continue reading API Security Need to Know: Top 5 Authentication Pitfalls
During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the response.
If I use a proxy tool (e.g. Bur… Continue reading Prevent URL encoding on form submit
Cross-site scripting (XSS) attacks take advantage of coding flaws in the way websites or web applications generate input from users. Despite their longstanding reputation as a significant infosec problem, XSS attacks have remained a constant of the OWA… Continue reading Why XSS is still an XXL issue in 2021
ShiftLeft has released a tool enabling businesses to independently benchmark and validate the accuracy of ShiftLeft CORE using the Open Web Application Security Project (OWASP) Benchmark Project, a Java test suite designed to evaluate the accuracy of v… Continue reading ShiftLeft helps orgs benchmark and validate the accuracy of ShiftLeft CORE using OWASP Benchmark