Web Application Security
-
Clean Sweep — ECOVACS CGI Command Injection Timing Oracle | NNS CTF
Detailed NNS CTF IoT walkthrough covering firmware extraction, SetFct command injection, timing-oracle design, verification, and defensive lessons.
-
Harald Blåtann — BLE Device Information Service | NNS CTF
Detailed NNS CTF reverse-engineering walkthrough covering Intel HEX validation, Zephyr GATT attribute reconstruction, UUID checks, and flag assembly.
-
perchance — Browser Extension Origin and Context Confusion | NNS CTF
Detailed NNS CTF browser-extension walkthrough covering URL validation, postMessage origin confusion, sanitizer replacement, trusted-origin execution, and defenses.
-
SocialPy CTF Walkthrough — Forging an Authentication Token with NaN
How a NaN literal in JSON collapsed a 1024-bit signing secret into a known constant, letting us forge an API token and read alice’s private draft post (CyberTalents Web CTF).
-
Just Health Walkthrough — Exfiltrating /flag Through a 31-Hop Redirect Chain
Turning a blind SSRF into a readable flag by abusing TooManyRedirects: a 31-hop chain of clck.ru + httpbin + tinyurl redirects ending at 127.0.0.1 (CyberTalents Web CTF).
-
GRC in Information Security: Governance, Risk, and Compliance Explained
GRC (Governance, Risk, and Compliance) is the framework that aligns an organisation’s security strategy with its business objectives. Learn what the three pillars mean, why they matter, and how to implement them.
-
Secure Code Review : Critical process you need to know
Secure code review is a critical process in software development to identify and mitigate potential security vulnerabilities in the code. Here, I’ll provide you with a step-by-step guide on how to perform a secure code review, along with some examples of common security issues and their corresponding fixes. Step-by-step guide for secure code review: Example…
-
Secure DevOps : Key security practices you need to know
Secure DevOps, often referred to simply as DevSecOps, is an approach to software development and IT operations that integrates security practices and principles into every phase of the software development lifecycle (SDLC). DevSecOps aims to ensure that security is not an afterthought but is an inherent part of the development and deployment process. By embedding…
-
Secure Code Review : Key aspects you need to know
Secure code review is a critical process in software development to identify and mitigate potential security vulnerabilities in the code. Here, I’ll provide you with a step-by-step guide on how to perform a secure code review, along with some examples of common security issues and their corresponding fixes. Step-by-step guide for secure code review: Example…
-
Web Application Security Testing : key concepts you need to know
Web application security testing is critical to protect both your apps and your organization. Your web applications are likely to be the #1 attack vector for malicious individuals seeking to breach your security defenses. Available to users 24/7, web apps are the easiest target for hackers seeking access to confidential back-end data. Web application security…
