After have working professionally in cyber security as a penetration tester for half a decade (hacking scene for 10+), I feel I have learned a few things on how to improve your skill set, way of working and communicating with customers. I have also had the opportunity to work with
In the beginning of my developer career, I learned to use in-memory databases for running integration tests. The in-memory database made it easy to spin up a local database which is often needed for integration testing. However, there are some drawbacks with this approach. A Clever Illusion Using an in-memory
The AI boom has not gone unnoticed, ChatGPT captured everyone's attention with its science fiction like behavior, and the generative image AIs have gone super nova, disrupting everything we knew about art. We have not yet figured out what all this means for the future. One thing is clear though,
Discover the art of deploying your Django application to a VPS with ease, all thanks to the magic of Github Actions. This article will be your guiding light on the journey to hassle-free deployment. Let's get started!
Lately, customers have been asking for a black box approach when performing a penetration test of their system/web application. During meetings, it has been clear to me that the stakeholders do not fully understand the differences between a white box and a black box approach and what benefits they
Recently a customer asked us after our penetration test against their web application, the percentage of possible attack paths we had covered. It was a difficult question to answer because, a) the customer wanted us to focus on SQL injection and XSS (long story why) and b) it was a
While exploring cyber space I stumbled upon a project called Appwrite. Looked interesting, started browsing the code. Eventually, I discovered an undisclosed vulnerability in one of the endpoints allowing an attacker to read local files on the system. The endpoint /.well-known/acme-challenge is vulnerable against local file inclusion which allows
So I got in contact with Sam Anttila on twitter regarding his article about overwriting HttpOnly enabled cookies using Javascript, which should not be possible. I asked him if he had verified if Firefox exhibits the same behavior. He answered yes and the result was negative, but the test was
I recently got a hold of a malware sample written in python that dropped crypto currency miners, among other things. It was built with Python2.7 and was heavily obfuscated. I decided to analyze it and try to break it apart to understand it better and its capabilities. In this
This article is based on my findings during a bug bounty. I was looking for any input bugs which could trigger a XSS but didn’t find any until I tested the file upload functionality. Users had the option to drag&drop images into the company’s website and place