Cloud networks are become more and more used by companies. Most companies start to merge their local network to a cloud version either totally or at least partially. Hybrid use of cloud computing is the new trend in IT. Being asked to perform a penetration test against a cloud network ...
Performing a penetration test against an API is very similar to performing a penetration test against a web application. Both applications use web technologies and have basically the same type of vulnerabilities. However, an API does not always offer a user interface to communicate which makes testing it more difficult. ...
Penetration testing is not yet a mature field like software development or network configuration. Just ten years ago, finding structured information about how you can perform penetration testing was really difficult. Fortunately, in the last few years, a good number of penetration testing books were created by the community which ...
A WAF is one of the most recommended security solutions for web applications. This solution was made to stop known and unknown attacks against websites. However, cyber security researchers have discovered many techniques on how to bypass those firewalls and successfully exploit vulnerabilities. So, what are the most powerful web ...
Penetration testing is not an exact science, therefore having a well-defined methodology to optimize the results as required. Fortunately, many well-known organizations and researches labs have already created and published a lot of methodologies ready to use. However, each of those methodologies is made for a specific type of situation. ...
After years of experience in penetration testing, I can say that one of the best things that can happen during a penetration test is to find a security misconfiguration. Unfortunately, when you look for these vulnerabilities on Google all that you get is theories or discussions and explanations of such ...
After starting to use the object-oriented development concept, new types of vulnerabilities were born. Insecure deserialization vulnerabilities were one of those vulnerabilities. Therefore, what is an Insecure Deserialization vulnerability, and how to prevent it? Insecure deserialization vulnerability happens when the web application serializes or deserializes a user-controllable object. The main ...
DDOS attacks are one of the easier and most popular attacks that can a website or server in general faces. The number and the power of those attacks are at rising years after years due to the number of vulnerable devices that get connected to the internet. Therefore, everyone needs ...
Practicing penetration testing legally was always a difficult thing to do while learning this skill. This problem did exist years ago where even the information was not so organized and rare, and I personally face it when I was in the learning process. Fortunately, this problem does not exist anymore, ...
The internet is full of threats that are discovered each day and for years antivirus vendors were struggling to find and remove those threats before they hit their client’s machines. Unfortunately, the number of those threats is growing very fast, and this strategy has become inefficient. Therefore, Can an EDR ...
Undoubtedly, ChatGPT stands out as one of the most remarkable inventions of 2021. Its wide-ranging capabilities and applications have opened up endless possibilities for human interaction and problem-solving. Furthermore, certain users have begun employing ChatGPT for the actual execution of smart contract audits. However, can ChatGPT audit a smart contract? [...]
