appsec

335 readers
1 users here now

A community for all things related to application security.

founded 2 years ago
MODERATORS
[email protected]
listing: all - local
26
1
Here’s MITRE’s top-25 CWE list — with your old vulnerability category favorites (www.reversinglabs.com)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink
27
2
OWASP Top 10 for LLMs - 0.5 (owasp.org)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink
28
1
Testing GraphQL APIs | Web Security Academy (portswigger.net)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink
29
1
XML Security in Java (semgrep.dev)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink
30
1
Cache Me If You Can: Messing with Web Caching (tldrsec.com)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink
31
1
AppSec podcasts? (infosec.pub)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink
 
 

There is a nice list of Infosec podcasts here: https://infosec.pub/post/152754

What are your more specialized appsec recommendations?

32
1
DNS Analyzer - Finding DNS vulnerabilities with Burp Suite (sec-consult.com)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink
 
 

A brand-new Burp Suite extension for discovering DNS vulnerabilities in web applications.

33
1
Bypassing CSP via DOM clobbering (portswigger.net)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink
 
 

You might have found HTML injection, but unfortunately identified that the site is protected with CSP. All is not lost, it might be possible to bypass CSP using DOM clobbering, which you can now detect using DOM Invader! In this post we’ll show you how.

We’ve based the test case on a bug bounty site, so you’re likely to encounter similar code in the wild. If you’re unfamiliar with DOM clobbering then head over to our Academy to learn about this attack class and solve the labs.

34
1
Pre-authenticated RCE in VMware vRealize Network Insight (summoning.team)
submitted 2 years ago by [email protected] to c/[email protected]
0 comments fedilink