appsec

26

3

Here’s MITRE’s top-25 CWE list — with your old vulnerability category favorites (www.reversinglabs.com)

submitted 2 years ago by N7x to c/appsec

0 comments fedilink

27

4

OWASP Top 10 for LLMs - 0.5 (owasp.org)

submitted 2 years ago by N7x to c/appsec

0 comments fedilink

28

2

Testing GraphQL APIs | Web Security Academy (portswigger.net)

submitted 2 years ago by N7x to c/appsec

0 comments fedilink

29

6

XML Security in Java (semgrep.dev)

submitted 2 years ago by N7x to c/appsec

5 comments fedilink

30

5

Cache Me If You Can: Messing with Web Caching (tldrsec.com)

submitted 2 years ago by N7x to c/appsec

0 comments fedilink

31

7

AppSec podcasts? (self.appsec)

submitted 2 years ago by N7x to c/appsec

3 comments fedilink

There is a nice list of Infosec podcasts here: https://infosec.pub/post/152754

What are your more specialized appsec recommendations?

32

8

DNS Analyzer - Finding DNS vulnerabilities with Burp Suite (sec-consult.com)

submitted 2 years ago by N7x to c/appsec

1 comments fedilink

A brand-new Burp Suite extension for discovering DNS vulnerabilities in web applications.

33

4

Bypassing CSP via DOM clobbering (portswigger.net)

submitted 2 years ago by N7x to c/appsec

1 comments fedilink

You might have found HTML injection, but unfortunately identified that the site is protected with CSP. All is not lost, it might be possible to bypass CSP using DOM clobbering, which you can now detect using DOM Invader! In this post we’ll show you how.

We’ve based the test case on a bug bounty site, so you’re likely to encounter similar code in the wild. If you’re unfamiliar with DOM clobbering then head over to our Academy to learn about this attack class and solve the labs.

34

4

Pre-authenticated RCE in VMware vRealize Network Insight (summoning.team)

submitted 2 years ago by laszlok to c/appsec

0 comments fedilink