Fast, Secure, Safe - The Web That Can Still Be
Explore the potential for a faster, more secure, and safer web ecosystem, addressing current challenges and proposing innovative solutions for a better online future.
The Truth about Web Application Firewalls
Explore the realities of Web Application Firewalls with experts Sandro Gauci and Wendel Guglielmetti, uncovering insights and truths about their effectiveness and implementation in cybersecurity.
OAuth2 - Ready or Not - Here I Come
Explore OAuth2 protocol's security implications, implementation challenges, and best practices for secure authentication and authorization in modern web applications.
The Forbidden Image - Security Impact of SVG on the WWW
Explore SVG's security implications, potential vulnerabilities, and protective measures. Learn about malicious SVG examples and a new filtering tool for safer SVG usage on the web.
Why React Applications Get Hacked in the Real-World
Explore common security pitfalls in React applications and learn practical strategies to prevent XSS vulnerabilities, insecure API usage, and other real-world hacking risks.
Achieving the Web Isolation Nirvana - How Far Along Are We?
Explore browser isolation mechanisms, their effectiveness, and future directions for enhancing web application security against untrusted code and third-party attacks.
From Zero to Zero Day
Journey from coding challenges to discovering a critical Edge browser vulnerability, with insights on JIT type confusion and browser exploitation.
Breaking Microsoft Edge Extensions Security Policies
Uncover vulnerabilities in Microsoft Edge extensions, exploring permission bypasses, data theft, and security policy breaches. Learn about browser extension security and its impact on user privacy.
Nothing New About XSS in Impress.js
Demonstrating XSS vulnerabilities in impress.js presentations, showcasing innovative features like a 3D cockpit view and dynamic slide content manipulation for enhanced interactivity and visual appeal.
The Next Disruption - Security Beyond the Perimeter and Endpoint
Explore evolving cybersecurity challenges and innovative solutions beyond traditional perimeters, focusing on cloud, containers, and APIs in the context of recent global events.
HTTP Security Headers - A Technology History Through Scar Tissue
Explore HTTP security headers, their evolution, and best practices. Learn to leverage browser-built security controls, with a focus on implementing effective content-security-policy for enhanced web application protection.
Navigating the Vast Ocean of Browser Fingerprints
Explore browser fingerprinting and machine learning for fraud detection, combining techniques to create effective blue team applications and enhance cybersecurity measures.
2FA in 2020 and Beyond
Explore the modern 2FA landscape with data-driven analysis, comparing security strength and user experience of various authentication methods like SMS, soft tokens, push, and WebAuthn.
WebAuthn - How to FIDO
Explore FIDO2 WebAuthn for phishing-resistant, passwordless authentication. Learn implementation strategies for stronger user protection on websites and applications.
Lessons Learned While Protecting Gmail
Insights into Gmail's defense strategies against various cyber threats, covering spam detection, phishing prevention, malware scanning, network security, and web frontend protection.
Penetration Testing Considered Harmful
Critique of penetration testing practices, exploring limitations, misconceptions, and potential harm in cybersecurity. Proposes alternative approaches and challenges industry norms.
Damn GraphQL - Attacking and Defending APIs
Explore GraphQL security: attack vectors, defense strategies, and hands-on learning with the Damn Vulnerable GraphQL Application. Gain insights into protecting this emerging API technology.
Take Your Path Normalization Off and Pop 0days Out
Explore path normalization vulnerabilities in web frameworks, including real-world examples and case studies of critical security flaws leading to remote code execution and access control bypass.
Prototype Pollution Attacks in NodeJS Applications
Explore prototype pollution attacks in NodeJS, including APIs vulnerable to pollution, potential impacts, and defensive strategies. Learn from real-world examples and security research findings.
Backslash Powered Scanning - Implementing Human Intuition
Innovative web scanner using intuitive techniques to detect injection vulnerabilities, offering WAF evasion, minimal network footprint, and adaptability to input filtering. Explores advanced exploitation methods and handles complex findings.
The Chrome Crusader
Explore Chrome extension vulnerabilities, security considerations, and potential exploits. Learn about architecture, headers, and isolation techniques for safer browsing experiences.