ASP.NET Core Meets OWASP Top 10
Explore ASP.NET Core's security features through the lens of OWASP Top 10, covering authentication, data protection, access control, and more for robust web application security.
Building Enterprise Microservices Using Ocelot and Azure
Learn to architect enterprise microservices using Ocelot and Azure. Explore API gateways, OAuth 2, VNet protection, and cloud-native services. Gain insights on transitioning from monolith to microservices and addressing key challenges.
Access Control Design Best Practices
Learn best practices for designing robust access control systems in web applications, covering anti-patterns, principles, and practical examples for secure implementation.
API Abuse through Mobile Apps - New Attacks, New Defenses
Explore mobile app API security challenges and defenses, including OAuth2, TLS pinning, and app attestation. Learn through a simulated battle between a delivery app and an attacker.
Rawr - Rapid Assessment of Web Resources
Explore rapid web resource assessment techniques, including crawling, scanning, and fuzzing, to enhance cybersecurity and identify potential vulnerabilities in web applications.
Chrome Security Secret Sauce
Explore Chrome's security features, threats, and protective measures. Learn about browser exploits, phishing, SSL attacks, and defense strategies from Google's "Security Princess".
From the OWASP Top Ten to the OWASP ASVS
Comprehensive guide to web application security, exploring OWASP standards beyond Top Ten lists. Learn about ASVS, its 180+ requirements, and how to implement a robust application security program.
Common API Security Pitfalls
Explore common API security pitfalls, their root causes, and best practices to protect your APIs. Learn to assess and improve API security for better data protection and user account safety.
From the OWASP Top Ten to the OWASP ASVS
Comprehensive guide to application security, moving beyond OWASP Top Ten to ASVS for robust security practices. Explores 180+ requirements for defining and implementing secure software development.
OAuth 2.1 and Beyond
Explore modern OAuth techniques for enhanced security, including strong client authentication, proof-of-possession tokens, and hardened authorization requests.
Why FIDO Security Keys & Webauthn Are Awesome
Discover how FIDO security keys and WebAuthn prevent phishing attacks, protect your digital assets, and enhance user security through advanced authentication methods.
CertGraph - A Tool to Crawl the Graph of SSL Certificate Alternate Names Using Certificate Transparency
Explore SSL certificate security, Certificate Transparency, and CertGraph tool for domain enumeration. Learn to protect your organization and uncover hidden information in SSL certificates.
Cisco SMB Products - Critical Vulnerabilities - 0-Day Release
Detailed examination of critical 0-day vulnerabilities in Cisco SMB switches, including web application and API exploits, leading to complete endpoint compromise and data leakage.
MitM Attack by Name Collision - Cause Analysis and Vulnerability Assessment in the New gTLD Era
Explore MitM attacks via name collision, analyzing causes and vulnerabilities in the new gTLD era. Learn about WPAD query leakage, attack surface characterization, and potential remediation strategies.
Toward Secure and Convenient Browsing Data Management in the Cloud
Explores a novel Cloud computing Age Browser architecture to address browsing data insecurity and inconvenience issues in modern Web browsers, leveraging cloud storage services.
Attacks From a New Front Door in 4G & 5G Mobile Networks
Unveils critical API vulnerabilities in 4G/5G networks, exposing risks for AI, MEC, and IoT applications. Explores attack vectors, security misconfigurations, and potential exploits in commercial providers' systems.
HTTP/2 - The Sequel is Always Worse
Uncover HTTP/2 vulnerabilities and their impact on web security. Learn about implementation flaws, RFC imperfections, and new attack techniques targeting high-profile websites and various server infrastructures.
Practical HTTP Header Smuggling - Sneaking Past Reverse Proxies to Attack AWS and Beyond
Explore HTTP header smuggling techniques to bypass security measures, attack web applications, and exploit vulnerabilities in proxy servers and AWS services.
Cross-Site Escape - Pwning macOS Safari Sandbox the Unusual Way
Explore a novel attack on macOS Safari sandbox using Cross-Site Scripting, achieving native code execution outside the sandbox without re-exploiting WebKit twice.
200+ Vulnerabilities in Android Phones
Revealing 200+ vulnerabilities in Samsung Android phones, focusing on authentication bypass and system crashes. Demonstrates fragmentation issues and compares with Google's AOSP, offering insights into Android security.
CSP Oddities
Explore Content Security Policy intricacies, common pitfalls, and innovative solutions. Learn to deploy effective CSP policies and discover potential vulnerabilities in web application security.