19 hours agoMember-onlyChatGPT: Build me a Recon Tool!Using ChatGPT to build a simple hacking recon tool — In Chapter 5 of Bug Bounty Bootcamp, I talked about how you can write a simple bash script to automate recon tasks before hacking and bug bounty hunting. Then just a year later, ChatGPT came around. I am still a huge proponent of learning to script so that you can…Hacking5 min readHacking5 min read
Published in Better Programming·Jan 10Member-onlyDesigning Secure Software: A Guide for DevelopersAppSec engineer’s book club #001 — discussing Loren Kohnfelder’s book — Many of my followers have been asking me for book recommendations. After all, who doesn’t love a new tech book? Books are my favorite way to absorb new information, especially when learning something new. I’ve wanted to start a security engineer’s book club to…Programming4 min readProgramming4 min read
Published in Better Programming·Jun 15, 2022SameSite Cookie AttacksAnd what subdomain takeovers mean for your SameSite cookies — I published an article a while ago about how Chrome is making SameSite the default behavior for cookies to prevent Cross-Site Request Forgery (CSRF) attacks. After that, jub0bs reached out to me about how the nuances of SameSite can leave websites vulnerable. Thanks for bringing this issue to my attention! …Programming3 min readProgramming3 min read
Published in ShiftLeft Blog·Apr 20, 2022Security and privacy in a world of digital identityInterview with Shinesa Cambric, Principal Product Manager at Microsoft — Our guest today, Shinesa Cambric, is an IT security professional who is passionate about designing roadmaps for identity and access management programs, and architecting security strategies for emerging technologies. In this episode of Sources and Sinks, Vickie Li, developer evangelist at ShiftLeft, interviews Shinesa about her research in identity and…Podcast1 min readPodcast1 min read
Published in ShiftLeft Blog·Apr 14, 2022Breaking the entry-level barrier with Jasmine JacksonLaunching your career in cybersecurity with self-study — Our guest today, Jasmine Jackson, is an experienced cybersecurity professional who got her start through self-teaching. Looking at Jasmine’s resume right now, it’s difficult to imagine that she was not able to find a job at all when she first started in the field! Jasmine has a technical background, but…Podcast1 min readPodcast1 min read
Published in ShiftLeft Blog·Apr 2, 2022Spring4Shell: Spring Remote Code Execution VulnerabilitySpring unauthenticated RCE via classLoader manipulation — A critical zero-day vulnerability in the Spring framework was recently reported to Spring’s maintainer, VMWare. The vulnerability is an unauthenticated remote code execution vulnerability that affects Spring MVC and Spring WebFlux applications. You can find the CVE here: https://tanzu.vmware.com/security/cve-2022-22965. What is affected? The Spring4Shell RCE vulnerability allows attackers to execute code on applications…Java3 min readJava3 min read
Published in ShiftLeft Blog·Mar 1, 2022Angular + React: Vulnerability CheatsheetThe most common vulnerabilities to look out for in Angular and React applications: template injection, XSSI, authentication bypass, and more. — Securing applications is not the easiest thing to do. An application has many components: server-side logic, client-side logic, data storage, data transportation, API, and more. With all these components to secure, building a secure application can seem really daunting.JavaScript5 min readJavaScript5 min read
Published in ShiftLeft Blog·Feb 23, 2022Announcing the AppSec Ambassador ProgramPassionate about securing software? Become an AppSec Ambassador! — Interested in helping developers write secure code from the start? ShiftLeft has launched a program to support you in the mission of helping your community write secure code. We will be financially supporting conference speakers, content creators, and infosec influencers. Read on to find out more! The ShiftLeft conference scholarshipSoftware Development2 min readSoftware Development2 min read
Published in ShiftLeft Blog·Feb 17, 2022Node.js Vulnerability Cheatsheet25 vulnerabilities to look out for in Node JS applications: Directory traversal, prototype pollution, XSSI, and more… — Securing applications is not the easiest thing to do. An application has many components: server-side logic, client-side logic, data storage, data transportation, API, and more. With all these components to secure, building a secure application can seem really daunting. Thankfully, most real-life vulnerabilities share the same root causes. And by…JavaScript14 min readJavaScript14 min read
Published in ShiftLeft Blog·Feb 15, 2022Networking and growing your career in infosec with Vandana VermaOWASP leader Vandana’s tips for navigating your career in infosec — Our guest today, Vandana, holds a lot of impressive titles. She is the Chair of the OWASP Global Board of Directors, and she also leads multiple infosec Diversity Initiatives like InfosecGirls. But how did she get from an infosec newbie to the leader of OWASP and the keynote speaker at…Podcast1 min readPodcast1 min read
