01
29 July 2026 · 13 min read
MOL Move flaws let users turn accounts into employees
MOL Move field-level authorization flaws allowed role, email and loyalty data changes. We examine the facts, root cause and disclosure failure.
Topic · 46 articles
Penetration Testing and AppSec
Penetration testing and application security across web, API, mobile, business logic, secure development, hardening and actionable evidence.
FIELD NOTES
TOPIC INDEX
Latest research
02
25 July 2026 · 17 min read
IDOR and BOLA: testing object-level authorization
Why object-level authorization fails most often: overlooked IDOR variants, UUID myths, durable fix patterns, a testing method and log-based detection.
03
25 July 2026 · 17 min read
Secure file upload: from validation to isolation
Why extension checks solve nothing: filenames, types, serving, parsers, archives and limits. A target upload pipeline and a practical testing method.
04
25 July 2026 · 17 min read
SQL injection in the ORM era: where it still lives
Parameters bind values, not identifiers, and every ORM has escape hatches. Where SQLi survives: sorting, reports, blind and second-order variants.
05
25 July 2026 · 16 min read
SSTI: server-side template injection explained
How SSTI differs from XSS, why a template engine sandbox is not a security boundary, and how to test, fix and detect this class of vulnerability.
06
25 July 2026 · 17 min read
Webhook security: signatures, replay and SSRF
Webhooks have two sides and two attack surfaces. How to verify signatures, block replay, design idempotency and avoid building SSRF on request.
07
25 July 2026 · 16 min read
XXE: XML parser security in practice
How external entities turn an XML parser into a file reader and HTTP client. Where XML sneaks in, how to disable DTDs, and how to test and detect XXE.
08
14 July 2026 · 9 min read
GitHub AI security reviews: what now appears in pull requests
GitHub has added AI detections to code scanning and a /security-review command. Understand the prerequisites, limitations and a safe rollout plan for engineering teams.
09
14 July 2026 · 8 min read
GitHub is removing SHA-1 from HTTPS: lessons from the July brownout
GitHub's 18-hour test exposed legacy TLS clients before permanent SHA-1 removal on 15 September. Find risk across Git, APIs, CI/CD and vendor integrations.
10
12 July 2026 · 25 min read
Web application penetration testing: the complete guide
How professional web application penetration testing works: scope, OWASP methodology, reporting, retesting, pricing and vendor selection.
11
11 July 2026 · 16 min read
API penetration testing for REST, GraphQL and OAuth
A practical API penetration testing checklist for REST, GraphQL, OAuth, JWT, BOLA, access control, rate limits, business logic, reporting and retesting.
12
11 July 2026 · 15 min read
Mobile app penetration testing for Android and iOS
A practical mobile app penetration testing guide covering Android, iOS, MASVS, MASTG, backend APIs, preparation, reporting and retesting.
13
11 July 2026 · 16 min read
OWASP ASVS 5.0: levels, requirements and implementation
A practical OWASP ASVS 5.0 guide covering L1–L3, versioned requirements, evidence, procurement, testing and implementation across a secure SDLC.
14
11 July 2026 · 14 min read
Penetration test cost and pricing: 2026 buyer's guide
How much does a penetration test cost in 2026? Compare pricing factors, realistic scopes, deliverables and quotes without choosing a misleading bargain.
15
11 July 2026 · 15 min read
Red team vs penetration test: differences and choice
Red team or penetration test? Compare objectives, scope, duration, cost, detection goals and deliverables to choose the right security assessment.
16
9 July 2026 · 11 min read
Content Security Policy: a practical CSP rollout guide
Content Security Policy limits XSS impact. Learn Report-Only rollout, nonces, strict-dynamic, reporting and how to enforce a production CSP safely.
17
9 July 2026 · 11 min read
OAuth 2.0 security: the essential RFC 9700 controls
RFC 9700 updates OAuth 2.0 security. Learn PKCE, exact redirect URIs, token rotation, audience validation and a practical implementation checklist.
18
8 July 2026 · 10 min read
VDP vs bug bounty: building a safe disclosure program
Vulnerability disclosure and bug bounty programs differ. Design safe harbor, scope, triage, SLAs, rewards and a responsible launch process.
19
7 July 2026 · 12 min read
Cloud penetration testing guide for AWS, Azure and GCP
Plan a cloud pentest within provider rules. Scope IAM, storage, networks, Kubernetes, serverless, CI/CD, logging and safe rules of engagement.
20
7 July 2026 · 9 min read
Memory-safe languages: a practical migration roadmap
Memory-safe languages remove major vulnerability classes. Learn how to prioritise components, control FFI risk and plan a practical Rust migration.
21
6 July 2026 · 12 min read
CISA Secure by Design: a practical implementation guide
Secure by Design puts security outcomes on manufacturers. Apply CISA principles through safe defaults, transparent metrics and product governance.
22
4 July 2026 · 9 min read
Free website security scanner — check in seconds
A free website security scanner: HTTPS, headers, cookies, SPF/DMARC, library versions checked against OSV and more. Get a report under its own shareable link.
23
4 July 2026 · 11 min read
How to read your scan results and fix the issues
You scanned your site and see a grade and a list of issues — now what? We explain every finding type and show how to fix it, concretely.
24
4 July 2026 · 12 min read
HTTP Security Headers: A Practical Guide for Businesses
HSTS, CSP, X-Frame-Options, Permissions-Policy, CORS and cookie flags - which security headers to implement, how to set them correctly and how to verify them.
25
4 July 2026 · 11 min read
HTTP/2 Rapid Reset: How One Frame Enabled Record-Breaking DDoS Attacks
Rapid Reset (CVE-2023-44487) leverages HTTP/2 multiplexing for record-breaking L7 attacks. We explain the stream mechanism, RST_STREAM and defense.
26
4 July 2026 · 11 min read
Penetration Test, Security Audit or Vulnerability Scan: Which Do You Need?
Pentest, audit and vulnerability scan are three different things, often confused. We explain how they differ, how much they cost and which service to choose for your situation.
27
3 July 2026 · 12 min read
OSINT: what attackers know about you before they strike
Before an attack lands, a criminal does reconnaissance. We show what OSINT reveals about your company and how to shrink your digital footprint.
28
2 July 2026 · 12 min read
eBPF Security: A Linux Kernel Superpower for Defenders and Attackers
eBPF allows you to run programs in the Linux kernel without modules - it powers modern monitoring and networking, but can also be a rootkit tool. Technically and about hardening.
29
2 July 2026 · 13 min read
How to prepare for a penetration test
A well-prepared penetration test delivers more value for the same money. How the process works, what to agree up front and how to read the report.
30
30 June 2026 · 11 min read
Kerberoasting: How Attackers Crack Active Directory Service Accounts
A regular domain account is enough to download a Kerberos ticket and crack the password of an offline service account. We explain TGS-REP, RC4 vs AES and effective defense.
31
29 June 2026 · 10 min read
DNS Rebinding: How a Website Can Attack Your Local Network
DNS rebinding bypasses the same-origin policy and allows a website in the browser to reach the router, IoT or LAN admin panel. Mechanism and effective defense.
32
27 June 2026 · 11 min read
Threat Modeling: Find Security Flaws Before Attackers Do
Threat modeling is the cheapest way to detect design errors before they become code. We explain the STRIDE method, data flow diagrams and a practical approach.
33
5 June 2026 · 11 min read
WordPress security: 10 steps for site owners
WordPress powers most of the web and is the top target for attacks. Ten practical steps to secure your site — no coding knowledge required.
34
30 May 2026 · 7 min read
API security: the OWASP API Top 10 in practice
APIs are now the most common target for application attacks. We cover the key OWASP API Top 10 flaws — led by BOLA — and how to avoid them.
35
18 May 2026 · 7 min read
OWASP Top 10: the most common web app flaws
A guide to the OWASP Top 10 for teams that want to understand real risks — from broken access control, through injection, to SSRF.
36
9 May 2026 · 16 min read
Insecure Deserialization: When Data Becomes Code
Insecure deserialization in Java, .NET, and Python: identify trust boundaries, test without unsafe gadget chains, and remove the root cause of RCE.
37
8 May 2026 · 7 min read
Active Directory security: what we check first
Active Directory is the top target once inside a network. We cover common attack paths — Kerberoasting, excessive privileges — and how to close them.
38
5 May 2026 · 15 min read
Prototype Pollution in JavaScript: Test and Defend
Understand prototype pollution in JavaScript and Node.js, trace pollution sources and gadgets, test safely, and harden applications effectively.
39
4 May 2026 · 15 min read
Web Race Conditions: TOCTOU Testing and Defense
Learn how web race conditions and TOCTOU flaws break business logic, how to test concurrency safely, and which atomic controls actually fix them.
40
18 April 2026 · 20 min read
Internal network segmentation penetration testing
A technical LAN and segmentation pentest methodology covering flow matrices, Active Directory, IPv6, detection, hardening and safe evidence.
41
10 April 2026 · 9 min read
Hardening Linux servers: where to actually start
A practical guide to hardening Linux servers — no copying hundred-item checklists, with an emphasis on the highest-impact actions.
42
8 April 2026 · 18 min read
SaaS tenant isolation penetration testing: a technical guide
Test SaaS tenant isolation across APIs, databases, caches, queues, storage and support tooling with a safe, evidence-led penetration testing method.
43
7 April 2026 · 21 min read
gRPC and Protobuf penetration testing guide
A technical gRPC and Protobuf pentest methodology covering reflection, HTTP/2, mTLS, metadata, interceptors, schemas, streaming, limits and hardening.
44
6 April 2026 · 20 min read
WebSocket penetration testing: sessions and Origin
A technical WebSocket pentest methodology covering handshakes, CSWSH, Origin, cookies, tokens, message authorisation, subscriptions, limits and hardening.
45
5 April 2026 · 20 min read
Web cache poisoning and deception testing
How to test web cache poisoning and cache deception safely: cache keys, URL normalisation, CDN policy, Vary, private responses, detection and hardening.
46
3 April 2026 · 19 min read
HTTP request smuggling and desync testing
How to test HTTP request smuggling, CL.TE, TE.CL and HTTP/2 downgrades safely. A technical methodology for detection, hardening and retesting.
BR / NEXT STEP
Want to prepare your team for these threats?
We turn current threats into role-based training, safe exercises and a clear reporting path. The free Academy remains available for self-directed learning.
NDA · clear scope · direct communication