Code review is an essential part of the web application penetration testing process but is often overlooked. We’re going to look at why it’s important and how to get started. There are a number of reasons why we might decide to review the source code of an application...
While penetration testing can be considered “adversarial” testing, it should be anything but that. Your penetration test, no matter who you do it with, should be a partnership. In every partnership, communication is key. Settling for a pentest company that merely...
JavaScript is a bit like Marmite, you either love it or hate it. Regardless of how it makes us feel, it is a powerful tool for attacking users and exploitation. Often, popping alert(1) is proof enough to get a fix but doesn’t demonstrate the full impact an attacker...
Hypertext Transfer Protocol (HTTP) is an application layer protocol. On the surface, HTTP can appear quite simple, but there are a lot of quirks considering its use across inconsistent browsers and servers. Breaking down an HTTP request For each request, we generally...
One of the most underrated resources in your toolkit as an I.T. Professional is your ability to take notes. Ironically, this is also one of the least mentioned skills discussed when learning the fundamentals of anything new. We often get asked a variety of questions...
As with any industry, with jargon comes confusion and misunderstanding. 2022 saw a huge rise in the popularity of the buzz-word “Red Team”, but what is the essence of a Red Team? Popular opinion on social media may say “it’s a pentest with no scope,” but that’s a...
