We appreciate Kevin Beaver’s recent blog post about NTOSpider’s unique ability to authenticate on some of the trickiest applications and stay properly logged-in throughout the scan. At NTO we take pride […]

We are now in the middle of week 4, but I want to catch everyone up on whats been happening.  First of all, I am […]

SQL injection vulnerabilities have threatened application security for years. So why are they still quite common, despite the fact that we, as an industry, should […]

Knowing how to prevent a SQL injection vulnerability is only half the web application security battle. A multitude of factors come into play when it […]

The podcasting returns! This is the first new episode of InfoSec Place and in a few days will be the return of my web security […]

Podcast: Play in new window | Download (Duration: 57:24 — 81.8MB)

Subscribe: Apple Podcasts | Android | RSS

This November I will be presenting at AppSec USA, Revenge of the Geeks: Hacking Fantasy Football. So this year, I am starting a hackers only fantasy football league. Come join us to have fun and maybe make a little money!

The OWASP Top 10 list is well known as the industry standard for what matters in web security. The list, which ranks the most critical risks organizations face through their web applications, was recently updated. The 2013 Top 10 Listfeatures some incremental but noteworthy changes that point to the project’s maturity.

I attend some of the talks at security conferences for technical interest, others for political interest. This one, at 2013 B-Sides San Francisco was the […]

Continuing my series on the talks I attended at 2013 Security B-Sides, this one from Dan Hubbard (CTO OpenDNS) and Frank Denis (@thinkumbrella) called, “Building […]

2013 B-Sides San Francisco Talk Summary Series This was a great talk given by Jasper Van Woudenberg, from Riscure. Whenever I attend these talks, I always […]

SSL++; Tales of Transport Layer Security at Twitter I am happy to have attended this talk, at 2013 B-Sides San Francisco, by @jimio, a Twitter […]

Ruby on Rails – JSON Parser Vulnerability The JSON parser which converts JSON into YAML and in turn hands over to the YAML parser is […]

Last week, hackers gained access to Twitter’s internal systems and stole information, compromising 250,000 accounts. In a blog post, on Friday, Twitter announced that they […]

An Indian researcher, Prakhar Prasad found a Blind SQL Injection vulnerability in the Paypal Notifications (https://www.paypal-notify.com) application as part of a bug bounty program. The bug enabled him to […]

Most people are starting to realize that they need to start using more complex passwords, but generally believe: complex password = hard to remember This […]

All aboard the Pineapple Express, its a speeding bullet to the mobile backend! I’m looking forward to speaking at the upcoming B-Sides San Francisco. Most of […]

Anonymous Hackers hacked and defaced United States Sentencing Commission under the operation called “#opLastResort”. And also threatened the US government to release sensitive information. Hacked […]

Google Morocco was the latest victim of a Domain Name System or DNS attack. A notorious Pakistani leet hacker group named, “PAKbugs”, hijacked Google Morocco’s […]

Much has been written this week on the sad story of Aaron Swartz and the Anonymous hack executed in his name. This story has affected […]

HTML5 Definition Complete, W3C Moves to Interoperability Testing and Performance The 5th revision of HTML is regarded as the future of web markup language. The […]

This very useful talk was as much an education in HTML5 for me as it was an education on how HTML5 can be abused. I […]

First off, in the spirit of full disclosure, two points: One is that this talk took place at the same time as the Shreeraj Shah […]

SQL Server Exploitation, Escalation, and Pilfering The general thesis of this talk I attended by Scott Sutherland and Antti Rantasaari from @NetSpi is that SQL Server is mostly […]

This talk, by Ofer Maor, CTO – Quotium (Follow on Twitter, @quotium) at 2012 AppSecUSA, addressed something that I see is an up and coming issue, interactive in-memory code […]