Hello, World! This blog post will serve as a walkthrough of PortSwigger’s Web Academy new NoSQL Injections lab #3, “Exploiting NoSQL injection to extract data.” Let’s go for it! Glossary NoSQL Database — refers to a database that does not implement table-based storage mechanisms but instead leverages an alternative storage model…

Hello, World! This blog post will serve as a walkthrough of PortSwigger’s Web Academy new NoSQL Injections lab #2, “Exploiting NoSQL operator injection to bypass authentication.” Let’s go for it! Glossary NoSQL Database — refers to a database that does not implement table-based storage mechanisms but instead leverages an alternative storage…

Hello, World! This blog post will serve as a walkthrough of PortSwigger’s Web Academy new NoSQL Injections labs, specifically lab #1, “Detecting NoSQL Injection.” Let’s go for it! Glossary NoSQL Database — refers to a database that does not implement table-based storage mechanisms but instead leverages an alternative storage model such…

How Browsers Can Protect Your Web Apps From Embedded Content — Hello, Universe! As our online experiences become increasingly dynamic and interactive, so too does the potential for security vulnerabilities. In this blog, we’ll learn about of IFrame sandboxing, unraveling its importance, mechanisms, and how it stands as a robust guardian against a wide array of web-based threats. What does IFrame Sandboxing Prevent

Scan Your GitHub Actions for Common Security Bad Practices — Hello, World! I’ve released a new tool called ghast that allows you to evaluate the security posture of your GitHub Actions. …

Identifying Privacy Threats in Your System Design — Hello, World! Privacy violations have become a significant concern for companies, leading to frequent fines imposed on both small-scale entities like Clearview AI and industry giants like Meta. In fact, Meta recently received the largest-ever GDPR fine, amounting to an astounding $1.3 billion (😮). In this blog post, I will…

Four Effective Ways to Mitigate Unauthenticated API Threats — As an application security engineer, the most challenging applications to secure are those that want to provide an unauthenticated user a means to execute server-side logic. There are many threats to an unauthenticated application user flow such as denial-of-service attacks, injection attacks, spam, etc. However, with the proper security controls…

A Vetted Client-Side Cryptographic Library — The AWS Encryption SDK (ESDK) is a client-side encryption library that was created to minimize the time spent deciding on how best to encrypt your data on the client side. It was designed with the utmost security in mind (as are all things in AWS since security is job zero!)…

A More Secure Way of Granting Access to Private Content — I recently published cloudfront-signed-cookies, a package available on the PyPI index that allows you to quickly generate signed cookies for secure access to resources behind a CloudFront distribution such as an object in an S3 bucket. In this blog, I’ll talk a little about CloudFront signed cookies and demonstrate how…