I have been using docker for 10 years... Today I learned that you don't need to provide the full container id when you run docker exec...

Really awesome preso from @snyff.pentesterlab.com @pentesterlab.com over at BSides Perth. Jam packed with patterns, approaches, tips and tricks to level up finding bugs in code. #bsides #bsidesperth

I’ve spent 2 solid hours doing bug bounty and I still haven’t made $200k. Can someone tell me what I’m doing wrong? #bugbountytips

AI-generated code is reshaping secure code review—fewer trivial bugs, but more hidden threats. Read more in our new blog post: pentesterlab.com/blog/secure-... What do you think?

Think teaching devs to hack is risky? In reality, a bit of hacking knowledge helps them spot vulnerabilities early and build stronger apps. Discover why having devs with a 'hacker mindset' is a win for security: pentesterlab.com/blog/why-dev...

From now on, I'll call any snippet of vulnerable code shared on Social Media as "Security Code Review Porn" It gives the wrong expectations about what real code review actually involves.

Articles worth reading discovered last week: 🤝 blog.doyensec.com/2025/01/30/o... ☠️ www.feistyduck.com/newsletter/i... 📚 pathonproject.com/zb/?871f0933... And as always, it’s in our blog: pentesterlab.com/blog/researc... #PentesterLabWeekly

I’m excited to share that in a few weeks I’ll be heading to the US for a series of talks and workshops focused on security code review and JWT—and I’ll be bringing some @pentesterlab.com swag along too!

🚀 Level up your #CyberSecurity skills FOR FREE! 🛡️ Earn the Recon Badge with Pentesterlab and master: 🔍 Virtual Hosts 🌐 DNS Recon 🔒 TLS Recon ...and so much more! Start your journey today 👉 pentesterlab.com/badges/recon

...

Networking in InfoSec isn’t just about IP addresses and ports—it’s also about people! Discover how meetups, conferences, and volunteering can open big career doors in InfoSec. Read more: pentesterlab.com/blog/infosec...

Someone shared this write-up in the @pentesterlab.com 's discord: www.wiz.io/blog/nuclei-... I love this article so much! The content and the analysis are A+ I really like the 🚩 (very similar to pentesterlab.com/blog/another...)

Have a great weekend and enjoy some tunes: youtu.be/j_Md8_7mhOU

If your New Year’s resolution is to get better at web security code review, don’t miss our upcoming live training. Learn how to find vulnerabilities and strengthen your skills: pentesterlab.gumroad.com

Happy New Year! pentesterlab.com/gift/xDzcB35... (3-month) pentesterlab.com/gift/UBMtCsi... (3-month) pentesterlab.com/gift/BWEYEme... (3-month)

Golang: because hackers haven’t given up on SQL injection in 2024...

🎅 pentesterlab.com/gift/v5kegJq... (3-month) pentesterlab.com/gift/4VG6RYU... (3-month) pentesterlab.com/gift/lsgfEwJ... (3-month)

I put together a VERY limited (for now) list of web hackers in a Starter pack: go.bsky.app/9uay4Ad A lot of people are missing (I will try to add more as I find them) but make sure you follow people already in the list!

Cross-Site POST Requests Without a Content-Type Header by @lukejahnke https://nastystereo.com/security/cross-site-post-without-content-type.html #BBRENewsletter85

❤It is why I am a huge fan and student of @pentesterlab.com and @snyff.pentesterlab.com 😱This lab show me that I was wrong, since several years, recommending to dev teams using a hash of the token as identifier in a revocation list. 🥰Now, I know the correct recommendation to provide. #appsec #jwt

Want to level up your learning in security? 🚀 Stop scrolling and start reflecting. 'Reading Between the Lines' challenges you to dig deeper: 1️⃣ What can I learn from this? 2️⃣ What patterns apply elsewhere? 3️⃣ Why didn’t I spot this? The real breakthroughs come when you ask the right questions. 💡 👇

These are simple issues, but they illustrate how, by thinking of vulnerabilities as patterns rather than code, you can move from one language to another.

Guess who has two thumbs, just found another algorithm confusion vulnerability, and got accepted to speak at @cactuscon.bsky.social on algorithm confusion vulnerabilities? 👍 THIS GUY 👍

Cyber has more certs than /etc/ssl/certs/ca-certificates.crt

If you are a new PRO subscriber, make sure you order your set of free stickers!

Only content from Australia and New Zealand this week! Is the rest of the world asleep? 💎 nastystereo.com/security/rub... 🪄 srcincite.io/blog/2024/11... 🌐 nastystereo.com/security/cro... 👺 pulsesecurity.co.nz/articles/mss... 🔐 tierzerosecurity.co.nz/2024/11/26/d...

Encoding isn't magic ✨: It doesn’t bypass filters or hack systems unless something decodes it. Learn how to avoid this common security misconception: pentesterlab.com/blog/encodin... #AppSec #CyberSecurity #BugBounty

Given that simps0n isn’t on Bluesky yet, allow me to repost a link to his excellent weekly ezine 💎 Here’s today’s edition, "AppSec Ezine - 563rd" 📚

Programming languages should have functions/methods to validate if a hostname or origin are part of a domain... That would kill a *LOT* of vulnerabilities...

When you're just minding your own business building code review labs for @pentesterlab.com, and a new vulnerability jumps out at you...

@nastystereo.com seems alright at computers...

My latest blog post is live! nastystereo.com/security/cro... Read how to send a cross-site POST without including a Content-Type header (without CORS). It even works with navigator.sendBeacon

‼️Only valid until‼️ Tuesday, 03 Dec 2024 23:59:59 Don't miss this opportunity! It's also the perfect time to renew/extend your existing subscription! pentesterlab.com/pro

(H|Bl)ack Friday is Back! 🔥🔥🔥 Black Friday Special 🔥🔥🔥 Get full access to PentesterLab PRO for a year and pay $146.52 instead of $199.99 🎓📚✏️ Student Special ✏️📚🎓 Get full access to PentesterLab PRO for three months year and pay $25.99 instead of $34.99

I've been meaning to look into this for a while... the year of the latest commit for all the libraries on jwt.io.

I loved putting these challenges together. A good mix of simple code review and exploitation. 😈 𝐓𝐡𝐞 𝐝𝐞𝐯𝐢𝐥 𝐢𝐬 𝐢𝐧 𝐭𝐡𝐞 𝐝𝐞𝐭𝐚𝐢𝐥𝐬 😈

I just updated PentesterLab Handle to @pentesterlab.com ...

💻 𝐇𝐚𝐜𝐤 𝐭𝐡𝐞 𝐰𝐞𝐛 𝐰𝐢𝐭𝐡 𝐜𝐮𝐫𝐥! In this article, we share tricks and handy ways to test web applications using curl. Boost your debugging, automate tasks, and uncover vulnerabilities with ease. 🚀 📖 Read the full guide: pentesterlab.com/blog/tricks-... Happy hacking! #WebHacking #CyberSecurity #Curl

I just published a new blog post sharing an improved Deserialization Gadget Chain for Ruby! It builds on the work of others, including Leonardo Giovanni, @ulldma.bsky.social and @vakzz.bsky.social nastystereo.com/security/rub...

More details in our Blog: pentesterlab.com/blog/researc...

Articles worth reading discovered last week: 🗞 naehrdine.blogspot.com/2024/11/reve... 🗞 mizu.re/post/explori... 🗞 seclists.org/oss-sec/2024... 🗞 www.synacktiv.com/relaying-ker... 🗞 blog.includesecurity.com/2024/11/spel... 🗞 pagedout.institute?page=issues.... 🗞 pathonproject.com/zb/?65b407a5...

I had a blast giving my talk "What Developers Get for Free" at Christchurh Hacker Conference! I received some great feedback on the content, and they also have amazing speaker gifts.

Go 1.24 (February 2025) will introduce os.Root to fight directory traversal: tip.golang.org/doc/go1.24

Why are JWT libraries rarely vulnerable to algorithm confusion? 🤔🔐 Learn how developers block these attacks and key takeaways for your next code reviews in our latest blog post: pentesterlab.com/blog/jwt-alg... #AppSec #CodeReview #JWT

I’ve watched plenty of talks on OAuth2 security and not one of them covered the same thing. That tells you everything you need to know about OAuth2 security. 🫠

🚀 Just dropped 3 NEW API labs: API 18, API 19, and API 20! 🛠️ Audit the authorization layer written in Go, find the vulnerability, and exploit it. Are you up for the challenge? 💻🔥 pentesterlab.com/badges/api/ #APISecurity #GoLang #Pentesting