Added 3 new Java CVEs to our Java Code Review Badge! Now at 64 real-world labs to sharpen your Java code review skills. Try them here: pentesterlab.com/badges/java-... More CVEs coming soon 👀🔥

Articles worth reading discovered last week: 📲 security.googleblog.com/2025/11/rust... 📸 www.pixnapping.com 🧩 www.praetorian.com/blog/how-i-f... 🤖 buganizer.cc/hacking-gemi...

😂 @pentesterlab.com #Kawaiicon @kawaiicon.bsky.social

Research to read this week: Android, Django, MCP… 🤖 knifecoat.com/Posts/Runtim... 🐍 www.endorlabs.com/learn/critic... 🌽 googleprojectzero.blogspot.com/2025/11/defe... 🤖 medium.com/@kulkan-secu... 🧑🏻‍💻 words.filippo.io/claude-debug... #PentesterLabWeekly

Don't just look at bad code Know what good looks like! @pentesterlab.com #Kawaiicon @kawaiicon.bsky.social

Articles worth reading discovered last week: Passports, WIFI and AI-SAST! 🛂 blog.trailofbits.com/2025/10/31/t... 🛜 pulsesecurity.co.nz/articles/byp... 🧠 parsiya.net/blog/wtf-is-...

Yeah @nastystereo.com I think you and @pentesterlab.com would get along just fine collabbing. 👀

Upgrading the designer bag with a necessary accessory @pentesterlab.com

🚨 New labs just dropped! 3 new Python Code Review labs are now live on PentesterLab 🐍 Learn to spot subtle bugs and insecure patterns by reading real Python code. 🎯 pentesterlab.com/badges/python-code-review #Python #AppSec #CodeReview #PentesterLab

Really awesome preso from @snyff.pentesterlab.com @pentesterlab.com over at BSides Perth. Jam packed with patterns, approaches, tips and tricks to level up finding bugs in code. #bsides #bsidesperth

The past few weeks have been quiet, but we’re back! 🛠️ deepwiki.com 🛠️ github.com/AsyncFuncAI/... 🪲 blog.trailofbits.com/2025/04/23/h... 🛠️ github.com/quarkslab/pr... 🛡️ hdm.io/decks/Charti...

Your face when you realize your next security code review is on a Clojure codebase...

Articles worth reading discovered last week: 🪲 labs.watchtowr.com/xss-to-rce-b... 🧩 gist.github.com/Panya/990b45... #PentesterLabWeekly

Two great pieces of content for this week: 🪲 www.wiz.io/blog/ingress... 🪲 zhero-web-sec.github.io/research-and... #PentesterLabWeekly

‼️ blog.doyensec.com/2025/03/18/e... 📨 workos.com/blog/samlstorm 🛤️ projectdiscovery.io/blog/discour... ☑️ labs.watchtowr.com/by-executive... ❤️ tmpout.sh/4/ 🗼 labs.watchtowr.com/bypassing-au...

 Get our weekly news direct to your mailbox: pentesterlab.substack.com

If people spent as much time actually learning hacking as they do optimizing how to learn hacking, they’d be a lot better at it. Just start. Break things. Learn. Repeat.

We just released 3 new labs in our Golang Code Review Badge: pentesterlab.com/badges/golan... #golang

What a week! SAML&Ruby, PHP&XXE and so much more! 📨 github.blog/security/sig... 🧑🏻‍💻 seeinglogic.com/posts/visual... 🤯 swarm.ptsecurity.com/impossible-x... 😻 scrapco.de/blog/analysi... More details in our blog: pentesterlab.com/blog/researc... #PentesterLabWeekly

Articles worth reading discovered last week: 💎 www.elttam.com/blog/rails-s... ﹟ afine.com/understandin... 🪲 slcyber.io/blog/sitecor... For more details, check out our blog: pentesterlab.com/blog/researc...

Want to prove your API hacking skills? Earn the PentesterLab API badge! Hands-on labs designed to test and improve your ability to find and exploit API vulnerabilities. https://pentesterlab.com/badges/api

AI-generated code is reshaping secure code review—fewer trivial bugs, but more hidden threats. Read more in our new blog post: pentesterlab.com/blog/secure-... What do you think?

Articles worth reading discovered last week: 📚 mizu.re/post/explori... ☁️ devanshbatham.hashnode.dev/fragility-of... 🫙 www.wiz.io/blog/nvidia-... 🐍 www.reversinglabs.com/blog/rl-iden... 🎥 brutecat.com/articles/lea...

Think teaching devs to hack is risky? In reality, a bit of hacking knowledge helps them spot vulnerabilities early and build stronger apps. Discover why having devs with a 'hacker mindset' is a win for security: pentesterlab.com/blog/why-dev...

🚨 Just launched: Two brand-new API Mass Assignment labs! Ready to level up your #API hacking skills? Dive into realistic scenarios & learn how to exploit hidden parameters: 1️⃣ API Mass Assignment 01 2️⃣ API Mass Assignment 02 pentesterlab.com/badges/api/

Articles worth reading discovered last week: 🤝 blog.doyensec.com/2025/01/30/o... ☠️ www.feistyduck.com/newsletter/i... 📚 pathonproject.com/zb/?871f0933... And as always, it’s in our blog: pentesterlab.com/blog/researc... #PentesterLabWeekly

I’m excited to share that in a few weeks I’ll be heading to the US for a series of talks and workshops focused on security code review and JWT—and I’ll be bringing some @pentesterlab.com swag along too!

Invariants + Short Feedback Loops = your secret weapon 🛡️ in web hacking & exploit dev! 

 Validate assumptions locally, iterate fast ⚡, and say goodbye to endless 10-minute test cycles ⏱️.
 Master these two techniques and watch your productivity skyrocket 🚀 : pentesterlab.com/blog/invaria...

Jumping straight into “full exploitation” can lead to confusion and missed bugs. Instead, focus on minimal, incremental changes to isolate vulnerabilities. It’s a simple shift that reduces false negatives and clarifies which step triggers the bug. pentesterlab.com/blog/minimal...

Articles worth reading discovered last week: 🎮 ssno.cc/posts/revers... 👾 github.blog/security/vul... 🎹 psi3.ru/blog/swl01u/ 🚗 samcurry.net/hacking-subaru 📚 pathonproject.com/zb/?f4f3382a... #PentesterLabWeekly

🚀 Level up your #CyberSecurity skills FOR FREE! 🛡️ Earn the Recon Badge with Pentesterlab and master: 🔍 Virtual Hosts 🌐 DNS Recon 🔒 TLS Recon ...and so much more! Start your journey today 👉 pentesterlab.com/badges/recon

🚨 3 new MongoDB IDOR labs are live! 🚨 Learn how to understand and predict MongoDB's ObjectId. Perfect for pentesters, appsec engineers, and devs looking to level up their security skills! Start learning now: pentesterlab.com/badges/api/

Networking in InfoSec isn’t just about IP addresses and ports—it’s also about people! Discover how meetups, conferences, and volunteering can open big career doors in InfoSec. Read more: pentesterlab.com/blog/infosec...

Scoping a security code review? Don’t fall into these traps: 🚫 Too little time = missed issues 🚫 Too much time = wasted resources Learn how to balance depth, coverage & cost while delivering tailored artefacts like SAST rules for long-term security. 🔗 pentesterlab.com/blog/scoping...

Articles worth reading discovered last week: 🤯 www.wiz.io/blog/nuclei-... 📚 pathonproject.com/zb/?47a5c4d2... #PentesterLabWeekly

Want to elevate your hacking skills? Master the 'Engineer Mind'??

Build mental models of code and architecture to predict vulnerabilities and navigate complex systems. It's the perfect counterpart to the 'Criminal Mind.' 🛠️⚡ Read more: pentesterlab.com/blog/enginee...

Want to find vulnerabilities like a pro? Develop the 'criminal mind'! 🧠 Think like an attacker, question assumptions, and uncover flaws others miss. 🔍💻 Learn how 👉 pentesterlab.com/blog/crimina...

The single best thing you can do to crush your goals in 2025: Limit your phone usage to just 1 hour a day. 🚀📵

WOOOOT ? poke @pentesterlab.com

If your New Year’s resolution is to get better at web security code review, don’t miss our upcoming live training. Learn how to find vulnerabilities and strengthen your skills: pentesterlab.gumroad.com

Happy New Year: pentesterlab.com/gift/p5KZNah... (3-month) pentesterlab.com/gift/DHWbMw-... (3-month) pentesterlab.com/gift/VmZXW_o... (3-month)

We just released two new code review labs in our Golang Code Review Badge: pentesterlab.com/badges/gcr

PentesterLab isn’t just for pentesters. 🚀 🏆 Rewards for security champions 🌱 Growth for failed interviewees 🔒 Probation challenges for new hires 💡 Hacker mindset for devs 🔍 IR team training ✨ Scouting future security stars Here’s how companies really use it: pentesterlab.com/blog/creativ...

🎅 pentesterlab.com/gift/02K5EQT... (3-month) pentesterlab.com/gift/SuFk7vH... (3-month) pentesterlab.com/gift/V_q_IWU... (3-month)

🔍 Want to level up as an Application Security Engineer? PentesterLab isn't just about finding bugs—it's about mastering code review, building custom tools, and understanding real-world vulnerabilities.

Articles worth reading discovered last week: 🔐 pentesterlab.com/blog/another... 🐘 www.assetnote.io/resources/re... 📚 pathonproject.com/zb/?ebab2d29... #PentesterLabWeekly

Thank you very much @pentesterlab.com and @snyff.pentesterlab.com 🥰🥰🥰🥰

These are some really nice blog posts regarding algo confusion bugs in JWT by @pentesterlab.com pentesterlab.com/blog/jwt-alg... & pentesterlab.com/blog/another... nice one @snyff.pentesterlab.com!

❤It is why I am a huge fan and student of @pentesterlab.com and @snyff.pentesterlab.com 😱This lab show me that I was wrong, since several years, recommending to dev teams using a hash of the token as identifier in a revocation list. 🥰Now, I know the correct recommendation to provide. #appsec #jwt

Here’s a good companion for this lab: "Base64 Malleability in Practice"