The past few weeks have been quiet, but we’re back! 🛠️ deepwiki.com 🛠️ github.com/AsyncFuncAI/... 🪲 blog.trailofbits.com/2025/04/23/h... 🛠️ github.com/quarkslab/pr... 🛡️ hdm.io/decks/Charti...

Your face when you realize your next security code review is on a Clojure codebase...

Articles worth reading discovered last week: 🪲 labs.watchtowr.com/xss-to-rce-b... 🧩 gist.github.com/Panya/990b45... #PentesterLabWeekly

Two great pieces of content for this week: 🪲 www.wiz.io/blog/ingress... 🪲 zhero-web-sec.github.io/research-and... #PentesterLabWeekly

‼️ blog.doyensec.com/2025/03/18/e... 📨 workos.com/blog/samlstorm 🛤️ projectdiscovery.io/blog/discour... ☑️ labs.watchtowr.com/by-executive... ❤️ tmpout.sh/4/ 🗼 labs.watchtowr.com/bypassing-au...

 Get our weekly news direct to your mailbox: pentesterlab.substack.com

If people spent as much time actually learning hacking as they do optimizing how to learn hacking, they’d be a lot better at it. Just start. Break things. Learn. Repeat.

We just released 3 new labs in our Golang Code Review Badge: pentesterlab.com/badges/golan... #golang

What a week! SAML&Ruby, PHP&XXE and so much more! 📨 github.blog/security/sig... 🧑🏻‍💻 seeinglogic.com/posts/visual... 🤯 swarm.ptsecurity.com/impossible-x... 😻 scrapco.de/blog/analysi... More details in our blog: pentesterlab.com/blog/researc... #PentesterLabWeekly

Articles worth reading discovered last week: 💎 www.elttam.com/blog/rails-s... ﹟ afine.com/understandin... 🪲 slcyber.io/blog/sitecor... For more details, check out our blog: pentesterlab.com/blog/researc...

Want to prove your API hacking skills? Earn the PentesterLab API badge! Hands-on labs designed to test and improve your ability to find and exploit API vulnerabilities. https://pentesterlab.com/badges/api

AI-generated code is reshaping secure code review—fewer trivial bugs, but more hidden threats. Read more in our new blog post: pentesterlab.com/blog/secure-... What do you think?

Articles worth reading discovered last week: 📚 mizu.re/post/explori... ☁️ devanshbatham.hashnode.dev/fragility-of... 🫙 www.wiz.io/blog/nvidia-... 🐍 www.reversinglabs.com/blog/rl-iden... 🎥 brutecat.com/articles/lea...

Think teaching devs to hack is risky? In reality, a bit of hacking knowledge helps them spot vulnerabilities early and build stronger apps. Discover why having devs with a 'hacker mindset' is a win for security: pentesterlab.com/blog/why-dev...

🚨 Just launched: Two brand-new API Mass Assignment labs! Ready to level up your #API hacking skills? Dive into realistic scenarios & learn how to exploit hidden parameters: 1️⃣ API Mass Assignment 01 2️⃣ API Mass Assignment 02 pentesterlab.com/badges/api/

Articles worth reading discovered last week: 🤝 blog.doyensec.com/2025/01/30/o... ☠️ www.feistyduck.com/newsletter/i... 📚 pathonproject.com/zb/?871f0933... And as always, it’s in our blog: pentesterlab.com/blog/researc... #PentesterLabWeekly

I’m excited to share that in a few weeks I’ll be heading to the US for a series of talks and workshops focused on security code review and JWT—and I’ll be bringing some @pentesterlab.com swag along too!

Invariants + Short Feedback Loops = your secret weapon 🛡️ in web hacking & exploit dev! 

 Validate assumptions locally, iterate fast ⚡, and say goodbye to endless 10-minute test cycles ⏱️.
 Master these two techniques and watch your productivity skyrocket 🚀 : pentesterlab.com/blog/invaria...

Jumping straight into “full exploitation” can lead to confusion and missed bugs. Instead, focus on minimal, incremental changes to isolate vulnerabilities. It’s a simple shift that reduces false negatives and clarifies which step triggers the bug. pentesterlab.com/blog/minimal...

Articles worth reading discovered last week: 🎮 ssno.cc/posts/revers... 👾 github.blog/security/vul... 🎹 psi3.ru/blog/swl01u/ 🚗 samcurry.net/hacking-subaru 📚 pathonproject.com/zb/?f4f3382a... #PentesterLabWeekly

🚀 Level up your #CyberSecurity skills FOR FREE! 🛡️ Earn the Recon Badge with Pentesterlab and master: 🔍 Virtual Hosts 🌐 DNS Recon 🔒 TLS Recon ...and so much more! Start your journey today 👉 pentesterlab.com/badges/recon

🚨 3 new MongoDB IDOR labs are live! 🚨 Learn how to understand and predict MongoDB's ObjectId. Perfect for pentesters, appsec engineers, and devs looking to level up their security skills! Start learning now: pentesterlab.com/badges/api/

Networking in InfoSec isn’t just about IP addresses and ports—it’s also about people! Discover how meetups, conferences, and volunteering can open big career doors in InfoSec. Read more: pentesterlab.com/blog/infosec...

Scoping a security code review? Don’t fall into these traps: 🚫 Too little time = missed issues 🚫 Too much time = wasted resources Learn how to balance depth, coverage & cost while delivering tailored artefacts like SAST rules for long-term security. 🔗 pentesterlab.com/blog/scoping...

Articles worth reading discovered last week: 🤯 www.wiz.io/blog/nuclei-... 📚 pathonproject.com/zb/?47a5c4d2... #PentesterLabWeekly

Want to elevate your hacking skills? Master the 'Engineer Mind'??

Build mental models of code and architecture to predict vulnerabilities and navigate complex systems. It's the perfect counterpart to the 'Criminal Mind.' 🛠️⚡ Read more: pentesterlab.com/blog/enginee...

Want to find vulnerabilities like a pro? Develop the 'criminal mind'! 🧠 Think like an attacker, question assumptions, and uncover flaws others miss. 🔍💻 Learn how 👉 pentesterlab.com/blog/crimina...

The single best thing you can do to crush your goals in 2025: Limit your phone usage to just 1 hour a day. 🚀📵

WOOOOT ? poke @pentesterlab.com

If your New Year’s resolution is to get better at web security code review, don’t miss our upcoming live training. Learn how to find vulnerabilities and strengthen your skills: pentesterlab.gumroad.com

Happy New Year: pentesterlab.com/gift/p5KZNah... (3-month) pentesterlab.com/gift/DHWbMw-... (3-month) pentesterlab.com/gift/VmZXW_o... (3-month)

We just released two new code review labs in our Golang Code Review Badge: pentesterlab.com/badges/gcr

PentesterLab isn’t just for pentesters. 🚀 🏆 Rewards for security champions 🌱 Growth for failed interviewees 🔒 Probation challenges for new hires 💡 Hacker mindset for devs 🔍 IR team training ✨ Scouting future security stars Here’s how companies really use it: pentesterlab.com/blog/creativ...

🎅 pentesterlab.com/gift/02K5EQT... (3-month) pentesterlab.com/gift/SuFk7vH... (3-month) pentesterlab.com/gift/V_q_IWU... (3-month)

🔍 Want to level up as an Application Security Engineer? PentesterLab isn't just about finding bugs—it's about mastering code review, building custom tools, and understanding real-world vulnerabilities.

Articles worth reading discovered last week: 🔐 pentesterlab.com/blog/another... 🐘 www.assetnote.io/resources/re... 📚 pathonproject.com/zb/?ebab2d29... #PentesterLabWeekly

Thank you very much @pentesterlab.com and @snyff.pentesterlab.com 🥰🥰🥰🥰

These are some really nice blog posts regarding algo confusion bugs in JWT by @pentesterlab.com pentesterlab.com/blog/jwt-alg... & pentesterlab.com/blog/another... nice one @snyff.pentesterlab.com!

❤It is why I am a huge fan and student of @pentesterlab.com and @snyff.pentesterlab.com 😱This lab show me that I was wrong, since several years, recommending to dev teams using a hash of the token as identifier in a revocation list. 🥰Now, I know the correct recommendation to provide. #appsec #jwt

Here’s a good companion for this lab: "Base64 Malleability in Practice"

🚨 New Lab Alert! 💡 How NOT to revoke JWTs: Learn how Base64 malleability can be used to bypass weak revocation mechanisms. Ready to test your skills? 💥 👉 pentesterlab.com/exercises/ap... #APISecurity #Pentesting

Want to level up your learning in security? 🚀 Stop scrolling and start reflecting. 'Reading Between the Lines' challenges you to dig deeper: 1️⃣ What can I learn from this? 2️⃣ What patterns apply elsewhere? 3️⃣ Why didn’t I spot this? The real breakthroughs come when you ask the right questions. 💡 👇

You can now bookmark labs using the little bookmark icon near the lab's title. It's a great way to revisit your favourite labs or ones you think you should revisit in the future!

Articles worth reading discovered last week: 🗞 flatt.tech/research/pos... 🗞 snyk.io/articles/rem... 🗞 nastystereo.com/security/rub... 🗞 blog.doyensec.com/2024/12/03/c... 🗞 nastystereo.com/security/r-s... 🗞 satoooon1024.hatenablog.com/entry/2024/1... 🗞 portswigger.net/research/byp...

CORS vulnerabilities in Rust 🦀? Same common mistakes, new language. 🐛 Look out for starts_with(), contains(), and even some interesting ends_with() cases. Check out our new dive into Rust CORS issues: pentesterlab.com/blog/rust-co... #AppSec #RustLang #CodeReview

An old favourite from @pentesterlab.com

🚨 CORS vulnerabilities in Go 🚨 Misusing strings.HasSuffix, Contains, or HasPrefix? You might be leaving the door wide open! 🔓 Learn how these patterns lead to bypasses 🐛👇 👉 pentesterlab.com/blog/golang-...

If you are a new PRO subscriber, make sure you order your set of free stickers!

Only content from Australia and New Zealand this week! Is the rest of the world asleep? 💎 nastystereo.com/security/rub... 🪄 srcincite.io/blog/2024/11... 🌐 nastystereo.com/security/cro... 👺 pulsesecurity.co.nz/articles/mss... 🔐 tierzerosecurity.co.nz/2024/11/26/d...