PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Code Assisted Penetration Testing

projectblack.io | research | #jwt | #penetration-testing | #methodology | #application-security | #source-code-review
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How source-code assisted penetration testing works: reading backend logic such as JWT validation skips guesswork and improves coverage, with findings adjusted for realistic attacker access.
Published
Collected

Related coverage

blog · netspi.com
Why You Should Consider a Source Code Assisted Penetration Test
Source code assisted (white-box) pentesting delivers more thorough coverage, more findings, and more specific remediation guidance at no added cost — here's how it compares to black-box and grey-box.
blog · netspi.com
Happy New Year – Have you made your application testing resolution yet?
A New Year reminder that code review and penetration testing each miss vulnerabilities the other finds, so organizations should do both and remediate findings instead of delaying fixes.
blog · netspi.com
How Good Are Your Application Security Assessments?
Let's talk about application vulnerability assessments, penetration testing, and code reviews.
research · portswigger.net
How I choose a security research topic
James Kettle on choosing security research topics: evaluate how quickly you can fail, chase what scares you, and know when to push on, using his race-conditions research as a case study.
research · portswigger.net
Hunting evasive vulnerabilities
James Kettle's Nullcon keynote explores evasive vulnerabilities from a decade of research — too advanced, too silly or well-masked to spot — extracting principles for finding overlooked flaws.
research · portswigger.net
Introducing SignSaboteur: forge signed web tokens with ease
SignSaboteur is an open-source Burp extension for editing, signing, verifying and attacking signed tokens — JWT, Django, Flask, Express — with default-secret wordlists and automated brute-forcing.
Back