PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Your scanner didn't find it. Mjolnir did.

borghq.io | blog | #pentesting | #appsec | #continuous-testing | #vulnerability-detection | #business-logic | #scanners | #autonomous-pentesting
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Borg argues that pattern-matching scanners cannot catch logic-driven flaws such as out-of-order workflow IDORs, and presents Mjolnir, its autonomous pentesting engine built to fill that gap.
Published
Collected

Related coverage

blog · borghq.io
How to Prioritise Security Findings That Have No CVE
CVSS, EPSS and KEV are all built around published CVEs, so they cannot score findings in your own application code. This practical guide shows how to rank exploitable issues like tenant boundary flaws in a continuous testing queue.
blog · borghq.io
SAST and Business Logic Vulnerabilities: What Static Analysis Can Reach
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · borghq.io
What Is Code-Aware Application Security Testing?
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · yeswehack.com
Why pentests cause security debt
New features ship, dependencies update, new APIs are added… and all the while, despite your pentest program, security debt mounts up.
research · theori.io
What are business logic vulnerabilities, and why are they so hard to catch?
Business logic flaws execute correctly but violate business intent — like a password reset token returned in the HTTP response — and Xint explains why SAST and human testers miss them.
tool · projectdiscovery.io
Neo v1 is now available for everyone
Neo v1 is out of beta: an autonomous security platform that runs continuous exploitability testing across applications, APIs, repositories, cloud accounts, and the internal network, all from one org-wide context layer.
Back