Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Web Application Security: The Controls That Still Matter Most

bugbunny.ai | blog | #appsec | #web-security | #application-security | #csrf | #authorization | #input-validation | #session-security

Summary

Web application security where it actually fails: server-side authorization on every object and action, safe session, cookie and CSRF behavior, validation for uploads and APIs, and retesting.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Macros Demystified
A three-part video series demystifies Burp Suite macros: capturing dynamic values like CSRF tokens, chaining sessions, and automating complex multi-request scenarios, with practice labs included.
blog · netspi.com
Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
Since its formal recognition by the security community in 2007 on the OWASP Top Ten list, Cross Site Request Forgery (CSRF) has stepped out of the shadows and joined the ranks of vulnerability all-stars like Cross Site Scripting (XSS) and SQL injection.
blog · netspi.com
What's Happening in the Application Security Arena?
According to Gartner, 75% of the attacks are coming though web applications and not through the network. This means greater emphasis needs to be placed on application security. However, this does not appear to be happening.
advisory · aikido.dev
Web & REST API Security Explained
Web and REST APIs power modern software but become open doors when insecure. Essential practices include OAuth 2.0 authentication, strict authorization, and input validation.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
vulnerability · netspi.com
Advisory: Oracle Forms 10g Unauthenticated Remote Code Execution (CVE-2014-4278)
Oracle Forms 10g fails to validate the ifip parameter passed to ListenerServlet, letting unauthenticated attackers execute arbitrary commands; E-Business Suite 12.0.6-12.2.4 is also affected.
back