Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Please Stop Giving Me Your Passwords

netspi.com | blog | #secure-coding | #secrets-management | #sast | #xxe | #database-security | #hardcoded-credentials

Summary

A code review found 30 hardcoded database passwords across 20 accounts; the article shows how flaws like XXE turn leaked source into direct DB access and outlines safer secret distribution options.
Published
Collected

original ↗

Related coverage

blog · bugbunny.ai
Database Security Best Practices That Survive Real Incidents
Database security that survives incidents: least-privilege roles per service, managed and rotated credentials, encryption with reviewed key access, contextual audit logs, and tested restore paths.
vulnerability · netspi.com
Advisory: XXE Injection in Oracle Database (CVE-2014-6577)
Oracle Database's XML parser (11.2.0.3-12.1.0.2) resolves external schemas, so XXE via extractvalue() lets a CREATE SESSION holder exfiltrate data over HTTP/FTP, port-scan, or trigger SSRF.
blog · netspi.com
Rust’s Role in Embedded Security
Rust improves memory safety in embedded systems, eliminating entire vulnerability classes, but logic, hardware, and cryptographic flaws still demand rigorous security testing.
blog · netspi.com
Vibe Coding: A Pentester’s Dream
NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.
blog · netspi.com
Next-Level DevSecOps
A GrammaTech guest post argues DevSecOps pipelines alone miss the adversarial view; pairing SAST automation with offensive security closes the blind spot where design and code flaws slip through.
blog · netspi.com
Limiting The Exposure of Plain Text Passwords in C#
NetSPI shows why .NET SecureString still leaks passwords in memory via NetworkCredential, and demonstrates safer login handling using pinned mutable byte arrays instead of immutable strings.
back