CAPTCHAs Done Right?

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.

A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.

A three-part video series demystifies Burp Suite macros: capturing dynamic values like CSRF tokens, chaining sessions, and automating complex multi-request scenarios, with practice labs included.

The first post in an anti-scraping series lays out five core principles: require authentication, enforce rate limits, lock down account creation, cap data volume, and return generic error messages.

Shows how an attacker with domain credentials can request an RSA Emergency Access Tokencode from the self-service console and brute force the numeric PIN, turning recovery features into a 2FA bypass.

A walkthrough of common login page bypass techniques—SQL injection, response manipulation, forced browsing, default credentials and credential stuffing—and how defenders should counter them.