Insecurity Through Obscurity

NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.

A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.

A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.

A three-part video series demystifies Burp Suite macros: capturing dynamic values like CSRF tokens, chaining sessions, and automating complex multi-request scenarios, with practice labs included.

Part two of an anti-scraping series applies rate limits, generic errors, and data caps to a demo message board, then shows how scrapers adapt, proving defense in depth beats any single control.