Username Discovery

A practical guide to testing SSO solutions that use SAML, covering the IdP/SP message flow and common implementation mistakes involving signatures, assertions, and message expiration.

Introduces a web security series on login portals, framing attack surface concepts and contrasting unauthenticated versus authenticated vulnerability classes before deeper defensive topics.

Shows how directory traversal and local file inclusion bugs can read the Linux proc file system to reveal running processes, mounts, network connections, ARP tables, and kernel versions.

APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.

Learn about administrative access and Remote Code Execution (RCE) exploitation from a recent Web Application Pentest.

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.