Our sole purpose is to make security concepts accessible for all developers | We taught 320+ developers how to secure their applications.
Paris
Joined September 2023
- Tweets962
- Following431
- Followers513
- Likes799
Devsecurely retweeted
In soccer, the goal is the surface area defined by the goalposts.
The goalkeeper knows exactly what to defend.
You should identify all the websites you own that are accessible on the internet.
Clearly define the attack surface you need to defend.
Devsecurely retweeted
If you’re interested in getting started in cryptography, check out the crypto 101 course by Dr. Alfred Menezes from UWaterloo.
cryptography101.ca
He’s planning on publishing the lectures from his Applied Cryptography course, which was my introduction to the field.
Devsecurely retweeted
Scanning images for vulns in CI/CD can prevent security issues hitting prod, but any changes will take time to apply.
Scanning images for vulns in development will find the same issues, but it will be much quicker and easier to fix them.
Devsecurely retweeted
"Everyone has to be presumed innocent until proved guilty"
- Universal Declaration of Human Rights
"User input has to be presumed guilty until proved innocent"
- Jingle for baby hackers
Devsecurely retweeted
This was a case of default credentials left on the Foundations Software SQL servers, publicly exposed for mobile app usage.
If you have Foundations in your stack, plz rotate the DB admin passwords
A threat actor has been spraying&praying default creds to get xp_cmdshell access.
🚨👷♀️ The @HuntressLabs SOC is seeing wide-spread attacks against Construction companies.
Early evidence links the intrusions to Foundation Software, a provider of construction accounting software built for contractors. We're still working to confirm if this link is accurate.
🕑 Initial activity began around 2024-09-14 15:38:35 UTC
🔍 You can expect to see host/domain enumeration commands spawning from a parent process of `sqlservr.exe`.
Plumbing, HVAC, Concrete, and similar sub-industries appear to be common victims in our findings.
Devsecurely retweeted
This is a cool project, shows you what percentage of ads you’re blocking. Tried it on wifi with @The_Pi_Hole doing its thing then on 5G, check the results: d3ward.github.io/toolz/adblo…
Devsecurely retweeted
Using an ORM does not mean you're safe.
On a recent security training, developers told me how they are protected against SQL injection because they use an ORM.
Turns out they WERE affected because they use raw SQL queries when the ORM doesn't allow them to do complex operations
Devsecurely retweeted
If your defense hinges on the attacker being incompetent, then it's a bad defense.
Always assume your users are world class hackers. Leave nothing to chance
Devsecurely retweeted
Im looking to #connect with people who are interested in
🌐Web Development
🎨Front end
⚙️Coding
🦏 Javascript
🏗 Building online
🔧 DevOps
🚀UI/UX
📂 Open Source
💻Software Development
💼 Freelancing
#letsconnect #buildinpublic #tech
Devsecurely retweeted
Wormable Substack XSS: blog.calif.io/p/wormable-sub…
It must have been years since the last time a wormable XSS was found in a major social media website. This beautiful type confusion XSS attack vector is a gift that keeps on giving.
But most of all, @samykamkar is our hero!
Type confusion attacks in ProseMirror editors
blog.calif.io/p/type-confusi…
Devsecurely retweeted
CORS : The ultimate guide : devsecurely.com/blog/2024/06… credits @devsecurely
Devsecurely retweeted
New blog post and tool release: plORMbing your Prisma ORM with Time-based Attacks
elttam.com/blog/plorming-you… and
github.com/elttam/plormber/
Devsecurely retweeted
Got a new blog out about detections and hunting in AWS Bedrock - definitely a new area for me to explore - learned a lot writing this one.
Also a tad bittersweet as this will be my final blog at Sumo - a new & exciting journey begins next week!
sumologic.com/blog/defenders…
Devsecurely retweeted
This article was written by @Hacker_Content!
If you need cybersecurity-focused content like this for your organisation, head to our website and get in touch today 👇
hackercontent.com/
Devsecurely retweeted
New Critical RCE Vulnerability Discovered in Apache Struts 2 - Patch Now: Apache has released a security advisory warning of a critical security flaw in the Struts 2 open-source web application framework that could result in remote code execution.… thehackernews.com/2023/12/ne…
