DEV Community

#infosec

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Why CIDS Looks at Behavior, Not Just Individual Requests
cybermoranda profile

Why CIDS Looks at Behavior, Not Just Individual Requests

#cybersecurity #infosec #security
Comments
3 min read
CSWSH: Four Major WebSocket Frameworks Default to Vulnerable While Attackers Get a Bidirectional Channel
roxdavirox profile
Davi

CSWSH: Four Major WebSocket Frameworks Default to Vulnerable While Attackers Get a Bidirectional Channel

#cybersecurity #infosec #security
Comments
6 min read
Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint
roxdavirox profile
Davi

Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint

#authentication #cybersecurity #infosec #security
Comments
5 min read
RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked
roxdavirox profile
Davi

RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked

#api #cybersecurity #infosec #security
Comments
6 min read
Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials
roxdavirox profile
Davi

Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials

#api #cybersecurity #infosec #security
Comments
6 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
roxdavirox profile
Davi

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
Webhook Producers Are SSRF by Default: Seven CVEs the Security Guides Don't Mention
roxdavirox profile
Davi

Webhook Producers Are SSRF by Default: Seven CVEs the Security Guides Don't Mention

#backend #cybersecurity #infosec #security
Comments
5 min read
Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page
roxdavirox profile
Davi

Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page

#authentication #cybersecurity #infosec #security
Comments
5 min read
SAML XSW: Signatures That Validate the Wrong Element
roxdavirox profile
Davi

SAML XSW: Signatures That Validate the Wrong Element

#authentication #cybersecurity #infosec #security
Comments
5 min read
JWT Algorithm Negotiation Is a Spec Design Flaw, Not a Library Bug
roxdavirox profile
Davi

JWT Algorithm Negotiation Is a Spec Design Flaw, Not a Library Bug

#cybersecurity #infosec #security
Comments
5 min read
CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard
roxdavirox profile
Davi

CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard

#api #cybersecurity #infosec #security
Comments
6 min read
Wayback Machine for OSINT: What Stayed Archived After Remediation
roxdavirox profile
Davi

Wayback Machine for OSINT: What Stayed Archived After Remediation

#cybersecurity #infosec #security
Comments
5 min read
API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP
roxdavirox profile
Davi

API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP

#api #cybersecurity #infosec #security
Comments
6 min read
XXE in Document-Processing APIs: The Attack Surface Nobody Hardens
roxdavirox profile
Davi

XXE in Document-Processing APIs: The Attack Surface Nobody Hardens

#cybersecurity #infosec #security
Comments
5 min read
Working: CORS misconfigurations escape automated detection
roxdavirox profile
Davi

Working: CORS misconfigurations escape automated detection

#api #cybersecurity #infosec #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.