API Discovery with Kiterunner

API Discovery with Kiterunner

Content discovery is often focused on finding files and folders. However, modern applications not longer conform to this hierarchical approach and specifically applications that use APIs. Kiterunner is a tool that can be used to discover routes and endpoints used in...
Encoding and Decoding Primer

Encoding and Decoding Primer

When testing web applications, the understanding and use of various encoding schemes is a fundamental skill. In particular, we often see Base64, URL encoding, and HTML encoding used across many applications both as part of the application’s general functionality and...
BFLA: Broken Function Level Authorization

BFLA: Broken Function Level Authorization

Application Programming Interfaces (APIs) are at the heart of modern applications, enabling functionality, communication and acting as a bridge between different software components. A common issue that’s found though is Broken Function Level Authorization (BFLA), and...
The Best Apps for Keeping Notes: Pros & Cons

The Best Apps for Keeping Notes: Pros & Cons

What is the best note-taking application for pentesters? It’s a hot debate, and if you prefer to watch than read then we recently compared many of the popular options in this video. Otherwise, let’s take a look at what each app has on offer to help you decide what’s...
ID Tokens vs Access Tokens: What’s the Difference?

ID Tokens vs Access Tokens: What’s the Difference?

In the realm of secure authentication, two key elements often come to the fore: ID tokens and access tokens. Though these elements might seem similar, understanding their differences, common pitfalls, and best practices is crucial in ensuring the security of your...