Clickjacking 101: What is Clickjacking and How Does it Work?

Clickjacking 101: What is Clickjacking and How Does it Work?

Clickjacking, also known as UI Redressing, is a technique that tricks users into clicking on unintended elements on a website. By using hidden elements, attackers deceive users into performing actions that they did not intend to carry out. Learn more about...
What is Cross-Site Scripting (XSS)?

What is Cross-Site Scripting (XSS)?

Overview Cross-Site Scripting (XSS) is a type of security vulnerability in web applications that enables an attacker to insert malicious code into a web page that can be viewed by other users (typically in the form of scripts). When a web application fails to properly...
What is Threat Modeling and Why You Should Use it

What is Threat Modeling and Why You Should Use it

Threat modeling is a process used to identify potential threats and weaknesses in a system. It involves breaking down a system and examining it to better understand what needs protecting, who might attack it, and how it can be protected. So who needs to be involved?...
How to Get Started with Code Review

How to Get Started with Code Review

Code review is an essential part of the web application penetration testing process but is often overlooked. We’re going to look at why it’s important and how to get started. There are a number of reasons why we might decide to review the source code of an application...
Penetration Testing – From Adversary to Partner

Penetration Testing – From Adversary to Partner

While penetration testing can be considered “adversarial” testing, it should be anything but that. Your penetration test, no matter who you do it with, should be a partnership. In every partnership, communication is key. Settling for a pentest company that merely...
Getting Started with Offensive JavaScript

Getting Started with Offensive JavaScript

JavaScript is a bit like Marmite, you either love it or hate it. Regardless of how it makes us feel, it is a powerful tool for attacking users and exploitation. Often, popping alert(1) is proof enough to get a fix but doesn’t demonstrate the full impact an attacker...