Technical | Web Application Pentesting

Walking Through an Attack Path with ForceHound

April 17, 2026

Technical | Web Application Pentesting

Auditing Salesforce Permission Hierarchies with ForceHound 

April 17, 2026

Executive | Web Application Pentesting

Vibe Coding: A Pentester’s Dream

September 3, 2025

Executive | Web Application Pentesting

Assessing the True Business Impact of a Malicious Connected App

August 14, 2025

Technical | Web Application Pentesting

Getting Shells at Terminal Velocity with Wopper

April 23, 2025

Technical | Red Teaming

CVE-2025-27590 – Oxidized Web: Local File Overwrite to Remote Code Execution

April 9, 2025

Technical | Web Application Pentesting

A Not So Comprehensive Guide to Securing Your Salesforce Organization

March 31, 2025

Technical | Web Application Pentesting

Exploiting Second Order SQL Injection with Stored Procedures

December 22, 2024

Technical | Web Application Pentesting

From Informational to Critical: Chaining & Elevating Web Vulnerabilities

December 10, 2024

Technical | Web Application Pentesting

CVE-2024-37888 – CKEditor 4 Open Link plugin XSS

August 27, 2024

Technical | Web Application Pentesting

Prototype Pollution: A Deep-Dive

June 24, 2024

Technical | Web Application Pentesting

Why TOTP Won’t Cut It (And What to Consider Instead)

January 18, 2024

Technical | Web Application Pentesting

Exploiting XPath Injection Weaknesses

November 30, 2023

Technical | Web Application Pentesting

Macros Demystified

September 22, 2023

Technical | Web Application Pentesting

Introduction to Smart Contract Security and Decentralized Web Applications

July 7, 2022

Technical | Web Application Pentesting

Burp Suite Extension: AWS Signer 2.0 Release

March 31, 2022

Technical | Web Application Pentesting

Azure SAS Tokens for Web Application Penetration Testers

January 6, 2022

Technical | Web Application Pentesting

Escape NodeJS Sandboxes

November 27, 2018

Technical | Web Application Pentesting

XXE in IBM's MaaS360 Platform

October 16, 2018

Technical | Web Application Pentesting

Introducing Burp Extractor

August 7, 2018

Technical | Web Application Pentesting

Attacking Application Specific SQL Server Instances

May 8, 2018

Technical | Web Application Pentesting

Jira Information Gathering

March 13, 2018

Technical | Web Application Pentesting

CAPTCHAs Done Right?

March 9, 2018

Technical | Web Application Pentesting

Weaponizing self-xss

February 12, 2018

Technical | Web Application Pentesting

Insecurity Through Obscurity

January 22, 2018

Technical | Web Application Pentesting

NetSPI SQL Injection Wiki

December 19, 2017

Technical | Web Application Pentesting

DNS Tunneling with Burp Collaborator

September 26, 2017

Technical | Web Application Pentesting

XSS Using Active Directory Automatic Provisioning

August 17, 2017

Technical | Web Application Pentesting

Anonymous SQL Execution in Oracle Advanced Support

July 5, 2017

Technical | Web Application Pentesting

Application Self Protection – A New Addition to the OWASP Top 10

June 6, 2017

Technical | Web Application Pentesting

Beautifying JSON in Burp

May 16, 2017

Technical | Web Application Pentesting

SQL Injection to Help You Sleep at Night

April 25, 2017

Technical | Web Application Pentesting

Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them

March 7, 2017

Technical | Web Application Pentesting

Defeating CSRF Protections Through Expired cross-domain.xml Domains

February 21, 2017

Technical | Web Application Pentesting

Attacking JavaScript Web Service Proxies with Burp

February 14, 2017

Technical | Web Application Pentesting

Username Discovery

January 30, 2017

Technical | Web Application Pentesting

Login Portal Security 101

January 23, 2017

Technical | Web Application Pentesting

Java Deserialization Attacks with Burp

March 2, 2016

Technical | Web Application Pentesting

Directory Traversal, File Inclusion, and The Proc File System

February 23, 2016

Technical | Web Application Pentesting

Hashdump without the DC using DCSync (because we all wanted it)

October 2, 2015

Technical | Web Application Pentesting

Exploiting MS15-076 (CVE-2015-2370)

August 12, 2015

Technical | Web Application Pentesting

Tearing Apart a Datto Device

June 18, 2015

Technical | Web Application Pentesting

Debugging Burp Extensions

May 26, 2015

Technical | Web Application Pentesting

Forcing XXE Reflection through Server Error Messages

May 4, 2015

Technical | Web Application Pentesting

Playing with Content-Type – XXE on JSON Endpoints

April 20, 2015

Technical | Web Application Pentesting

Decrypting WebLogic Passwords

April 6, 2015

Technical | Web Application Pentesting

ActiveX + XSS = ActiveXSS Pwnage!

March 5, 2015

Technical | Web Application Pentesting

Advisory: XXE Injection in Oracle Database (CVE-2014-6577)

January 21, 2015

Technical | Web Application Pentesting

Advisory: Oracle Forms 10g Unauthenticated Remote Code Execution (CVE-2014-4278)

October 14, 2014

Technical | Web Application Pentesting

The Illusion of Security

August 22, 2013

Technical | Web Application Pentesting

Java Obfuscation Tutorial with Zelix Klassmaster

July 15, 2013

Technical | Web Application Pentesting

Magic Bytes – Identifying Common File Formats at a Glance

July 8, 2013

Technical | Web Application Pentesting

Great, you use CA SiteMinder, but you broke it!

June 17, 2013

Technical | Web Application Pentesting

Covert Exfil from a Target Network

May 3, 2013

Technical | Web Application Pentesting

Backdooring Office Documents

March 23, 2013

Technical | Web Application Pentesting

Hacking Web Services with Burp

March 5, 2013

Technical | Web Application Pentesting

Tool release: AMF Deserialize Burp Plugin

January 9, 2013

Technical | Web Application Pentesting

OWASP AppSec 2012 Presentation: SQL Server Exploitation, Escalation, and Pilfering

November 5, 2012

Technical | Web Application Pentesting

Thoughts on Web Application Firewalls

October 15, 2012

Technical | Web Application Pentesting

Web Application Testing: What is the right amount?

June 22, 2012

Technical | Web Application Pentesting

SQL Injection: Death by Blacklist

December 22, 2010

Technical | Web Application Pentesting

Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy

September 24, 2010

Technical | Web Application Pentesting

Presenting at OWASP AppSec Conference

August 16, 2010

Technical | Web Application Pentesting

Are You Testing Your Web Application for Vulnerabilities?

May 5, 2010

Technical | Web Application Pentesting

Do Not Use the Back Door!

November 6, 2009

Technical | Web Application Pentesting

Preventing SQL Injection at the Database

October 16, 2009