#appsec

2023-03-14 DevSecOps can take development to new heights My guest post on Kode24: how folding security into DevOps lets developers ship fast and safely, from defensive coding and reusable libraries to behavioural monitoring.
2022-01-20 Hacker techniques developers should know in 2022 My Kode24 guest post walking developers through four attack classes worth understanding: SQL injection, XXE, XSS, and SSRF, with the defensive takeaway for each.
2021-12-20 Fuzzing: maybe every developer should test their apps with all bytes My Kode24 guest post on fuzzing: why developers, who understand their own code best, should throw every byte at it and investigate anything that responds oddly.
2017-10-09 Smart house attack vectors Beyond WPA2 and a firewall: WPS, pre-compromised LAN hosts, evil-maid USB attacks, weak ISP routers, leaked credentials, and sub-GHz radio protocols.
2014-12-04 Finding zero-day XSS through document metadata Embedding XSS payloads in EXIF and document metadata, and using the technique to find zero-days in image-sharing sites and WordPress.
2012-10-06 XSS explained The three ways to deliver a Cross-Site Scripting payload, the attack vectors that make it dangerous, and a short history of XSS in the wild.