DEV Community

#infosec

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint
roxdavirox profile
Davi

Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint

#authentication #cybersecurity #infosec #security
Comments
5 min read
CSWSH: Four Major WebSocket Frameworks Default to Vulnerable While Attackers Get a Bidirectional Channel
roxdavirox profile
Davi

CSWSH: Four Major WebSocket Frameworks Default to Vulnerable While Attackers Get a Bidirectional Channel

#cybersecurity #infosec #security
Comments
6 min read
Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page
roxdavirox profile
Davi

Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page

#authentication #cybersecurity #infosec #security
Comments
5 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
roxdavirox profile
Davi

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
Webhook Producers Are SSRF by Default: Seven CVEs the Security Guides Don't Mention
roxdavirox profile
Davi

Webhook Producers Are SSRF by Default: Seven CVEs the Security Guides Don't Mention

#backend #cybersecurity #infosec #security
Comments
5 min read
SAML XSW: Signatures That Validate the Wrong Element
roxdavirox profile
Davi

SAML XSW: Signatures That Validate the Wrong Element

#authentication #cybersecurity #infosec #security
Comments
5 min read
Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials
roxdavirox profile
Davi

Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials

#api #cybersecurity #infosec #security
Comments
6 min read
RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked
roxdavirox profile
Davi

RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked

#api #cybersecurity #infosec #security
Comments
6 min read
Wayback Machine for OSINT: What Stayed Archived After Remediation
roxdavirox profile
Davi

Wayback Machine for OSINT: What Stayed Archived After Remediation

#cybersecurity #infosec #security
Comments
5 min read
JWT Algorithm Negotiation Is a Spec Design Flaw, Not a Library Bug
roxdavirox profile
Davi

JWT Algorithm Negotiation Is a Spec Design Flaw, Not a Library Bug

#cybersecurity #infosec #security
Comments
5 min read
Working: CORS misconfigurations escape automated detection
roxdavirox profile
Davi

Working: CORS misconfigurations escape automated detection

#api #cybersecurity #infosec #security
Comments
5 min read
XXE in Document-Processing APIs: The Attack Surface Nobody Hardens
roxdavirox profile
Davi

XXE in Document-Processing APIs: The Attack Surface Nobody Hardens

#cybersecurity #infosec #security
Comments
5 min read
API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP
roxdavirox profile
Davi

API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP

#api #cybersecurity #infosec #security
Comments
6 min read
CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard
roxdavirox profile
Davi

CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard

#api #cybersecurity #infosec #security
Comments
6 min read
Subdomain Takeover Severity Comes From Security Context, Not the Exploit Mechanism
roxdavirox profile
Davi

Subdomain Takeover Severity Comes From Security Context, Not the Exploit Mechanism

#cybersecurity #infosec #security
Comments
6 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.