Blog

Spring4Shell as a class injection example

Two serious vulnerabilities leading to remote code execution (RCE) have been found in the popular Spring framework, one in Spring… Read more

DORA and PCI DSS

Article will help to introduce DORA requirements to those who have years of cybersecurity experience but are very new to… Read more

JNDI injection

Java Naming and Directory Interface (JNDI) is a Java API that allows clients to discover and look up data and… Read more

JNDI injection. Log4Shell case study

On December 10, 2021, Apache released a fix for CVE-2021-44228, a critical RCE vulnerability affecting Log4j that is being exploited… Read more

JNDI injection. JDBC

Preventing JNDI injection vulnerabilities by using a source code review is always a good idea. Read more

Secure secrets management in Docker containers. Part 1

Secure secrets management in Docker containers from the offensive point of view. With examples and demo scripts. Read more

Secure secrets management in Docker containers. Part 2

Secure secrets management in Docker containers from the offensive point of view. Secrets in memory. Secrets in build arguments Read more

Bash/zsh scripts. Part 3

Secure secrets management in Docker containers from the offensive point of view. Secrets in bash/zsh scripts. Secrets in logs. Read more

Git secret leaks

Secure secrets management in git from the offensive point of view. With examples and demo scripts. Read more

Obtain secrets from different sources

Obtain secrets from storage buckets, static landing pages and other static content with examples Read more

Avoiding injection vulnerabilities

Injection attacks refer to a broad class of attack vectors. In an injection attack, an attacker supplies untrusted input to… Read more

Applying Henry Ford’s Management Principles to software development

Applying Henry Ford's principles to software development emphasizes efficiency, standardization, and continuous improvement. Streamline processes, reduce waste, and optimize workflows… Read more