Contact us: info@tenendo.com

Blog

A technical blog focused on application and infrastructure security, with insights into secure coding practices, adversary simulation, and advanced penetration testing techniques.

We cover topics such as web and mobile application testing, especially within the fintech and banking sectors, as well as social engineering tactics, initial access techniques, and the development of custom malware, evasion methods, and command-and-control (C2) frameworks.

Git secret leaks

Secure secrets management in git from the offensive point of view. With examples and demo scripts.

Bash/zsh scripts. Part 3

Secure secrets management in Docker containers from the offensive point of view. Secrets in bash/zsh scripts. Secrets in logs.

Insecure deserialization

Insecure deserialization is when user-controllable data is deserialised by a website. This potentially enables an attacker to manipulate serialised objects in order to pass harmful data into the application code.

Input processing vulnerabilities

Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. When software does not validate input properly, an attacker is able to craft the input in a form that is not expected by the rest of the ap…

Spring4Shell as a class injection example

Two serious vulnerabilities leading to remote code execution (RCE) have been found in the popular Spring framework, one in Spring Core and the other in Spring Cloud Functions.

JNDI injection

Java Naming and Directory Interface (JNDI) is a Java API that allows clients to discover and look up data and objects via a name.