Contact us: info@tenendo.com

Blog

A technical blog focused on application and infrastructure security, with insights into secure coding practices, adversary simulation, and advanced penetration testing techniques.

We cover topics such as web and mobile application testing, especially within the fintech and banking sectors, as well as social engineering tactics, initial access techniques, and the development of custom malware, evasion methods, and command-and-control (C2) frameworks.

JNDI injection. Log4Shell case study

On December 10, 2021, Apache released a fix for CVE-2021-44228, a critical RCE vulnerability affecting Log4j that is being exploited in the wild.

JNDI injection. JDBC

Preventing JNDI injection vulnerabilities by using a source code review is always a good idea.

Avoiding Templates injection

The best way to prevent server-side template injection is to not allow any users to modify or submit new templates.

Avoiding other injections

Secure coding practices prescribe that spring expressions using dynamic values should be avoided.

Avoiding injection vulnerabilities

Injection attacks refer to a broad class of attack vectors. In an injection attack, an attacker supplies untrusted input to a program. This input gets processed by an interpreter as part of a command or query. In turn, this alters the execution of that program.

Avoiding XSS injection vulnerabilities

In this section, we'll describe some general principles for preventing cross-site scripting vulnerabilities and ways of using various common technologies

Services Delivery

Focused. Flexible. Transparent. At Tenendo, we tailor every engagement to your needs — no off-the-shelf solutions. Whether it’s a one-time assessment or a long-term collaboration, we work closely with your team to ensure clarity, alignment, and results at every stage. From planning to reporting, our delivery process is designed to be efficient,…