06 September 2018

Find Security Bugs can often uncover interesting findings that may lead to the discovery of critical vulnerabilities. However, the process of using Find Security Bugs can be a little bit tedious to unseasoned Java users. Also, the process of analyzing compiled code and triaging the findings needed improvements. Here is the solution that was built to find vulnerabilities at scale.

October 12, 2016

Our old blog was officially migrated into its new home in our website! Our previous blog will redirect you here automatically.

Remember to update your bookmarks.

June 28, 2016

Content Security Policy (CSP)  is a HTTP header that instruct the browser to limit resource loading of media, styles and scripts.

As you may know, CSP is not adopted yet by industry. Multiple surveys have already been made about the adoption of the security header [1] [2] [3]. Even so, it does not mean that we cannot prepare ourselves for the technology. For this purpose, we have built a Burp and ZAP extension to automate the most common validations called CSP Auditor.

May 26, 2016

In this article, we will be looking at the strategies to detect and analyze malware hidden inside an OPcache file. If you haven't read our previous article about hiding a binary webshell inside a PHP7 OPcache file, we suggest reading it before moving on.