Ben-Hur Santos OttforGuia de AppSec :: Blogblog.guiadeappsec.com.br·12 hours agoAppSec Newsletter 0010Links [artigo + video] Technical Introduction to Software Bill of Materials (SBOMs) [artigo] 5 Best Practices for Securing Your API Gateway [tool] OWASP Risk Rating Calculator [tool] dockle - Container Image Linter for Security, Helping build the...Discussappsec
Ben-Hur Santos OttforGuia de AppSec :: Blogblog.guiadeappsec.com.br·Sep 25, 2023AppSec Newsletter 0009[vídeo] Using IAST to Unlock the Benefits of DevSecOps • Jeff Williams • YOW! 2022 [artigo] How to switch to a ModSecurity WAF alternative before it is EOL in March 2024? [site] Web AppSec Interview Questions by Tib3rius [framework] SSDF - Secure ...Discuss·1 like·39 readsappsec
Hung Ngohungoboss.hashnode.dev·Sep 23, 2023Between the Lines: What are the secrets in your code?One critical aspect of security is ensuring that sensitive data, such as passwords, API keys, and encryption keys, are not accidentally exposed in your source code. These sensitive data are usually called “secrets”, and for penetration testers, they ...Discusssecrets
Roger Abendibarotech-1695071453338.hashnode.dev·Sep 22, 2023Critical GitLab Vulnerability Demands Immediate PatchingGitLab has released an emergency security patch to address a critical remote code execution vulnerability, CVE-2023-4998, rated 9.6/10 in severity. All GitLab users are urged to install the patch immediately to prevent potential compromise. The updat...DiscussGitHub
Ben-Hur Santos OttforGuia de AppSec :: Blogblog.guiadeappsec.com.br·Sep 18, 2023AppSec Newsletter 0008Links [artigo] Github Blog :: Introducing auto-triage rules for Dependabot [cursos] ProdSec Academy :: Treinamentos em AppSec (2 dias free trial) [tool] Microsoft OSSGadget :: Collection of tools for analyzing open source packages. [artigo] Semgr...Discuss·54 readsappsec
Ben-Hur Santos OttforGuia de AppSec :: Blogblog.guiadeappsec.com.br·Sep 9, 2023AppSec Newsletter 0007Links [video] From SSRF to EKS Cluster takeover by Crowsec [video] JWT Authentication Bypass via Algorithm Confusion by Intigriti [artigo] Cloud storage security: What’s new in the threat matrix by Microsoft [tool] charmbracelet/gum: Uma tool par...Discuss·62 readsappsec
Ben-Hur Santos OttforGuia de AppSec :: Blogblog.guiadeappsec.com.br·Sep 3, 2023AppSec Newsletter 0006Bom dia champs! Chegamos a mais uma edição da nossa newsletter! Links [artigo] A Guide to Threat Modelling for Developers [artigo] Smashing the state machine: the true potential of web race conditions [curso - youtube] OWASP API Security Top 10 Co...Discuss·35 readsappsec
Hung Ngohungoboss.hashnode.dev·Aug 25, 2023SAST, DAST, IAST and RASP, what's the difference?In the application security world, we often use a lot of fancy catchphrases and abbreviations that might leave some people flummoxed. I have struggled with the initial understanding which is why I have decided to put together this short and simple ar...Discuss·51 readsappsec
Zeroday Co., Ltd.zeroday.hashnode.dev·Aug 24, 2023The Role of Penetration Testing in AppsecPenetration testing plays an important role in application security by identifying vulnerabilities and weaknesses in applications. It helps to: Find vulnerabilities that automated tools missMimic real-world attacksProvide insights on how to improve s...DiscussSecurity
Ben-Hur Santos OttforGuia de AppSec :: Blogblog.guiadeappsec.com.br·Aug 19, 2023AppSec Newsletter 0004E chegamos a mais uma edição da nossa newsletter semanal! [video] Gamifying Security by Github [tool] Nuclei Templates Editor (coooom IA óbvio) [artigo] Demystifying DREAD and STRIDE Threat Modeling for Kubernetes Security by Practical DevSecOps ...Discuss·43 readsnewsletter
