Application security

Introduction In the first installment of this series, we discussed application security within the Software Development Process by demystifying the adoption

In this paper we will discuss HTTP Response Splitting and how the attack can actually be carried out. When we're clear about how it works, because it is an o

In the previous article, we discussed forming a SOAP request based off the operations listed in a WSDL file and automating this task with Buby and Burp Suite

I often receive testing related questions from AppSec folks new to web services about the techniques used to discover and attack them. Often, web services ar

[highlight color="blue"]Interested in formal OWASP Top 10 Training? Check out our  OWASP Top 10 Training course OWASP Top 10 Training. [/highlight] Descripti

What is Arachni? In very simple terms, Arachni is a tool that allows you to assess the security of web applications. [pkadzone zone="main_top"] [pka

Description: Parsing the OWASP Top Ten with a closer look at Cross-Site Request Forgery (CSRF). No freely available or open source tools "automagically" discovers CSRF vulnerabilities; you have to step through the app as described above and test against locally installed vulnerable applications and devices unless you have explicit permission to test remote applications per an approved penetration testing engagement.

A tool for each of the OWASP Top 10 to aid in discovering and remediating each of the Top Ten If you've spent any time defending web applications as a sec