PentesterLab

Don’t just learn tools and payloads. Learn why vulnerabilities exist. Hands-on web hacking, security code review, and real-world CVE labs.

[PentesterLab @PentesterLab]

💥🐹 4 new Go Code Review Labs just dropped! 🐹💥

Read the code, peek at the diff, find the bug.

Sharpen your skills: https://t.co/0Y56bXk2oa

[PentesterLab @PentesterLab]

All the labs in our threat modelling badge are now available!

We built this badge around practical, high leverage skills that help you spot potential threats and ask better security questions when designing, developing or using AI to build your next application.

https://t.co/9d5qfbvTFp

[PentesterLab @PentesterLab]

Stranger Strings.

Some inputs open doors to another dimension. Others open a reverse shell.

Which one scares you more?

[PentesterLab @PentesterLab]

Sometimes, doing code review is just as easy as playing spot the difference...

Two handlers, same file, 40 lines apart. Same auth decorator, so both need a valid login. Both read current_user_id.

Both read group_id from the request body.

One asks whether you're allowed to see that group. One doesn't.

You don't need to have in-depth understanding of Python, authorisation logic or code review.

You just need the right idea: "Are all those functions checking the same thing, if not, what is the security impact?"

CVE-2026-121552

[ju4dy @jundybaba]

I just completed @Pentesterlab's Recon Badge!!!
unto the next

[PentesterLab @PentesterLab]

@kerberoasting Thank you!

[PentesterLab @PentesterLab]

A Go bug put the private key inside the certificate, in clear text (CVE-2025-6224).

The culprit: h.Sum(key) doesn't hash key. It appends the hash of nothing to key.

https://t.co/glhBARWG9Q

[joao tonetto @kerberoasting]

Watching DEFCON talks, I heard about PentesterLab and decided to give it a try. Coming from HTB and THM, I found it way more educational. The labs are realistic and quick, but the code review videos are the real game changer for understanding API workflows behind the scenes.

[PentesterLab @PentesterLab]

@MrTuxracer Funnily, I was looking at CVE-2026-125357 a few hours ago...

[PentesterLab @PentesterLab]

Would you rather only be allowed to pentest using Nikto, or only be allowed to pentest Perl applications?

[𝘻𝘰𝘪𝘥𝘴𝘦𝘤 @z0idsec]

If you're wanting to level up your code review skills, I would highly recommend @PentesterLab's on demand training, I've completed the training and the amount of information covered is insane and you learn techniques from an industry veteran @snyff.

https://t.co/LwrB5RIwGx

[PentesterLab @PentesterLab]

If you use a whole package for one small helper, consider the updates, maintenance and trust you take on. Removing unused functionality or replacing a tiny helper with simpler, tested code you can maintain may be worthwhile.

https://t.co/2nVqW3Mlsv

[PentesterLab @PentesterLab]

Remember: the codebase you're reviewing is alive, and it won't stop changing just because you're taking notes.

When documenting a potential vulnerability, don't record only the filename and line number. Code moves, code changes, files get renamed, and your reference might point to something completely different by the time someone reads your findings.

Always keep the filename, line number, commit hash, and a copy of the relevant code, along with an explanation of the issue. If you include a link, make sure it points to that specific commit, not to the branch.

Your notes should still make sense after the code has changed.

[刘灏 LiuHao @GuanShanZhe]

I just completed @Pentesterlab's Serialize Badge!!!

[PentesterLab @PentesterLab]

@GuanShanZhe Congrats!

[刘灏 LiuHao @GuanShanZhe]

I just completed @Pentesterlab's Java Deserialization Badge!!!

[PentesterLab @PentesterLab]

Java gotcha: concatenating a null reference doesn't throw. It becomes the four characters "null".

In Tomcat's digest authentication, a missing user's password became "null" (CVE-2026-43512). When code hashes a lookup result, look for the null check.

https://t.co/LXwcFCwX6B

[PentesterLab @PentesterLab]

Say "we don’t validate signatures" again.

I dare you. I double dare you.

[PentesterLab @PentesterLab]

Spend some time and tokens auditing the third-party code you rely on. Someone else may keep a zero-day private or publish it at the worst time for you. Your own reviews give you a chance to find and fix bugs earlier.

[PentesterLab @PentesterLab]

"We've automated the entire pentest"

[PentesterLab @PentesterLab]

What’s your perfect setup? 😁