Zwarts

Application security. Web, mobile, and the details that matter.

[Zwarts @_zwarts_]

This week's weekly lab on @bugforgeio is a trip down memory lane.

If you grew up playing Half-Life, this one's for you. Black Mesa vibes meet real-world AppSec challenges.

https://t.co/Pyy8krYjks

#bugforge #appsec #ctf #halflife

[Zwarts @_zwarts_]

Today's @bugforgeio daily reminded me why I love business logic flaws: they're hiding in plain sight, waiting for someone to ask "but what if the server doesn't validate this?"

#AppSec #WebSecurity #BugForge #BusinessLogicVulnerabilities #bugbountytips

https://t.co/ZfXBa7lTB5

[Zwarts @_zwarts_]

If you’re sharpening your web & AppSec skills, @bugforgeio, created by the legendary @AppSecExp, is worth a look. Daily & weekly challenges, active community write-ups, first-bloods, and a competitive leaderboard to keep things spicy.

https://t.co/4RndfvJaB6

[Zwarts @_zwarts_]

@dccybersec What a legend, you’re truely inspiring! Congrats on the little one!

[Zwarts @_zwarts_]

@NahamSec You do indeed!

[Zwarts @_zwarts_]

@harshleenchawl2 Solid list! I’d definitely add
@0xTib3rius and @Tyler_Ramsbey to it. They’re both great resources.

[JS0N Haddix @Jhaddix]

I love to show this clip from “Dr Strange” to people getting into offensive security…

“Study and practice. Years of it”

👏✍️💯

https://t.co/xDNBAWZ8GK

[Maddy 🐝 @Cyb3rMaddy]

Reverse Shell with a CAPTCHA

Edited some HTML and with some user interaction, it downloads a reverse shell powershell script from a web server and runs it on the target.

Shoutout @_JohnHammond for the index.html

OUT NOW: https://t.co/psalz5O7sk

My GitHub link to this project so you have the scripts handy: https://t.co/G7wNcLhsSq

My blog link: https://t.co/zQtP1Kowgm

[Hack The Box @hackthebox_eu]

Leave your neighbor out of this 🙅
A new Module is here to teach you about Wi-Fi security. Learn how to exploit vulnerabilities in #wifi networks, discover hidden networks, and bypass MAC filtering implemented by access points using aircrack-ng tools: https://t.co/cTDzD8IRSP

[Hack The Box @hackthebox_eu]

Not all that shines is gold ☝️
The AT&T breach, a major security incident, occurred due to compromised #Snowflake credentials. Here's how you can learn and practice the #breach techniques! Dive deeper into the attack breakdown on our #blog: https://t.co/3t7Mt7geIg

[bugcrowd @Bugcrowd]

.@nahamsec's list of tools for beginner bug hunters! 🧰👇

🔧 Proxy & Network Sniffers
🔨 Burp Extensions
⚒️ Recon, OSINT & Discovery
🛠️ Exploitation
🪛 Scanners
🪚 Mobile Hacking
🗜️ Notes & Organization
⛏️ Others

Check it out here 👇
https://t.co/NFZmIg3K7K

[Zwarts @_zwarts_]

@hackthebox_eu That SQLi!

[Milan Jovanović @mjovanovictech]

Are you accidentally crippling your EF Core queries?

Before you start bashing on EF Core, this is an SQL problem, not an EF problem.

But it can be problematic to find and fix with EF Core.

Understand the Cartesian Explosion problem and how it occurs in your queries.

I'll also give you a practical solution using EF Core's query-splitting feature.

Watch the full video here: https://t.co/vsG1Uuj6yb

[Jeppe H. Olesen @jeppe_olesen]

F1 is back and heading to the sunny beaches of the Netherlands. That also means we have a bunch of news to talk about!

Here's what's new in F1 since last week:

- Pete Bonnington promoted to Head of Race Engineering at Mercedes; he will not be joining Hamilton at Ferrari in 2025
- Helmut Marko on Liam Lawson: "He'll definitely be in one of our cars next year"
- Max Verstappen responds to the Kyle Larson "I'm a better all-around driver" statement
- FIA spokesman on change to asymmetric brake system rule: "There is no truth that any team was using such a system"
- Sergio Perez will have a new race engineer, as his regular engineer Hugh Bird goes on paternity leave
- Yuki Tsunoda still an option for Red Bull in 2025 according to VCARB CEO Peter Bayer
- Liberty Media is selling ~€700 million worth of Formula 1 stock to fund their purchase of MotoGP
- Investment group Emodrom will acquire 74.99% ownership of the Hockenheimring and will invest ~€250 million over the next decade to improve the track and facilities
- F1 has been enforcing their trademarks causing content creators to change their usernames
- Andrea Kimi Antonelli will do FP1 at Zandvoort with Mercedes
- Robert Shwartzman will do FP1 at Zandvoort with Sauber
- Ticket resellers are returning thousands of unsold tickets to the Dutch GP
- Isotta Fraschini announce immediate withdrawal from WEC
- Nina Gademan will participate in the Zandvoort F1 Academy Race
- Meyer Shank Racing will move from Andretti to Ganassi in IndyCar
- Red Bull E-Sports sign two-time World Esports Champion Jarno Opmeer
- Prema / Iron Dames driver coach Luca Persiani has passed away
- Dirt racing legend Scott Bloomquist has passed away

Did I miss anything?

#F1 #Formula1 #Indycar #WEC #F1Academy

[Joey_Jay @Joey_Mukando]

You have to be wise enough to know when you’re living your dream and humble enough to accept when you’re living in someone else’s ~ Dave Chappelle, The Dreamer

[Zwarts @_zwarts_]

@manishkumar_dev @or975

[Maximilian @maxedapps]

Major releases everywhere!

https://t.co/mxLhFGIycS

[Sahn Lam @sahnlam]

Cookies vs sessions for managing user session

Cookies and sessions are both used to carry user login credentials and permissions over HTTP requests.

🔹 Cookies
- Cookies typically have size limits of 4KB
- Used to store user login credentials or permissions
- Sent with each subsequent request by logged in user
- Users can disable cookies in their browser, which may log them out

🔹 Sessions
- Created and stored on the server-side
- Server generates a unique session ID
- Session ID links to a specific user session
- Session ID can be sent back to client in a cookie, URL parameters, or HTTP headers
- Can hold more data than cookies
- Offer more security than cookies because session data is not directly accessed by the client

–
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): https://t.co/kNfv0DVDdf

[LetsDefend @LetsDefendIO]

How HTTPS Works ?

[LetsDefend @LetsDefendIO]

OSI Reference Model