August Detlefsen

Software architect, senior security consultant and author focused on building a cooler, safer web.

[August Detlefsen @codemagi]

My Paste cURL Burp Suite extension is now live in the BApp Store! It allows you to take any curl command (e.g. from API docs) and paste it into Repeater as a raw HTTP request.

https://t.co/mXXnn32knb

[Jessie Ho @j3ssie]

While #BCheck from @PortSwigger is still a work in progress, I've already replicated some useful Burp extensions within BCheck. Explore them here https://t.co/qlZxq7da67
Of course, we have to thank you @albinowax and @jahadix @codemagi & more for their incredible original work 💪

[August Detlefsen @codemagi]

@ChaseSupport your certificates are expired for https://t.co/kxYX5wJat4. This is preventing pages from loading, particularly the login. When will this situation be fixed?

[August Detlefsen @codemagi]

@ctxt The real question should be: why would it interpret any "message to be logged" as a format?

[August Detlefsen @codemagi]

OWASP Security Logging v1.1.7 released, after much wrangling with the Nexus staging repository (I wonder if this is their busiest day ever?) https://t.co/1jfLgPkWHG

[August Detlefsen @codemagi]

@deviantollam Why ruin a good meal by making me do math at the end??

[August Detlefsen @codemagi]

@psiinon Remind me, what are pens?

[August Detlefsen @codemagi]

@manicode @omerlh At least in that case params would not stick around in RAM for as long as a String waiting for garbage collection.

[August Detlefsen @codemagi]

@manicode @omerlh What if a web server parsed all request params into byte[] (that's what an incoming request really is) until they were specifically called for in other types, then overwrote those arrays? If you could go directly from byte[] -> SecureString would that be better?

[August Detlefsen @codemagi]

@KevinWWall @ColumbusCrewSC @owasp Wow @KevinWWall ! That's dedication!

[August Detlefsen @codemagi]

@manicode @asanso @SchmiegSophie @jedisct1 Sigh* maybe you should explain that if you give out the symmetric (or private) key, you give people the ability to ISSUE tokens, as opposed to just verifying them.

[August Detlefsen @codemagi]

@manicode "Stick with the approved implementations in the corporate security standards"

[August Detlefsen @codemagi]

@eekim If we could all do that we'd be living in some kind of utopia.

[August Detlefsen @codemagi]

@thebensams @jeremiahg Learning? Time sink? You can 'learn' anything you want on stack overflow in a few seconds of googling /s

[August Detlefsen @codemagi]

@manicode Maybe not to write secure code. But to create secure _applications_ (many moving parts, high complexity) you need to be able to threat model. And to threat model you must be able to think like an attacker.

[August Detlefsen @codemagi]

@jeremiahg @manicode Tomcat does not always mean Struts. It could be any Java web application.

[August Detlefsen @codemagi]

@tagir_valeev That example is vulnerable to XXE attacks. In Java you need to disable DTD processing. See https://t.co/DWIiMQQVqX

[August Detlefsen @codemagi]

@wef We're talking about 1000s of tons of plastic per river, per year. Would a recycling operation find this a profitable source of raw materials?

[August Detlefsen @codemagi]

@dcuthbert @pinger Sometimes I wonder if the companies aren't signing my email up themselves. Maybe using out as free advertising that evades spam filters. Look we have millions of users! Cool how many are real? That's just it, nobody knows!

[August Detlefsen @codemagi]

@jeremiahg The cities are not comparable size/population. There'll be less in-town demand when they arrive at SLC vs San Jose/Bay Area. When they arrive at SLC those assets will spend more time idle and that's figured into the price of the rental.