Mohamed

Application security @Doyensec

[Doyensec @Doyensec]

Our new post shows how #AWS ELBs break #security boundaries via rule shadowing, CloudFront/WAF bypasses, & alternate routing.

📢 Plus ELBaph - a new tool to map routing graphs, detect exposed paths & find attack chains across ALBs/NLBs

https://t.co/K5Lq2V5Pws

#AppSec #Doyensec

[anaxim @lacerenza_fra]

Just released with @ouadmoha a Malicious SSO IdP for OIDC / SAML / SCIM security testing.

If you are trying to exploit a Service Provider, you should check maSSO 🪨 at
https://t.co/JjRAgiyf3L

Built at @Doyensec

[Doyensec @Doyensec]

AuthN/Z is always a #security minefield & MCP adds even more complexity with agents, remote servers, and transitive trust.

This @goteleport -sponsored deep dive breaks down attack vectors & why each step is a potential trust boundary.

🔗 https://t.co/vOXy5t7sxV

#doyensec #ai

[Doyensec @Doyensec]

🧞Your wish has been granted - the latest @pagedout_zine edition is out! In it, our @tell1c0 takes a quick look at #vibecoding, walking through the creation of an AI agent🤖. Check it out today!

#doyensec #appsec #ai #Security

https://t.co/s6279LYJzI

[Doyensec @Doyensec]

🚨Just posted🚨: Learn about real-world API authorization vulnerabilities we frequently see with the slides from @tell1c0's recent presentation at @CONFidenceConf in Krakow.

https://t.co/a1BTDuFkUC

#doyensec #appsec #security

[Doyensec @Doyensec]

🥳The latest !exploitable is here! We're sharing all the joy that comes with exploiting an arbitrary file write in GitLab, while cruising the Mediterranean. 🚢 Everything from onerous configurations to spotty internet! Enjoy! #doyensec #appsec #security

https://t.co/AMdtG4PWDX

[Doyensec @Doyensec]

Despite being central to their security, many orgs struggle to securely implement #OAuth. Our new post walks through common issues & how to prevent them, along with a useful checklist! Read it today & ensure your org is secure: https://t.co/UHLlE9vlQB

#doyensec #security #appsec

[Doyensec @Doyensec]

In the latest Doyensec research, our Norbert Szetei (@73696e65) takes a closer look at the SMB3 Kernel Server (ksmbd) component of the Linux kernel. Check it out today & learn what he found, which led to multiple CVEs!
#Doyensec #Appsec #Security #Linux

https://t.co/ZxhGcobavc

[Doyensec @Doyensec]

CSRF in modern web apps? It's still possible! Our latest research by @maxenceschmitt dives into using Client-Side Path Traversal to perform CSRF. Check out our latest blogpost and brand new #Burp extension for finding bugs.

#doyensec #appsec #CSPT2CSRF

https://t.co/9XUicACBRI

[Doyensec @Doyensec]

Checkout @maxenceschmitt's presentation at @owasp's Global AppSec in Lisbon to learn how Client-Side Path Traversal can be leveraged for CSRF attacks!
#owasp #appsec #doyensec

https://t.co/0OfT8TLRdr
https://t.co/bcGKroMZJZ

[Doyensec @Doyensec]

Congratulations 🎉 to Doyensec's own @73696e65 for discovering an out-of-bounds memory read vulnerability in the Linux kernel!

Details: https://t.co/cEcbpp154c

The fix has been committed here: https://t.co/ZdknDV8MFA

#doyensec #appsec #linux #security

[Doyensec @Doyensec]

New blog post on our new Server Side Prototype Pollution Gadgets Scanner plugin for #BurpSuite! It features a modern detection approach and a focus on real-world exploitation. Download it today!

https://t.co/qG3I3G6b9y

https://t.co/N2DJK05Ywz

#Doyensec #AppSec #websecurity

[Doyensec @Doyensec]

PoIEx, a new #Doyensec tool, identifies "Points of Intersection" where code & IaC definitions meet. Visualize & explore IaC, plus create & share real-time notes w/ teammates in VS Code. Try it out today‼️

https://t.co/Z0ekdlATFQ

https://t.co/rBqOlBUEjU

#CloudSecurity #appsec

[Doyensec @Doyensec]

Learn more about how having a security-oriented scheduling strategy for #k8s can limit opportunities for lateral movement within your environment in our latest blog post.
#doyensec #Kubernetes #security #appsec

https://t.co/B6ou4SaeL8

[Doyensec @Doyensec]

Just posted! Learn how to achieve privilege escalation via misconfigured #AWS Batch & the solution for our previous lab, in the latest installment of #Doyensec's "Cloudsec Tidbits" series by @ouadmoha and @lacerenza_fra.
#cloudsecurity #DevSecOps #appsec

https://t.co/0Fa49OWAFL

[Doyensec @Doyensec]

Zero Touch Production platforms improve security while also making auditing and IR easier. Our latest post talks about common pitfalls found in their implementations and how to avoid repeating past mistakes.
https://t.co/ve5YFiuF1D

#doyensec #appsec #devops #infosec #security

[Hillai Ben-Sasson @hillai]

Read the full technical details here >>
https://t.co/mVPHP3OYrO

[Doyensec @Doyensec]

Phishing scams targeting #crypto wallets are everywhere. In our latest blog post, @viktorot details one such attack and offers suggestions on how wallets can improve their security.
#doyensec #appsec #phishing #infosec

https://t.co/xxCjQ70NGy

[Doyensec @Doyensec]

In our latest blog post, learn how Szymon Drosdzol found a trivial SSRF bypass in #NodeJS 's `request` library (18M weekly downloads). Learn how to patch it and get the details on how other widely used libraries handle the same vector.

#Doyensec #appsec

https://t.co/LrTjTMIh0i

[Doyensec @Doyensec]

Check out @lacerenza_fra's new PESD @Burp_Suite extension. It converts proxy history to interactive diagrams!

Easily document findings or convey complicated logical application flows in seconds!
#Doyensec #appsec #Pentesting

https://t.co/aUtKpbptTL

https://t.co/vXEAYU5ukT