How to prevent SQL injection

Despite being one of the oldest known web application attacks, SQL injections continue to feature in data breach headlines, from MOVEit Transfer to Zendesk and beyond. This article discusses ways of preventing SQL injection vulnerabilities to make sure incoming attack payloads can’t get a foothold in your systems.

Server-Side Template Injection Introduction & Example

This article introduces Server Side Templates and explains why and how they can be susceptible to Server-Side Template Injection vulnerabilities. It includes examples of HTML, PHP and CSS code and concludes with a list of recommendations on how to protect your web applications from attacks that exploit SSTI vulnerabilities.

Type Juggling Authentication Bypass Vulnerability in CMS Made Simple

Our researcher, Sven Morgenroth, explains how he found an Authentication Bypass in CMS Made Simple, what PHP Type Juggling is, and why you should never use the unserialize function together with user-supplied input.

Ferruh Mavituna Talks About Security in the SDLC on Paul’s Security Weekly Podcast

Watch episode #557 of Enterprise Security Weekly in which Ferruh Mavituna, Netsparker’s Founder and CEO, talks about the vital role of dynamic web application testing within the Software Development Life Cycle, the benefits and challenges of an early security focus, and Netsparker’s automation and integration facilities.

How you can steal private data through CSS injection

Introducing the Same-origin Policy Whitepaper

This blog post outlines the contents of our Same-origin Policy Whitepaper: The Definitive Guide to Same-origin Policy. It includes a discussion of SOP misconceptions and implementations. It is jointly by Alex Baker, an independent Security Researcher, together with Ziyahan Albeniz and Emre Iyidogan, two of Netsparker’s Security Researchers.

Why You Should Never Pass Untrusted Data to Unserialize When Writing PHP Code

Unserialize is a PHP function that, while often classified as a security risk, is seldom defined. This article explains the vulnerability and contains a PHP Classes Crash Course that includes properties and ‘magic methods’. It uses examples to illustrate the basic concepts of Deserialization, PHP Object Injection and Class Autoloading in PHP.

Facebook & Cambridge Analytica Data Breach

This blog post examines the Facebook and Cambridge Analytica Data Breach news, asks what might change at Facebook and discusses whether users or organisations are responsible. It also examines whether data portability or security is the priority and sets out some basic questions web application vendors need to ask of their data security policies.

Sven Morgenroth Explains & Demos Same-origin Policy and How to Circumvent it

Watch episode #550 of Enterprise Security Weekly in which Sven Morgenroth, our Security Researcher, talks about Same Origin Policy, its origin, how it works as a security measure, various incorrect implementation issues and dangers. The show includes slides and a demo of four exploits that abuse mistakes developers make when circumventing SOP.

Ferruh Mavituna Talks About Web Security on Enterprise Security Weekly Podcast

Watch episode #81 of Enterprise Security Weekly in which Ferruh Mavituna, our CEO, talks about Netsparker’s current focus, the role of web application vulnerabilities in data breaches, honesty in the web application security industry, dynamic and static analysis tools, enterprise requirements for scalability, IoT and his conference plans for April.

Netsparker’s Weekly Security Roundup 2018 – Week 05

In this week’s edition of our security roundup: why you should be careful what you put into your composer.json file, why you need to use a Package Manager, the Principle of Least Privilege and DNS Rebinding