Websec Cybersecurity Blog
Expert insights, trends, research findings, and best practices from our security team to help you strengthen your organization's security posture.
Articles
Downloading an Application's Entire Source Code Through an Exposed GIT Directory
Website administrators sometimes inadvertently leave an exposed .git directory, from which it is possible to download the entire source code of the web application using just wget and a common server misconfiguration.
Backdoors in Zhone GPON 2520 and Alcatel Lucent I240Q
While examining the "dropbear" binary for the Zhone GPON 2520 and Alcatel Lucent I240Q, we found that both routers have backdoors that allow users with SSH access to connect to these devices with maximum privileges.
Drive By ONT Botnet with IRC C&C
Demonstration of a botnet created purely by using embedded devices which are controlled remotely through vulnerabilities exploited from a webpage.
(IN)secure session data in CodeIgniter
A security analysis of how web applications built on the CodeIgniter PHP framework handle user sessions, documenting the recurring implementation mistakes we see on assessments and what pentesters and developers should watch for.
Panoptic - A tool to exploit path traversal vulnerabilities
An overview of Panoptic, an open source penetration testing tool that automates the process of search and retrieval of common log and config files through path traversal vulnerabilities.
Special discount code for "Nmap 6: Network Exploration and Security Auditing Cookbook"
PacktPub has shared a limited-time discount code for our friends attending Hacker Halted USA 2012. Use code APMK1F for 20 percent off the print edition and 25 percent off the electronic edition of Nmap 6: Network Exploration and Security Auditing Cookbook.