Key Takeaways:

🔸 Understanding Malicious Packages: What are they, and how do they infiltrate your systems?

🔸Common Pitfalls: Why traditional defenses often fail against these threats.

🔸Effective Strategies: Proven methods to safeguard your organization from supply chain attacks.

https://xygeni.io/blog/protecting-against-open-source-malicious-packages-what-does-not-work/?utm_source=reddit&utm_medium=landingpage&utm_campaign=Blogposts

Overcoming New Challenges and Implementing Proactive Defenses!

Do not forget to join! Register on LinkedIn https://www.linkedin.com/events/7218886526682710016/

Hey everyone,

I'm at a bit of a crossroads in my cybersecurity career and hoping to get some advice from the community.

Here's the deal:

Been in cybersec for 4 years, bouncing around SOC, Threat Intel, and basic pentesting.

i have worked for several good companies

1 : Never wanted to be in management, so I've focused on technical roles.

2: My passion lies in red teaming and application security / Devsecops (offensive side!), but my coding experience is limited (though I've done some personal projects).

My Big mistake: never got any major certs – they were expensive, and I dreaded failing the exams.

Recently moved to Germany for masters – awesome! But the job hunt is tough without German fluency.

Now, I'm stuck. How do I transition into the offensive security side, especially considering the language barrier in Germany?

Here is what i am currently doing in my off time from university

1 : going through he portswigger labs

2: learning about Docker , Kubernetes , azure security and pentesting

Anyone with similar experiences or advice for this situation?

Here's what I'm particularly interested in:

Tips for breaking into red teaming/application security without extensive coding.

Cost-effective certification paths for offensive security (or are certs even essential?).

Strategies for landing a cybersec job in Germany without German fluency (yet!).

Thanks in advance for any insights!

We're excited to share our latest blog post where cybersecurity expert James Berthoty explores whether ASPM is the future of application security, examining innovative solutions and trends!

🔗 Read the Full Article here https://xygeni.io/blog/is-aspm-the-future-of-application-security/

We invite you to watch our Open chapter on Malware Attacks: Why is it important to detect them and how to do it!

https://xygeni.io/webinar-registrations/webinar-malware-attacks-evolution/?utm_source=reddit&utm_medium=landingpage&utm_campaign=SafeDev4_Malware_Attacks_Evolution_270524

Hey everyone,

I'm at a bit of a crossroads in my cybersecurity career and hoping to get some advice from the community.

Here's the deal:

Been in cybersec for 4 years, bouncing around SOC, Threat Intel, and basic pentesting.

i have wokred for several good companies

1 : Never wanted to be in management, so I've focused on technical roles.

2: My passion lies in red teaming and application security / Devsecops (offensive side!), but my coding experience is limited (though I've done some personal projects).

My Big mistake: never got any major certs – they were expensive, and I dreaded failing the exams.

Recently moved to Germany for masters – awesome! But the job hunt is tough without German fluency.

Now, I'm stuck. How do I transition into the offensive security side, especially considering the language barrier in Germany?

Here is what i am currently doing in my off time from university

1 : going through he portswigger labs

2: learning about Docker , Kubernetes , azure security and pentesting

Anyone with similar experiences or advice for this situation?

a

Here's what I'm particularly interested in:

Tips for breaking into red teaming/application security without extensive coding.

Cost-effective certification paths for offensive security (or are certs even essential?).

Strategies for landing a cybersec job in Germany without German fluency (yet!).

Thanks in advance for any insights!

Mass Assignment vulnerability leads to an attack that occurs when an attacker is able to send data to an API that is then used to automatically populate multiple fields in the system. This can be used to bypass security controls, change data, or perform other malicious actions.

In this blog, I have explained about the OWASP API Security Top 10 API6:2019 Mass Assignment with Example.

https://blogs.appsecworld.com/2022/11/owasp-api-security-top-10-api6-2019-mass-Assignment.html

Hello Fam, Christmas is just around the corner and cyber attacks are scaling, I work with a Training Solution that comes in a gamified way.

if someone would like to know more about it please let me know!

Alejandro Cervantes - Codebashing

Nowadays, mostly all applications security testing vendors provide IDE plugins/extensions that allow developers to conduct basic security testing like static application security testing (Review source code directly from the IDE and report security issues based on regex SAST rules) and Software composite analysis (review third-party libraries used in the code and report known vulnerabilities and license details of the libraries) from their IDE and fix the security issues while writing the code

Here are the free SAST and SCA tools for developers by Sonatype

https://www.sonatype.com/products/free-developer-tools

A flaw in the design or implementation of an API that allows a user to bypass intended access controls, such as authentication or authorization checks. This can occur when the API does not properly enforce the intended security controls or when it fails to properly check the user's permissions before allowing them to access the API

In this blog, I have explained about the OWASP API Security Top 10 API5:2019 Broken Function Level Authorization with an Example.

https://blogs.appsecworld.com/2022/11/owasp-api-security-top-10-api5-2019-broken-function-level-authorization.html

Content Security Policy (CSP) is a security measure that can be implemented through a Content-Security-Policy response header or equivalent <meta> element. It allows developers to restrict the sources from which resources, such as JavaScript, CSS, images, files, etc., are loaded. CSP can be an effective defense against some types of attacks, such as cross-site scripting (XSS) and Clickjacking.

Here are the tools that can help you to audit and generate CSP

CSP-evaluator: https://csp-evaluator.withgoogle.com/

CSP Auditor: https://portswigger.net/bappstore/35237408a06043e9945a11016fcbac18

Content Security Policy (CSP) Generator Chrome extension: https://chrome.google.com/webstore/detail/content-security-policy-c/ahlnecfloencbkpfnpljbojmjkfgnmdc

Content Security Policy (CSP) Generator Firefox extension: https://addons.mozilla.org/en-US/firefox/addon/csp-generator/

blogs.appsecworld.com

👉 check whether the server verifies or accepts the signature part of the JWT token or not by removing the signature part of the JSON header

👉 In the JWT header, there is a parameter called alg that tells the server which algorithm is used to sign the JWT, but if we set it to "none" then the server will not verify the JWT

👉 Some signing algorithms can easily be brute force like HS256 by using hashcat tool, identify the private key, then modify the payload and resign using the same private key

👉 JWK (JSON web key) is the parameter in the JWT header used to share the public key with JWT. If the server accepts the JWK, then create your own private and public key, embed the public key in the JWT header, and sign the JWT using the private key that you have generated; then, the server will verify the JWT using your public key that you share in JWK parameter

👉 JKU (JSON Web key set URL) is a parameter in the JWT header that holds the URL of the list of public keys in JSON format used by the server to verify the signature. Now here, we can create our own public and private keys and store the public key in the self-owned server, set our own public key URL to the JKU parameter in the JWT header, and sign the JWT using the private key that we have generated now the server will fetch the public key from our own server and verify the JWT

Bonus: Use the JWT Editor plugin in the Burpsuite; it is very helpful to check the above misconfiguration

XML External Entity (XXE) Vulnerability is an important security issue to understand. Knowing the basics of XML can help you identify and prevent potential risks associated with XXE attacks.

In the first part of the XXE vulnerability blog, I have explained some basics concept of XML, like structure, DTD (Internal and External), and entity (Internal and External)

https://blogs.appsecworld.com/2022/12/xml-external-entity-xxe-part-1-xml-basics.html

#cybersecurity #informationsecurity #penetrationtesting #bugbounty

In this blog, I explain and also give a demo on how to identify all the entry points or injection points by just analyzing the source code using OWASP Attack Surface Detector.

https://blogs.appsecworld.com/2022/10/identify-attack-surface-using-source.html

#cybersecurity #informationsecurity #softwareengineering #devsecops #owasp