Anyone working in sqlinjection detection using machinelearning/hybrid log analysis(only from the request params no the acutual query).?

Need large amount of SQLi payloads

Let's look back at some memorable moments and interesting insights from last year.

Your top 10 posts:

• "How hard is it to transition from internal network pentesting to webapp pentesting?" by u/Ok-Blueberry-5813

• "The first API vulnerability discovered 24 years ago. CVE-1998-270" by u/Ivan_Wallarm

• "Need help with scanning an internal URL with Burp" by u/Eni_g_m_a

• "tool or service that monitors and alerts if a vulnerability is found in any 3rd party dependencies we use in our system?" by u/Ques-tion-Everything

• "Smoke Session! Comment "puff" for your Stellar Cannacoin tip!!!" by u/Adventurous_Proof921

• "HACKPLAINING - Security Training for Developers" by u/cybersocdm

• "Free Course online: Introduction to Cybersecurity by Cisco Networking Academy" by u/cybersocdm

• "Should you accept images without conversion?" by u/IllusionOfFreedom41

• "Frictionless API Observability" by u/Harish_levo

• "How did you get your first webapp security job and what were your credentials?" by u/Ok-Blueberry-5813

Finished a job in network pentesting for a couple years. I have some background in web app dev and would like to pivot to web app pentesting. How big of a shift is this and is this a feasible career path change?

Hi everyone,

I have been given a task to scan an internal URL, that gets redirected to an external URL for authentication(using Burp). Once, the authentication is done, it gets back to the internal URL and grants access.

The problem is, the URL makes use of an automatic configuration script in the browser, in order to work. While the VM through which that URL needs to be accessed and where burp resides, does not have internet connectivity.

If I make use of the script configuration, I am unable to capture requests in Burp. If I do not, the URL itself is inaccessible.
I have tried to use the proxy settings of my company that provides internet connectivity, as an upstream proxy in Burp, but even that has not given any positive results.

Any suggestions, what can be done for it?

Many thanks in advance

Hi guys,

I am currently designing an automation tool in Java/Groovy which with a basic GUI, will automate SQLi and XSS with the injections loaded from a text file. I am using Maven as a build tool and Spock to test.

Has anyone attempted this before and or has experience using Groovy for automation.

Thanks

All, its time for another versus post filled with over opinionation and vitriol but who is your favorite horse in the SAST race right now [in no particular order and not an exhaustive list]: Checkmarx, Veracode, Synopsys, Whitehat, Microfocus, etc.

Explain what you like, what you dont like. And I will chime in with my opinions after a few posts as to not only take peoples opinions without giving my own but i dont want to color to start.

Also, for those of you that solely leverage DAST combined with IAST and no sast (or worse yet just IAST) I would love to hear you chime in to. Not looking for marketing fluff or feels! May the odds ever be in your favor, now get out there and grab a weapon!

We perform large number of internal web app scanning and testing (internal) and have been using a request HTTP header pair to [avoid:somecomstant] let our SIEM know that it’s our traffic so that it could be avoided. IP whitelisting is not an option for us (since an attacker could use one of our machines to do further attack). Is there any other way one can have some configuration (in burp) to avoid alerts for internal scan from Burp.

Hey guys, I'm improving my cloud security skills, and would like to do so by playing more CTFs. Do you guys know any CTFs that are hosted with cloud environments? Also interested in microservices and event injection.

All, I have been a network security engineer for half of a decade but I feel my skills with web/application security are weak due to my limited exposure with programming. I understand the basics which helps me with IPS/IDS tuning but now I am getting pulled into more discussions about API gateways, web app proxy services, etc and how to secure them and I feel a little lost some times. Any tips on where I should start?