If you’ve spent sufficient time on a cybersecurity assignment so that the bigger picture falls into place, you know that some issues will reveal themselves to you with ease. This was a penetration testing engagement for which I had sufficient time to scour through all the nooks and crannies of…

This is probably the report that I’m most proud of. On top of that, it was the lengthiest I’ve ever written. I think I said it in the past, I’m not big into bug bounty hunting. But there are a handful of programs and platforms that I enjoy playing with…

It’s the second account takeover I’m finding on a client pentest in the span of a few days. I’m not sure wth is going on… I’m going to try to be as short and to the point as possible because I don’t enjoy writing as much as I used to. …

In a web app pentest for a client, I found this interesting account takeover and I thought of sharing my findings with the infosec community. Usually, in apps involving authentication, I extensively test all the related functionalities. …

I guess the graphic above depicts the essence of BugProve, a recently launched European IOT Security company. I’m rarely excited when I see a new product or service emerging on the market because many of them are just very expensive abstractions for something that you could do yourself, provided that…

I know the title is a mouthful; submissions are open for better candidates. If you have one, suggest it below! In a recent pentest I did for a client, the scope included a banking/financial application. From the very start, mostly nothing worked from my side of the testing, but this…

I’ve spent the past couple of days looking over inigo.io, a GraphQL security and management platform for APIs. This basically works by running an agent alongside your GraphQL server. It comes with a very seamless integration with a whole host of servers (see the docs). Developers, DevOps and Security Architects…

Many pentesters and application security professionals talk about what they do but often, unintentionally, fail to provide detailed insight into what they do. For aspiring professionals, this is very frustrating because they don’t care about the 5 five phases of pentesting or OWASP Top 10. …

In this video, I tell you how I was able to stack two vulnerabilities while working on a bug bounty program on a private platform. My blog: https://dgtsec.com Twitter: https://twitter.com/CristiVlad25 Linkedin: https://www.linkedin.com/in/cristivlad/