icon Book Free Consultation
29th April 2020

Evolution of Ransomware and the trends in 2020

Nowadays the biggest danger that we come across and also something that we are about to face in future is The cyber threat the crime that happens via internet and technology.

Read More
14th June 2022

How hackers bypass file upload and how to prevent it?

Starbucks does have the best coffee in the world. But, do they have the best cybersecurity defense? ? Johnstone discovered It was possible to execute arbitrary code by uploading a webshell

Read More
27th November 2023

A Deep Dive into VAPT Methodology and Coverage Respective of Different Compliance Requirements

To evolve in modern-day VAPT (Vulnerability Assessment and Penetration Testing), it is essential to stay ahead of the ever-changing cybersecurity landscape

Read More
27th June 2023

Why VAPT is Crucial for Your Organizations Security-Beyond Compliance

Organizations face multiple cybersecurity dangers in the digital age, which could compromise confidential information.

Read More
12th September 2023

Why SaaS Product Owners Need to Prioritize Vulnerability Assessments and Penetration Testing

Your product is designed to handle sensitive customer data, ranging from personal information to financial records.

Read More
30th June 2023

Top 10 Compelling Reasons Why Web Application Security Testing Should Be a Priority

In today's interconnected world, where businesses rely heavily on web applications to interact with customers.

Read More
23rd June 2023

Securing PHP Applications: Safeguarding Against the Top 3 Cyber Attacks

Are you aware that more than 810 million web applications, which account for over 30% of all web applications.

Read More
18th June 2024

Ransomware The Deadliest Threat to Modern Cybersecurity

Ransomware has emerged as one of the most dangerous and persistent threats in the cybersecurity landscape.

Read More
7th July 2023

Maximizing Security: Uncovering Threats with In-house Security and External VAPT Team

Discover how combining in-house security expertise with external VAPT teams can maximize your organization's security.

Read More
26th April 2024

Mastering Web App VAPT The Complete Guide

In today's interconnected digital landscape, web applications serve as the backbone of numerous online services, facilitating everything from e-commerce transactions to social media interactions.

Read More
10th October 2023

Dont Let Your APIs Be the Weak Link Why API Security Assessments are Crucial

Imagine a bank with an API that allows you to check your account balance and make transactions from your favorite budgeting app

Read More
12th July 2023

DNS Hijacking Prevention: Safeguarding Your Domain from Attacks

Protecting your domain against DNS hijacking attempts is essential in the modern digital world.When hostile actors take over a domain's DNS settings.

Read More
30th September 2019

Growing Data Breaches And The Best Ways To Be Safe From Them

Data breaches – Unarguably, it’s a word that’s roaring predominantly and endlessly in each and every part of this digital world, without any precincts.

Read More
4th May 2019

How to secure your Github repository?

GitHub is a hosting platform which helps developers to collaborate in building software’s. It helps the developers to manage source code management.

Read More
3rd October 2018

CWE-79 Improper Neutralization Of Input During Web Page Generation Cross-Site Scripting

Cross-site scripting (XSS) is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications.

Read More
30th May 2019

Detection and Exploitation of XML External Entity Attack XXE

XML External Entity Attack happens when an application allows an input parameter to be XML or incorporated into XMLwhich is passed to an XML parser

Read More
29th May 2019

Server Side Includes Injection

Server Side Includes (SSIs) are directives present on web applications, used to feed an HTML page of the application with dynamic contents based on user’s input.

Read More
16th September 2021

HOW CAN THE OWASP DEPENDENCY TRACKER BE USED TO IMPROVE THE APPLICATION SECURITY LIFECYCLE?

Dependency Track is a free, open-source continuous component analysis platform that helps businesses discover and mitigate supply chain risk

Read More
14th April 2020

A Deep Dive into SAML-SSO Security Testing Approach

SAML the Security Assertion Markup Language was created by an organization known as OASIS.Nowadays applications make use of the latest version of SAML 2.0.

Read More
6th October 2018

Cross Site Port Attack XSPA

A web application is helpless against Cross Site Port Attack if it forms client provided URL’s and does not disinfect the backend reaction obtained from remote servers previously while sending it back to the client.

Read More
11th October 2018

Server-Side Request Forgery-SSRF

Server-Side Request Forgery (SSRF) refers to an attack, wherein an attacker can send a maliciously crafted request from a vulnerable web application

Read More
9th June 2022

While testing sql injection why do testers frequently use single quotes

SQL injection is often referenced as the most common type of attack on websites. It is being used extensively by hackers and pen-testers on web applications.

Read More
4th May 2019

Null Byte SQL Injection

Null Byte Injection is an exploitation technique which uses URL-encoded null byte characters to the user-supplied data. This injection process can alter the intended logic .

Read More
28th May 2019

CRLF Injection Attack

The term CRLF refers to Carriage Return (ASCII 13, , \r) Line Feed (ASCII 10, , \n). Carriage Return means the end of a line, and Line Feed refers to the new line. In more simple words, both of these are used to note the end of a line.

Read More
8th October 2018

SQL Injection -Using Burp Suite

SQL injection is an attack when an attacker persuades to “inject” his harmful/malicious SQL code into someone else’s database, and force that database to run his SQL

Read More
3rd October 2018

Host Header Attack

Most commonly many web servers are configured in such a way, to hosts several websites or web applications on the same IP address. That’s why the Host Header Injection occurs.

Read More
22nd July 2022

What is the difference between VA and PT ?

Thief plots heist at home. It takes him some time to figure out how to get into the house without being noticed. What we're doing here is called Vulnerability assessment.The thief could have used a glass door .

Read More
26th May 2023

Strengthening Security for BSFI SaaS Products: Leveraging the Power of OWASP ASVS

In the fast-paced world of Banking, Financial Services, and Insurance (BSFI), organizations rely heavily on Software as a Service (SaaS).

Read More
27th February 2023

Top 10 reasons to partner with briskinfosec cybersecurity experts to prevent cyberattacks and data breaches

If you're a business owner, you know that cybersecurity is an essential concern.

Read More
16th June 2022

Is CDN WAF enough to protect your web application?

What would you say if we told you that certain service was at USD 1.53 Billion in 2016 and is expected to reach USD 7.63 Billion by 2022.Is not this an exponential increase? Yes, that service is CDN WAF.

Read More
24th May 2022

How To Minimize The Impact Of False Positives?

Web applications are updated on a frequent basis in today's fast-paced development settings, and agile, integrated methodologies like DevOps are swiftly becoming the norm.To design, test, and update diverse apps

Read More
21st June 2022

Is there a difference between authentication and authorization in an API?

As with web applications, APIs operate on the web, but many require some sort of authentication or authorization before you can access the valuable.

Read More
20th August 2019

Guidelines to Secure Web Services and API End-Points

Web Service is a software service used to create a communication between 2 devices connected over a network through internet.

Read More
4th May 2022

Is Beast Attack Really Breaking Your SSL TLS

BEAST (Browser Exploit Against SSL/TLS) is a network vulnerability attack against TLS 1.0 and older SSL protocols. Security researchers carried out the attack for the first time in 2011, but the theoretical vulnerability was discovered in 2002.

Read More
5th July 2022

What Is FTP Penetration Testing and What It Is Not?

File transfer protocol, a standardized protocol used to allow transmission of files between computers. It consists of a set of coded signals which are transmitted between computers, and which inform

Read More
12th May 2022

Json web token and its exploitation

As an open standard, the JSON Web Token (JWT) defines a compact and self-contained method for securely transmitting information between parties as a JSON object (RFC 7519).

Read More
10th August 2022

What is the difference between Manual Penetration Testing versus Automated Penetration Testing?

The new normal has made the market bigger for digital transformation projects and strategies for moving to the cloud.

Read More
6th October 2018

Command Execution Attacks on Apache Struts server CVE-2017-5638

Apache Struts is a free, open-source, MVC framework for creating elegant and modern Java web applications.

Read More
10th May 2022

80 percent of the backend technologies have banner exposed why is it a serious issues

Banner grabbing or active reconnaissance is a type of attack during which the attackers send requests to the system they are attempting to attack in order.

Read More
29th July 2022

XML Rpc Attack

Yes, I am talking about U.S department of defense get hacked. Bibek Dhakal found that the xmlrpc.php file on the U.S. Department of Defense website had been turned on leaving it open to an attack on other sites. The XML Rpc.php in WordPress is turned on by default

Read More
23rd August 2022

Why should we use a proxy server?

People don't often stop to think about the most basic parts of how the internet works. But what happens when you browse the Internet? You could be using a proxy server at work, on a Virtual Private Network (VPN).

Read More
25th August 2022

HTTPS Request Smuggling Attacks and How to Stop Them?

Who will offer $36,000 for finding a bug? Yes, it has happened. And, by the the greatest company of the planet: Apple. From the prize, you can well understand the magnanimity .

Read More
7th October 2022

What weak credentials can do?

Yes! Hacking people's accounts is illegal. Hacker’s are enjoyed playing with weak credentials. A weak password is one that is easy to guess using a subset of all possible passwords in a brute force attack.

Read More
13th October 2022

What is Black box Security Testing?

In this kind of testing, the penetration tester acts like a normal hacker who doesn't know anything about the target system.Testers don't get any diagrams of the architecture or source code that isn't available to the public.

Read More
8th September 2022

What Are Security Headers and How Can We Implement Them For our Website?

When a browser asks a web server for a page, the server sends back the page's content along with headers. Some headers have meta-data about the content,

Read More
6th November 2019

This Awesome Stuff Will Make You Understand What Red Team And Blue Team Is

Most people think that Red Teaming and Blue Teaming are different approaches for testing and identifying the security flaws.

Read More
27th October 2022

Best practices to prevent Data breaches in SAAS platform

Out of the entire population on the planet earth, at least most of them have a Facebook account. What if I tell you that these data's can be hacked not from your computer but from the cloud.

Read More
19th December 2022

Different Types of session Based Attacks and How to Stop Them?

Imagine John surfing on the internet. He likes a product from a website. He orders it & now it is time to pay for it. He puts in the banking credentials. Everything went well.

Read More
30th June 2022

How to save yourself from Phishing attacks? A quick guide

Phishing is a type of social engineering attack used to obtain sensitive information from users, such as login credentials and credit card information.It

Read More
15th July 2022

What Is CRLF Injection Attack?

Twitter is one of the most popular social media platforms available today, with 100 million daily active users and 500 million tweets sent daily. But, do they have the best cybersecurity defense? Youssef discovered It was possible to inject the CRLF injection

Read More
15th December 2021

Introduction to HTTP Request Smuggling Vulnerability

HTTP Request Smuggling is one of the critical web application vulnerabilities that is often goes unnoticed by many security reasearchers and penetration testers due to its complexity.

Read More
14th March 2019

Drupal Core Remote Code Execution Vulnerability: CVE-2019-6340

Drupal is one of the most popular open source Content Management System (CMS) meant for developing, designing etc.

Read More
30th January 2019

Are you still fighting against decade old application attacks

In this modern digital era, online transactions play a pivotal role.

Read More
22nd January 2019

Top Trending Web app security Vulnerabilities

For a long time in the cyber security world, Web applications are subjected to various kinds of security vulnerabilities because of the increase in its usage and the use of dynamic web application technologies

Read More
2nd August 2022

Word-press plugin lightspeed caches security flaws and how to exploit them

WordPress plugin LiteSpeed Cache has a cross-site scripting vulnerability because it does not properly sanitize user input. An attacker can take advantage.

Read More
6th November 2019

Important Vulnerabilities And Smart Ways To Be Secured From Them

There’s a saying, ”Change is the only thing that never changes!” Similarly, each and every year has a change .

Read More
18th October 2019

What Do You Need To Know About Cyber Kill Chain?

The Cyber Kill Chain framework is a part of the Intelligence driven defense model for identification and prevention of cyber intrusion activities (i.e. Hack or Breach).

Read More
11th October 2022

What is the difference between OWASP Top 10 and ASVS Security Audit

OWASP is the blueprint for testing the web application security controls. It is safe to say that it helps the developers to develop application.

Read More
13th February 2019

Techniques to Secure your SOAP and REST API

An API is called as Application Programming Interface which is used for communication. An API acts as a middle man who delivers your request to the provider and then delivers response to

Read More
30th January 2019

Beware of Data War

Data as general is a set of information, knowledge or fact that is measured and stored in storage devices.

Read More
23rd June 2022

What is spring4shell vulnerability and how to address this vulnerability

Spring is a popular lightweight Java platform application framework that enables developers to easily create Java applications with enterprise-level features

Read More
5th October 2021

Why Is It Important To Understand Owasp Automated Threats To Web Applications To Develop Better Security?

The primary goal was to create an ontology that would serve as a common language for developers,

Read More
26th May 2022

My Website has HTTPS implemented. Should i really worry about implementing HSTS.

HTTP and that all redirection to the site using HTTP should be changed to HTTPS requests by default.

Read More
10th August 2021

End to End Email Security with DMARC Records

DMARC also known as Domain Message Authentication, Reporting & Conformance is a technical standard that helps protect email senders and recipients from email related spoofing and phishing attacks

Read More
3rd October 2018

CWE-78 Improper Neutralization Of Special Elements Used In An OS Command Injection

OS command injection is a technique used via a web interface in order to execute OS commands on a web server. The user supplies operating system commands through a web interface in order to execute OS commands.

Read More
21st December 2021

Security Flaws in Third Party Apps

One thing that you have to remember is that outside parties such as auditors, customers don’t care how vulnerabilities got into your environment. Even if your hands are tied, application security flaws can and likely will .

Read More
23rd September 2021

What is the Difference Between AWS Vs Azure Vs Google from a Cloud Security Standpoint

These services are designed to provide easy, affordable access to applications and resources, without the need for internal infrastructure or hardware

Read More
16th November 2021

6 Cybersecurity measures that Organizations tend to overlook

Cyberattacks are a major nuisance that aren't going anywhere anytime soon. Growing at an estimated 15% year over year, cybercrime costs to organizations worldwide are forecast to reach $10.5 trillion annually by 2025.

Read More
13th December 2021

What and How to address LOG4J CVE-2021-44228 Vulnerability?

CVE-2021-44228 is the name of the zero-day vulnerability, which can affect any programme that logs user input. The effect may be seen in a variety of places, including Minecraft, which registers the names of users.

Read More