Articles & Research

Introduction This is our fifth article, discussing how to abuse or bypass poorly configured Content Security Policies (CSP). It builds on some of our previous articles.   Audience Who is this article for? Understanding application layer security threats is important for a wide-range of professions, including: Security Architects and Solution Architects, as they need to under ...

Introduction This is the fourth article in the series, and it is discussing how the concepts in some of our previous articles, including some of our primer articles, are connected. Many security vulnerabilities lie in the point between two systems. For example, where one system generates code or commands for another system to execute and, in particular, if the generating system ...

Introduction This article is one of a collection of primer articles, providing a basic introduction to various topics, for reference in other more in-depth articles. These primer articles are written as people come to security pages from various backgrounds, be it a software engineer who wants to understand an issue they need to fix (or prevent one from occurring in the first p ...

The past decade has seen a rapid evolution in cyber threats in the financial services sector. Attackers have become more sophisticated by using advanced tactics such as implementing fileless attacks, that don’t leave a footprint, or targeting third-party vendors to gain access. 

Introduction This is our third article, again it is not directly related to either of our previous articles, though there will be some more JavaScript! So, this time we will focus on Cross Site Request Forgery (XSRF/CSRF) and Same Origin Policy (SOP).    Audience Who is this article for? Understanding application layer security threats is important for a wide-range of professi ...

Introduction This is our second article, this will not directly follow on from the first - though this is laying some ground material, and we will loop back later! This article then, will focus on an interesting security issue in JavaScript.  JavaScript is a widespread programming language, used in both client-side (especially via frameworks such as REACT or Angular) and server ...

Introduction This article is one of a collection of primer articles, providing a basic introduction to various topics, for reference in other – more in-depth – articles. These primer articles are written as people come to security pages from various backgrounds, be it a software engineer who wants to understand an issue they need to fix (or prevent one from occurring in the fir ...

Introduction This article is one of a collection of primer articles, providing a basic introduction to various topics, for reference in other more in-depth articles. These primer articles are written as people come to security pages from various backgrounds, be it a software engineer who wants to understand an issue they need to fix (or prevent one from occurring in the first p ...

Introduction to this Series of Articles This is the first of a series of articles exploring various topics that may be of interest to my LinkedIn network. As my experience has been diverse, the topics of my articles will also be varied. There will be an initial set of articles on penetration testing, with a focus on web applications, JavaScript, injection attacks, and databases ...

Introduction This article is one of a collection of primer articles, providing a basic introduction to various topics, for reference in other – more in-depth – articles. These primer articles are written as people come to security pages from various backgrounds, be it a software engineer who wants to understand an issue they need to fix (or prevent one from occurring in the fir ...

Introduction This article is one of a collection of primer articles, providing a basic introduction to various topics, for reference in other – more in-depth – articles. These primer articles are written as people come to security pages from various backgrounds, be it a software engineer who wants to understand an issue they need to fix (or prevent one from occurring in the fir ...