Professionally Evil Blog

A blog by experts of penetration testing and other security assessments.

Understanding Server-Side Template Injection (SSTI)

Web applications play a vital role in delivering dynamic content to users. To achieve this, developers often utilize server-side templates, which provide a powerful and consistent way to generate dynamic web pages. However, along with this power comes the risk of Server-Side Template Injection ...

Never miss a Professionally Evil update!

Introducing SamuraiWTF 5.3: A Powerhouse for Web App Pen Testing

We are thrilled to announce the release of SamuraiWTF (Web Training Framework) version 5.3! This ...

Introducing BILE - Groundbreaking Classification for Web App

As a seasoned web application penetration tester, I've always felt that there should be a more ...

ZAPmas Feedback

Sometimes Christmas comes early, and in this case for me it was the publication of the Twelve Days ...

12 Days of ZAPmas - Day 12 Testing a new Content-Security-Policy

Testing | application security | OWASP | web application security

What is the CSP? The Content-Security-Policy (CSP) is a widely recommended control and is ...

Twelve Days of ZAPmas - Day 11 - ZAP impressions from a Burp user

web penetration testing | Burp Suite | OWASP | web application security

It probably seems a bit odd to do this on Day 11 and not at the end of the series, but I have one ...

Twelve Days of ZAPmas - Day 10 - Manual Web App Testing Unproxied

web penetration testing | OWASP | web application security

Most of the time, proxying the browser doesn’t present any sort of trouble. You should be able to ...

Twelve Days of ZAPmas - Day 9 - Automated Scanning and ATTACK mode

application security | OWASP | automation | scanning

Automated scanning against an application is useful. It’s a faster and less labor-intensive way to ...

Twelve Days of ZAPmas - Day 8 - Spidering

OWASP | web application security

Spidering is an automated process that recursively finds and follows all the navigation from an ...

Twelve Days of ZAPmas - Day 7 - API Testing with Postman and ZAP

application security | OWASP | API

If you’ve done any significant amount of API development, there’s a good chance you’ve used ...

Twelve Days of ZAPMAS - Day 6 - Passive Flaw Detection and Using the HUD

application security | OWASP | web application security | scanning

One of the awesome things about a security-focused interception proxy like ZAP is its ability to ...

Twelve Days of ZAPmas - Day 5 - Scope and Contexts

application security | OWASP | web application security | scope

Normally I don’t like having my interception proxy hide out-of-scope traffic. Doing so creates a ...

1 2