Colors

A journey back in time: The analysis of the first version of my WAF

As you might already know, back in 2014, I've developed a custom Web Application Firewall. You'll see one adorning BreachDirectory…

7 years ago

10 ways to increase the security of your WordPress application

When someone mentions WordPress, you will often hear people saying "don't use it, it's insecure". In a sense, those people…

7 years ago

How I could have pwned my highschool (SQLi, CSRF, Hardcoded Passwords & XSS) Part 2: Investigating the Breach

Honestly, this is a blog title I've never expected to write, but hey, data breaches happen - no website is…

7 years ago

Your website needs a CSP. Here’s why

Here's a scenario: You create a website and make it available online. Your website ends up getting hacked (it happens…

7 years ago

Your website has assets – You need SRI

All websites have something worth protecting. Those valuable things are frequently loaded from a CDN (Content Delivery Network) which is a…

7 years ago

The path to a custom Firewall and a Content Security Policy on a Blog

Few years ago I found myself looking for a firewall. I've looked at various options from various security companies, but…

7 years ago

Creating a Secure Login Page

Login pages - they're everywhere. Almost every website has a login page - from big companies to discussion forums. In…

7 years ago

To padlock or not to padlock? SSL Explained

You visited a website, you saw a green padlock saying "Secure". Cool. But what does that actually mean? Does that…

7 years ago

Understanding & Mitigating Cross-Site Request Forgery (CSRF)

CSRF. Easy, enormously effective, frequently misunderstood. This attack can be called a sleeping lion because it is not taken as…

7 years ago