Nadia Benali

if you only watch one thing to understand SQL injection, make it this Computerphile one. Tom explains WHY it works with an actual login box, not just " OR 1=1. understanding the query is the whole thing

every breach notification email: "we take your privacy seriously and there is no evidence your data was misused". translation: we were not looking, we still are not looking, and we found out from a journalist. the passive voice in these emails should be a CVE on its own

be honest: do you run curl | sh?

push notification MFA where you just tap "approve" trains users to approve. attackers spam you at 3am until you tap it to make it stop. this is MFA fatigue and it is why number matching and passkeys exist. SMS 2FA is better than nothing and worse than everything else

forcing users to change their password every 90 days does not make you secure, it makes everyone go from Summer2024! to Summer2024!! and write it on a sticky note. NIST dropped this advice in 2017. your IT policy is doing security cosplay, not security

the invoice IDOR that paid for my holiday, and the 94 days it took to fix

this is a writeup of a bug I reported to a SaaS billing vendor I am calling "Facturo" here (not the real name, the program is private and I am still under their disclosure terms). nothing in this post lets you attack them or anyone else. it is a plain IDOR, the oldest bug in the book, and the only reason it is interesting is the 94 days it took them to admit it. the setup Facturo is a billing dashboard that a few…

Log4Shell, four years later: the lesson everyone said they learned and nobody did

Log4Shell (CVE-2021-44228, December 2021) is old news, but I keep seeing the same mistakes it should have cured, so here is the short version and what it was actually about. what happened Log4j is a Java logging library that is inside an enormous amount of the world's software. it had a feature where a logged string could trigger a lookup, and an attacker who could get a crafted string logged (a username, a user…

how to actually start in security (hint: not by downloading 40 tools)

I get the same DM twice a week: "how do I get into hacking". so here is the answer once, properly, and I will just link this from now on. the mistake everyone makes is starting with tools. they install kali, run thirty programs they cannot read the output of, and give up in a month. you do not need kali to start. you need to understand how the web works, and then practise on things that are built to be broken. step…

closed as informative: the SSRF that read the cloud metadata and still was not "a bug"

a short angry story, because I need to vent and because "informative" is the most insulting word in bug bounty. a company (private program, calling them "Shipr") had an image import feature. you give it a url, it fetches the image server side and stores it. classic SSRF territory. I pointed it at an internal address that only their own servers can reach, the kind of link to a cloud metadata service, and it happily…

the heap overflow I reported to skerry, and why @kernel_karl is the gold standard

since this topic is usually about maintainers behaving badly or companies being awful, here is the opposite, because it deserves saying out loud. last year I was fuzzing C JSON parsers for fun (yes, that is my idea of fun) and I found a heap buffer overflow in skerry, the little parser Karl maintains and that, as his bio says, half your companies vendor and never thank. a malformed deeply nested input could write…