Cybersecurity - By Reference

Sign in Subscribe

Cybersecurity

Web Application Penetration Testing (WAPT): JWT Vulnerabilities

Hello everyone, in this article we will look at the most common vulnerabilities involving misconfigured JWTs! 🕵️‍♂️🐛 First of all, what is a Json Web Token (JWT)? In brief, it is a compact, URL-safe means of representing claims between two parties. It is widely used for handling authentication and authorization in

Web Application Penetration Testing (WAPT): Cross-Site Scripting (XSS)

Hello world, today we will see Cross-Site Scripting (also known as XSS) which is one of the most famous cyber attacks against web applications. This attack is relatively easy to carry out, but can lead to serious consequences, such as: data theft, session hijacking, phishing attacks, web defacement, and malware

Web Application Penetration Testing (WAPT): SQLmap

Hello everyone! Today, I will share my knowledge about SQLmap, an open-source penetration testing tool designed to detect and exploit SQL injection vulnerabilities in web applications. This tool is an essential addition to your toolbox. 😈💉 If you do not know anything about SQL injection attacks? Please read this article before

Web Application Penetration Testing (WAPT): SQL Injection

Hello world, SQL Injection (SQLi) is a cybersecurity threat targeting relational databases which exploits vulnerabilities in the back-end code to execute malicious SQL commands. This allows attackers to access and/or manipulate sensitive data. 💉😈 Below there is an example of a vulnerable snippet of Python code where the untrusted user

Web Application Penetration Testing (WAPT): Introduction

Hello world, let's start a new exciting journey about Web Application Penetration Testing (WAPT), which is a security testing method that involves the identification, analysis, and exploitation of vulnerabilities in web applications with the aim of improving their resistance to cyber attacks. The primary goal of WAPT is

Think Your Password is Enough? Think Again!

Most people believe that a complex password, coupled with two-factor authentication (2FA), provides impenetrable security. The logic seems sound: even if your password is compromised, an attacker would still need physical access to your phone to breach your account, right? Well, not quite! Today, I’m going to shatter this

Say Goodbye to Passwords!

Hello world, in this article we will talk about Passkeys, the future way to authenticate yourself without using the obsolete password mechanism. 🔐 You already know what is a password, how complex is its management, and all its related security risks. Handling strong passwords is extremely difficult and they are the

Do You Really Need a VPN?

Hello world, today we will see what a VPN is and how it works. Don't worry, this article was not sponsored by NordVPN or Wireshark! 🤣 In brief, a Virtual Private Network (VPN) is a technology that creates a secure and encrypted connection over a less secure network, such

Deep Dive into LLM Security: Best Practices, Guardrails, and AI Firewalls

Hello everyone, this is the last post of the "Deep Dive into LLM Security" journey. In this article we will see how to protect your LLMs against the most common security threats! 🛡️🔥 LLMs were designed to be as accurate as possible in their answers, but they were not

Deep Dive into LLM Security: Automated Scanners

Hello everyone, this is the 5th post of the "Deep Dive into LLM Security" journey. In this article we will see how to automatically scan LLMs to identify potential vulnerabilities! ⚔️🎯 There are a lot of existing tools which can help you to evaluate the security posture of your

Deep Dive into LLM Security: Prompt Injection vs. Jailbreak

Hello everyone, this is the 4th post of the "Deep Dive into LLM Security" journey. In this article we will see the difference between Prompt Injection and Jailbreak! 💉⛓️ The techniques described below are intended solely for educational purposes and ethical penetration testing. They should never be used for

Deep Dive into LLM Security: Adversarial Prompts

Hello everyone, this is the 3rd post of the "Deep Dive into LLM Security" journey. In this article we will see how to persuade LLMs to generate harmful content! 😈 The techniques described below are intended solely for educational purposes and ethical penetration testing. They should never be used

Deep Dive into LLM Security: Leading Security Frameworks

Hello everyone, this is the 2nd post of the "Deep Dive into LLM Security" journey. In this article we will see the two most famous security frameworks for LLMs! 🛡️😈 While LLM-specific security frameworks are still emerging, several broader AI and cybersecurity frameworks can be applied to LLMs. Here

Deep Dive into LLM Security: Introduction

Hello everyone, let's start our first journey about LLM security! 😄 First of all, what is a journey? In our site, a journey is simply a series of articles on the same topic with the aim of providing the reader with a good level of knowledge on the matter.