Rohit Jawa on Security

  The Vulnerabilities Hackers Find Over and Over Again If you read enough penetration test reports, a strange pattern emerges. Despite decades of security research and billions spent on defences, the same handful of weaknesses appear in report after report, year after year. They aren’t exotic. Most of them have been well understood since the early 2000s. They persist because software is written by busy humans under deadline pressure, and these mistakes are easy to make. The OWASP Top 10, a regularly updated list from the Open Worldwide Application Security Project, is the most widely used catalogue of these recurring flaws in web applications. This article walks through the most important categories in plain language, with no code required. Understanding why each one happens is the foundation of both finding and preventing them. 1. Injection The idea: An application takes input from a user and passes it, unfiltered, into a command that gets executed somewhere else, such...

  How a Penetration Test Actually Works, Start to Finish Movies show hacking as a frantic few minutes of typing followed by “I’m in.” Real penetration testing is slower, more methodical, and involves a surprising amount of paperwork. That structure is not bureaucracy for its own sake; it’s what makes the work legal, repeatable, and useful to the client. A penetration test (or “pentest”) is a simulated attack on an organisation’s systems, carried out by professionals with permission, to find weaknesses before real attackers do. Here’s what one looks like from the inside, broken into the phases nearly every tester follows. Phase 0: Scoping and authorisation Before a single packet is sent, the tester and the client agree on exactly what will be tested. This produces a scoping document and a signed authorisation, sometimes nicknamed the “get out of jail free card.” It answers questions like: •              Which sy...