Category: web app security
Web-Applications are the future. Any device, any location. Security principles are different, threats are new, but overall its simpler and better.
-
When the Foundation Fails: PHP2Shell and the eMudhra Certificate Compromise
Read more: When the Foundation Fails: PHP2Shell and the eMudhra Certificate CompromiseTwo incidents in one week expose broken foundations: PHP2Shell hides in unpatchable embedded firmware, while eMudhra generated certificate authority keys with single-digit entropy. Don Bowman explains why conventional perimeter defences fail and how granular identity-based authorisation restores control.
-
Same Old Shenanigans: The MITRE 2025 Top 25 List
Read more: Same Old Shenanigans: The MITRE 2025 Top 25 ListMITRE has released the 2025 CWE Top 25 list, and it is a stark reminder that software is still porous. We analyse the rise of authorization failures and the return of buffer overflows.
-
GoDaddy Got Got: Multi-Year Breach
Read more: GoDaddy Got Got: Multi-Year BreachA multi-year attack involving 1.2M customers, hosting, DNS. What could the miscreants have achieved? DKIM? SSL? Domain verification?
-
Protecting Against the OWASP Top 10 Web Application Vulnerabilities
Read more: Protecting Against the OWASP Top 10 Web Application VulnerabilitiesThe OWASP Top 10 is a standard awareness document that outlines the most critical web application security risks and vulnerabilities. Learn how Agilicus AnyX is designed to eliminate an attacker’s visibility into the potential OWASP Top 10 web application vulnerabilities.
-
Industrial Air Gap – A Tale Of 2 Users
Read more: Industrial Air Gap – A Tale Of 2 UsersIndustrial devices are hard to secure. Commonly done only via direct local access. Teams, however, wish remote access to improve efficiency. A solution to this battle is Zero Trust.
-
Multi-Factor Authentication And The Supply Chain
Read more: Multi-Factor Authentication And The Supply ChainA high(ish) profile nodejs library is compromised. No multi-factor authentication used by developer. The ripples are far and wide. Including you!
-
The Personal Verification Question: Password’s Dumb Cousin
Read more: The Personal Verification Question: Password’s Dumb CousinThe personal verification question. The dumb, slow cousin of the password. Stored in plaintext, findable in social media. Not multi-factor auth
-
Add multi-factor authentication to old applications
Read more: Add multi-factor authentication to old applicationsYour cyber insurance is up for review. IGet all applications authenticated with multi-factor, simply, quickly, compliantly.
-
Re-Using your Multi-Factor Authentication To Prove Humanity
Read more: Re-Using your Multi-Factor Authentication To Prove HumanitySpam. The cat and mouse game of advertisers seeking to reach more people for less cost, and, people seeking to spend more to not be reached. The current state of the art in proving “I am not a spam-sending robot” is the captcha. Do you love the captcha? Me neither. Do you sometimes fail it?…
-
Angular Content-Security-Policy Complex Nonce: Google Tag Manager
Read more: Angular Content-Security-Policy Complex Nonce: Google Tag ManagerContent-Security-Policy protects our application, but challenging with external scripts like Google Tag Manager. We show in Angular Single Page Application.
-
Let’s Encrypt X3 to R3 and Certificate Transparency Logs
Read more: Let’s Encrypt X3 to R3 and Certificate Transparency LogsCertificate Transparency Logs in SSL can be a useful diagnostic tool as well as a security forensic.
-
OAuth 2.0 Protected Resource Threats
Read more: OAuth 2.0 Protected Resource ThreatsThe OAuth 2.0 protected resource. It takes the access token and uses it to grant access. Watch out for it becoming compromised.
-
OAuth 2.0 Refresh Token Threats
Read more: OAuth 2.0 Refresh Token ThreatsOAuth 2.0 refresh tokens are used to obtain new access tokens on the user’s behalf. If lost, they can allow an attacker to masquerade.
-
OAuth 2.0 Token Endpoint Threats
Read more: OAuth 2.0 Token Endpoint ThreatsThe OAuth 2.0 Token Endpoint. Its were authorisation becomes real. Secure it to prevent guessing
-
OAuth 2.0 Authorisation Endpoint Threats
Read more: OAuth 2.0 Authorisation Endpoint ThreatsOAuth 2.0 Authorisation Endpoints are the front-door skeleton-key creator of all your front-doors. So protect them carefully.
-
OAuth 2.0 Client Threats
Read more: OAuth 2.0 Client ThreatsOAuth 2.0 and the client. Use Defense In Depth. Secure the client, and then assume it can still be compromised. Zero Trust.
-
OAuth 2.0 Threat Model and Security Considerations
Read more: OAuth 2.0 Threat Model and Security ConsiderationsOAuth 2.0 has simplified authentication and authorisation for many applications, shifting from custom code to simple library import. However, as more applications come to rely on it, this makes its weaknesses more interesting. An attacker can gain access to a broader set of data via a smaller set of tactics and techniques. First lets understand…
-
OAuth 2.0 Proof of Possession
Read more: OAuth 2.0 Proof of PossessionOAuth 2.0 replaced Proof of Possession with Bearer Tokens for simplicity, a controlversial decision. A new draft brings them back.
-
OAuth 2.0 Access Token Demonstrate Proof of Possession
Read more: OAuth 2.0 Access Token Demonstrate Proof of PossessionTheft of an Access Token need not be a complete loss. Learn how Demonstration of Proof Of Possession can reduce this risk.
-
Blurring the web and the app: web push
Read more: Blurring the web and the app: web pushWeb push. An important part of making web applications peer to native, and more secure, more accessible.
-
My team works outside, why can’t their Kronos Timesheet?
Read more: My team works outside, why can’t their Kronos Timesheet?Access your on-premise Kronos from any user, from any device, from any network. Increased security, increased simplicity. Zero Trust Networking.
-
The JWT Bearer Token: You On The Wire
Read more: The JWT Bearer Token: You On The WireA bearer token is a cryptographic representation of who (you) and what (authorisation) that is used on a per-transaction basis. Learn and Use!
-
Take time to stop and sniff the mime type
Read more: Take time to stop and sniff the mime typeHappy Eyeballs? Mime-Type-Sniffing? Security wins, don’t infer content type from file name.
-
WEB SECURITY 101
Read more: WEB SECURITY 101January 2020 Waterloo Technology Chautauqua, Web Security 101
-
USE OF POSTMAN WITH OPENID CONNECT PKCE AND API
Read more: USE OF POSTMAN WITH OPENID CONNECT PKCE AND APIMany API’s, Agilicus’ included, use OpenAPI to specify how they function. Authentication of these is usually left out of scope, but, provided as a bearer token. This means that if you write a web application, you want to directly use the RESTful API’s, and you do so by first authenticating via OpenID Connect PKCE flow…
-
Zero Trust: Connecting The Digitally Disconnected
Read more: Zero Trust: Connecting The Digitally DisconnectedDigitally Disconnected. The 2nd class citizens of the 21st Century. Unable to access data due to identity or VPN. NO MORE! Zero Trust.
-
Static Application Scanning Angular: Resolving lodash npm audit
Read more: Static Application Scanning Angular: Resolving lodash npm auditStatic Application Scanning with Angular can sometimes block release with no solution. Learn about better-npm-audit.
-
Secure the Cookie!
Read more: Secure the Cookie!The humble cookie. So controversial. So complex to secure. If your web app must have them, you must secure them.
-
Fixing the case of the Implicit Flow modification
Read more: Fixing the case of the Implicit Flow modificationMeet Hank. Hank is a web application with a dark secret. It trusts you the user to not change things in the browser. Bad Hank. Learn how to fix it!
-
Why should I use Content-Security-Policy?
Read more: Why should I use Content-Security-Policy?The Content-Security-Policy headers exists to protect the users of your web site from the content they themselves might create.