Ostorlab: Mobile App Security Testing for Android and iOS

The Complete Guide to Healthcare Application Security Testing: Protecting ePHI, Medical Apps, and Patient Trust

Kawtar Boumaan — Thu, 16 Apr 2026 16:00:00 +0200

This comprehensive guide explores the critical role of application security testing in modern healthcare. It covers the shift toward application-driven care, the unique value of ePHI, and the regulatory landscape (HIPAA/GDPR). The article outlines a robust strategy for securing the healthcare ecosystem, including patient portals, APIs, and SaMD, while highlighting how autonomous tools like Ostorlab’s Deep Agentic Scan are defining the future of continuous, scalable security validation.

Mobile Banking Security Testing: Protecting Financial Apps, Data, and Transactions

Abir Jelti — Thu, 16 Apr 2026 09:59:00 +0200

Protecting mobile banking apps requires more than securing the client alone. This guide explores the risks across devices, networks, and backend systems, and explains why continuous mobile security testing is essential for protecting financial data and transactions.

Twenty CRM Serverless Functions Expose Critical RCE and Permanent Unauthenticated Backdoor Risk (CVE-2026-26720) - PoC & Exploit

Mohammed Lachhab — Wed, 15 Apr 2026 09:00:00 +0200

A technical breakdown of CVE-2026-26720, a CVSS 9.8 Critical authenticated Remote Code Execution vulnerability in Twenty CRM (≤ v1.15.0). Any workspace member can create and execute serverless functions that run unsandboxed with full access to process.env, leaking APP_SECRET, PG_DATABASE_URL, and all server-side credentials. When combined with webhook-triggered workflows exposed via PublicEndpointGuard, a single authenticated attacker can install a permanent unauthenticated RCE backdoor accessible from anywhere on the internet.

DORA Third‑Party Risk for Mobile AppSec: SDK Governance and Audit‑Ready Evidence Packs

Bilal Harras — Tue, 14 Apr 2026 18:00:00 +0200

A deep dive into DORA-focused third‑party risk for mobile AppSec, showing why embedded SDKs and runtime providers demand release‑scoped governance because vulnerabilities persist across multiple app versions in the wild and provider outages directly break critical journeys. It outlines an audit‑ready approach built on per‑release SDK inventories and diffs, approval/ban rules, patch SLAs with time‑boxed exceptions, and evidence packs that stay version‑scoped, indexed, and quickly retrievable.

Mobile Application Shielding: What it is and How it works

Youssef Mabrouk — Mon, 13 Apr 2026 12:00:00 +0200

Mobile application shielding protects apps on untrusted devices by preventing reverse engineering, tampering, debugging, and unauthorized access to sensitive data. It helps security teams secure critical app logic, sensitive information, and transactions even if the device is compromised.

New Roundcube Webmail Vulnerabilities Disclosed : IMAP Command Injection and SSRF via CSS Proxying.

Aziz Elbelaychy — Wed, 08 Apr 2026 18:00:00 +0200

A deep dive into two critical vulnerabilities uncovered in Roundcube Webmail (< 1.6.14, 1.5.14, 1.7 RC4) during a source code review. OVE-2026-8 allows authenticated attackers to inject arbitrary IMAP commands via the _filter parameter due to missing CRLF sanitization. OVE-2026-9 enables Server-Side Request Forgery (SSRF) by exploiting the CSS proxying mechanism, allowing access to internal network resources and cloud metadata.

Announcing Ostorlab for Harness: Mobile Security Scanning in CI Pipelines

Abir Jelti — Mon, 06 Apr 2026 16:51:00 +0200

Ostorlab now integrates with Harness CI to run automated mobile application security scans inside CI pipelines. Using Harness Secrets and a simple Run step, teams can install the Ostorlab CLI and run ostorlab ci-scan run against the same build artifacts produced by the pipeline (e.g., Android APK, Android AAB, or iOS IPA). The integration helps bring security into CI by improving feedback speed and catching vulnerabilities earlier, with options to tailor scans via profiles (fast, full) and optional inputs like test credentials, SBOM, and UI prompts.

CVE-2026-27971 : Qwik server$ Unauthenticated Remote Code Execution

Aziz Elbelaychy — Wed, 01 Apr 2026 14:00:00 +0200

A technical breakdown of CVE-2026-27971, a CVSS 9.2 critical unauthenticated remote code execution vulnerability in Qwik (< 1.19.1). Unsafe deserialization in the server$ RPC flow allows attacker-controlled QRL objects to be reconstructed from application/qwik-json requests, enabling arbitrary module path and symbol resolution and, where require() is available,remote code execution via crafted server-side function invocation.

How to Automate Security Testing Behind Login Walls (2FA & MFA)

Abir Jelti — Mon, 30 Mar 2026 16:44:00 +0200

Modern applications are more secure than ever, but that security introduces a major challenge. With the widespread adoption of Two-Factor Authentication (2FA) and Multi-Factor Authentication (MFA), automated security testing often stops at the login stage. As a result, automated testing often fails to reach the parts of the application where real user activity and risk exist.

Announcing Ostorlab for Bitrise: Mobile security scans in your CI

Bilal Harras — Fri, 27 Mar 2026 14:44:00 +0100

Ostorlab now integrates with Bitrise to run automated mobile application security scans inside CI workflows. Using a Bitrise Secret plus a simple Script step, teams can install the Ostorlab CLI and run ostorlab ci-scan run against the same build artifacts produced by the pipeline (e.g., Android APK, Android AAB, or iOS IPA). The integration helps shift security left by shortening feedback loops and catching vulnerabilities earlier, with options to tailor scans via profiles (fast, full, agentic deep scan) and optional inputs like test credentials, SBOM, and UI prompts.

Deep Agentic Scan (BYOK), New CI Integrations, Scan Filters & Performance

Ostorlab Team — Fri, 27 Mar 2026 00:00:00 +0100

This release highlights Agentic Deep Scan with BYOK (Bring Your Own AI Key), adds Harness + Bitrise CI documentation, introduces scan filtering by tags and owners, and delivers major performance improvements across tickets and scans.

CVE-2026-2599 : Unauthenticated PHP Object Injection → WP_HTML_Token POP Chain

Mohammed Lachhab — Wed, 25 Mar 2026 14:00:00 +0100

A technical breakdown of CVE-2026-2599, a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the "Contact Form Entries" WordPress plugin (≤ 1.4.7). The download_csv function deserializes untrusted user input without allowed_classes restrictions. When combined with WordPress 6.4.0-6.4.1, the built-in WP_HTML_Token class provides a complete all-public POP chain leading to full Remote Code Execution via two unauthenticated HTTP requests.

Mobile Operational Resilience Under DORA: The simplest drill library for BFSI journeys

Bilal Harras — Tue, 24 Mar 2026 14:44:00 +0100

A mobile-first guide to DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process, and avoid the traps that create unnecessary compliance work.

Ostorlab Launches Agentic Deep Scan: The next-generation vulnerability scanner

Ostorlab Team — Thu, 19 Mar 2026 11:00:00 +0100

Ostorlab has launched Agentic Deep Scan, a next-generation vulnerability scanner that validates real-world risks in iOS, Android (soon harmonyOS), and web applications. With Bring Your Own Key (BYOK) support, teams can safely explore its powerful scanning capabilities while keeping full control of their data and costs.

Exploit CVE-2025-68461 : Roundcube Webmail SVG Animate XSS Sanitizer Bypass

Aziz Elbelaychy — Tue, 17 Mar 2026 14:00:00 +0100

A technical breakdown of CVE-2025-68461, a CVSS 7.2 high stored Cross-Site Scripting vulnerability in Roundcube Webmail (< 1.5.12 and < 1.6.12). The rcube_washtml sanitizer blocks SVG \ tags that target the href attribute, but the attribute_value() comparison does not strip XML namespace prefixes before matching. An attacker can use attributeName="xlink:href" to bypass the check entirely, delivering unsanitized javascript: URIs in the values attribute directly into the rendered email DOM. JavaScript execution is currently prevented by an accidental namespace corruption in PHP's DOMDocument::loadHTML() which strips the xlink namespace declaration, but the sanitizer bypass is confirmed and the vulnerability remains exploitable under alternative parser configurations such as the Masterminds HTML5 parser or PHP 8.4's Dom\HTMLDocument.

GHSA-cr3w-cw5w-h3fj: 1-Click RCE in Saltcorn

Mohammed Lachhab — Wed, 11 Mar 2026 13:00:00 +0100

Analysis of GHSA-cr3w-cw5w-h3fj, a CVSS 9.7 critical XSS-to-RCE vulnerability in Saltcorn (≤ 1.5.0-beta.19). Two chained flaws, reflected XSS in route parameters and command injection in backup generation, enable remote code execution via administrator phishing.

DORA Compliance for Mobile Releases: The easiest baseline, verdict, and exceptions model

Bilal Harras — Tue, 10 Mar 2026 14:44:00 +0100

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process, and avoid the traps that create unnecessary compliance work.

CVE-2026-26019 : LangChain RecursiveUrlLoader Server-Side Request Forgery Vulnerability

Aziz Elbelaychy — Wed, 04 Mar 2026 14:00:00 +0100

A technical breakdown of CVE-2026-26019, a CVSS 4.1 medium Server-Side Request Forgery vulnerability in the LangChain Community JavaScript package (< 1.1.14). The RecursiveUrlLoader class uses a naive string prefix check to validate crawled URLs, allowing an attacker to bypass the default preventOutside restriction with a suffixed domain and redirect the crawler to internal network assets, potentially exposing sensitive credentials and metadata endpoints.

DORA Compliance for Mobile Teams: Understanding scope and what you need to do

Bilal Harras — Tue, 03 Mar 2026 11:00:00 +0100

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process, and avoid the traps that create unnecessary compliance work.

Top 10 Mobile Pentesting Tools in 2026

Youssef Mabrouk — Fri, 27 Feb 2026 16:00:00 +0100

We work with mobile apps every day, and over time we’ve found a list of open-source tools that consistently make our testing more powerful, faster and fun. In this article, we’ve highlighted 10 mobile app pentesting tools we love using everyday.

CVE-2025-64712: Path Traversal RCE in Unstructured Library MSG Processing

Aziz Elbelaychy — Mon, 23 Feb 2026 08:00:00 +0100

A technical breakdown of CVE-2025-64712, a CVSS 9.8 critical path traversal remote code execution vulnerability in the Unstructured Python library (< 0.18.18). Unsanitized attachment filenames in Outlook MSG processing allow for path traversal, enabling an attacker to overwrite arbitrary files via a crafted MSG file and achieve code execution.

CVE-2026-1357: Unauthenticated RCE in WPvivid Backup Plugin

Mohammed Lachhab — Fri, 20 Feb 2026 08:00:00 +0100

A technical breakdown of CVE-2026-1357, a CVSS 9.8 critical unauthenticated remote code execution vulnerability in the WPvivid Backup & Migration plugin (≤ 0.9.123). Two chained flaws, a cryptographic fail-open and an unsanitized path traversal, allow arbitrary file write and shell upload without credentials.

8 Open-Source AI Pentest Tools for Security Teams in 2026

Youssef Mabrouk — Fri, 30 Jan 2026 08:20:00 +0100

This article lists eight (8) open-source AI pentest tools. It covers how autonomous agents are potentially changing the way security testing is done.

Ostorlab 2025 Year in Review

Manal Samir — Wed, 28 Jan 2026 16:20:00 +0100

2025 marked the turning point where AI in cybersecurity graduated from experimental prototypes to production-grade engines. In this retrospective, we explore how Ostorlab’s new AI Pentest Engine and AI Monkey Tester are already uncovering critical vulnerabilities in the wild, including a complex arbitrary file read chain in Signal for Android. From mapping global banking risks to orchestrating scans with OXO Titan, dive into the year we redefined what automated security testing can actually do.

Android Requires Developer Verification Starting from 2026

Youssef Mabrouk — Tue, 27 Jan 2026 10:47:00 +0100

For years, Android’s openness was one of its biggest strengths. Anyone could build an app, share it, and sideload it freely. Users were warned about the risks, but the choice was always theirs. Starting in 2026, Android will require developer verification for apps to run on certified devices. Apps from unverified developers can be blocked, even when users knowingly install them. Google calls it security. Critics call it a loss of freedom. Understanding what’s changing and where Android draws the line now matters more than ever.

That Time a Zero (could have) Broke the Internet's Plumbing (CVE-2026-0915)

Ostorlab Team — Wed, 21 Jan 2026 16:20:00 +0100

An AI-assisted analysis uncovered a 30-year-old uninitialized buffer vulnerability in glibc's _nss_dns_getnetbyaddr_r function. This case study details how a zero-input edge case bypasses loop logic, causing the library to transmit raw stack memory to external DNS servers, and benchmarks how various AI models succeeded in identifying this subtle logic error where human review failed.

Javascript Interface Exposure

Mohamed Nasser — Wed, 07 Jan 2026 00:00:00 +0100

Ostorlab's Pentest Engine identified a JavaScript bridge exposure in an Android WebView, allowing unauthenticated native method invocation via deep links. This case study details how the engine bypassed insecure Intent handling to manipulate the native UI, validating a potent social engineering vector while confirming the effectiveness of the underlying sandbox.

Top Mobile App Security Testing Platforms 2026

Bilal Harras — Mon, 05 Jan 2026 16:20:00 +0100

Navigate the market for the Top Mobile App Security Testing Platforms 2026 by focusing on the criteria that actually matter for your delivery workflow. Our guide details exactly what to look for, including seamless CI/CD integration, powerful detection, and high-fidelity signal-to-noise ratios. Learn how to evaluate vendors on scalability, multiplatform support, and collaboration features to select a partner that secures your mobile releases without slowing you down.

Understanding Android's FLAG_SECURE for Screen Security

Bilal Harras — Mon, 29 Dec 2025 16:20:00 +0100

What Android’s FLAG_SECURE does, how it prevents screenshots and screen recordings of sensitive app content, how to implement it correctly, where it makes sense to use it, and the key limitations and UX trade-offs developers need to understand, including its behavior with casting and external displays.

AI Pentest Engine Discovers Critical WebSocket BFLA in GraphQL Subscriptions

Abderrahim Haddadi — Fri, 26 Dec 2025 16:20:00 +0100

Ostorlab's AI Pentest Engine systematically uncovered a critical Broken Function-Level Authorization (BFLA) vulnerability in a GraphQL WebSocket endpoint, allowing unauthenticated access to a real-time translation service. This case study details the AI's step-by-step process, from discovery to proof-of-concept.

AI Pentest Upgrades, ServiceNow Integration, Redesigned Email Notifications, and Enhanced Platform Controls

Ostorlab Team — Wed, 17 Dec 2025 00:00:00 +0100

This release delivers major advancements across the Ostorlab platform, including a significant upgrade to AI Pentest, enhanced web and mobile automation, a full-featured ServiceNow integration, redesigned email notifications, improved threat intelligence capabilities, and comprehensive access control enhancements with role and owner-based permissions.

AI Engine Triggers Account Takeover via API Version Confusion

Amine Atyq — Mon, 15 Dec 2025 10:00:00 +0100

Methodical analysis beats blind fuzzing as Ostorlab's AI engine discovers cross-version password reset weakness and achieves account takeover without email access.

Uncovering a Second-Order Data Exfiltration Chain in Modern SPAs

Mouad Ait Ougrram — Wed, 10 Dec 2025 16:20:00 +0100

How a second-order client-side data exfiltration chain was discovered in a modern SPA, transforming a simple open redirect into a multi-stage data theft vulnerability through JavaScript analysis and exploit chain validation.

Ostorlab AI Pentest Engine: How it Works

Ostorlab Team — Mon, 27 Oct 2025 16:20:00 +0100

Technical deep dive into Ostorlab AI Pentest Engine inner working, from threat intelligence, risk identification, mobile support to vulnerability validation.

Going Beyond: Ostorlab AI Engine Discovers Unknown Vulnerability Classes

Ostorlab Team — Mon, 13 Oct 2025 16:20:00 +0200

Ostorlab’s reasoning-driven AI engine breaks past rule-based limits to surface previously unknown and hard-to-detect vulnerabilities—including WebView Safe Browsing bypasses, SQLi via projections, WebCrypto key exfiltration, and JWT verification ordering flaws—delivering deeper, smarter, complementary security coverage.

Mobile Benchmarking, Monkey Tester Reliability, and Deeper Web Crawling

Ostorlab Team — Tue, 23 Sep 2025 00:00:00 +0200

This release introduces newly developed insecure mobile apps, improves the Monkey Tester for reliable prompt-based input during dynamic scans, and enhances the web crawler to explore deeper routes with faster performance. These improvements boost scanning coverage, accuracy, and reliability

Introducing Ostorlab Security Testing Benchmarks: Real Vulnerabilities, Real Impact

Ostorlab Team — Mon, 22 Sep 2025 16:20:00 +0200

The first open-source benchmark suite featuring 93 realistic vulnerable mobile apps that mirror actual CVE and bug bounty findings - not theoretical textbook examples.

Banking Report 2025: Security at the Core of Mobile Finance

Ostorlab Team — Mon, 15 Sep 2025 10:00:00 +0200

Large-scale security analysis of 500+ top mobile banking apps reveals widespread vulnerabilities, decade-old codebases, and concerning backend centralization patterns.

Automating Security Research: AI Engine Exploits Complex Blind Code Injection

Ostorlab Team — Thu, 04 Sep 2025 16:20:00 +0200

Precision beats payload spray using Ostorlab's AI engine to systematically land RCE on Titiler and proves exfiltration without a single stack trace.

AI-Powered Pentesting: A Deep Dive into Android Intent Redirection

Ostorlab Team — Sun, 31 Aug 2025 16:20:00 +0200

This article showcases Ostorlab's AI Pentest Engine's process for analyzing an Android application for Intent Redirection vulnerabilities. Follow the engine's journey from static analysis and initial findings to rigorous dynamic validation, demonstrating its ability to not only identify potential threats but also to meticulously discard false positives.

Automating Security Research: AI Engine Exploits GCP Service Account Secret

Ostorlab Team — Thu, 28 Aug 2025 16:20:00 +0200

This article presents a thorough, hands-on analysis and real-world exploitation of a hardcoded GCP service account with overprivileged Pub/Sub access discovered in a HackerOne mobile app. It details how Ostorlab’s AI-powered pentesting engine automated the full cycle—from authentication and permission enumeration to end-to-end message injection/interception—enabling remediation within four days.

From Signal to the Android SDK: Chaining Path Traversal, Mimetype Confusion, Security Check Bypass and File Descriptor Bruteforce for Arbitrary File Access

Ostorlab Team — Mon, 11 Aug 2025 16:20:00 +0200

This technical analysis reveals how sophisticated attack chains—combining path traversal, symbolic link manipulation, and Android SDK quirks—can breach Signal Android's defenses to extract sensitive internal files, despite its legendary encryption remaining intact. While Signal patched these vulnerabilities within days, the discoveries offer crucial lessons about how seemingly minor bugs can be chained into powerful exploits, and why even the best security architecture needs multiple layers of defense

Automating Security Research: AI Engine Exploits Report Portal XXE (CVE-2021-29620)

Ostorlab Team — Thu, 07 Aug 2025 16:20:00 +0200

This article presents a thorough, hands-on analysis and proof of concept for exploiting an OOB XXE vulnerability CVE-2021-29620 in Report Portal. It details how Ostorlab's AI-powered pentesting engine was used to automate the full cycle.

From Random to Intelligent: How AI-Powered Monkey Testing Achieves 10x Mobile App Coverage

Ostorlab Team — Fri, 01 Aug 2025 16:20:00 +0200

Ostorlab’s AI Monkey Tester transforms mobile app security testing by using natural language prompts and generative AI to automatically generate intelligent, context-aware test scenarios, resulting in up to a 10x increase in application coverage compared to traditional, rule-based testing approaches.

Automating Security Research: AI Engine Exploits Zulip Stored XSS (CVE-2025-52559)

Ostorlab Team — Mon, 28 Jul 2025 16:20:00 +0200

This article presents a thorough, hands-on analysis and proof of concept for exploiting the stored XSS vulnerability CVE-2025-52559 in Zulip. It details how Ostorlab's AI-powered pentesting engine was used to automate the full cycle.

SSL Scanner Overhaul and Improved UI Call Coverage Powered by User-Defined Prompts

Ostorlab Team — Tue, 22 Jul 2025 00:00:00 +0200

This release introduces major enhancements to our AI-powered UI exploration engine, delivering smarter and more adaptive dynamic scanning across modern applications. We've overhauled our SSL scanner to detect 15+ critical SSL/TLS vulnerabilities with improved precision, and rebuilt the taint analysis engine for deeper and more reliable vulnerability detection. The release also expands coverage for secrets detection, mobile misconfigurations, and modern CVEs. Across the board, platform performance has been refined for greater speed, stability, and accuracy.

Know Your App's Data Habits: A Deep Dive into Our Comprehensive Privacy Analysis

Anas Zouiten — Tue, 27 May 2025 10:00:00 +0200

Ostorlab's Privacy Scan automatically detects mismatches between what your app's privacy policy says and what it actually does. This comprehensive analysis of policy text, permissions, code, and UI elements helps mobile developers avoid compliance violations and build user trust through accurate privacy practices.

Ostorlab Security Scanner GitHub Integration

Abderrahim HADDADI — Wed, 21 May 2025 16:20:00 +0200

The Ostorlab Security Scanner GitHub Integration enhances mobile app development workflows by embedding automated security directly into the CI/CD pipeline. It offers a GitHub Action for scanning mobile application on every code push. It adds inline vulnerability insights directly to pull requests, highlighting the exact code changes that introduced issues and suggesting one-click fixes developers can apply without leaving GitHub.

Scan, Sync, Remediate: Ostorlab Meets Vanta for Faster Audits

Mohamed El Yousfi — Tue, 20 May 2025 12:00:00 +0200

This article announces the new integration between Ostorlab and Vanta, explains how it works, outlines the setup process, and highlights the key benefits for security and compliance teams.

Expanded Privacy Analysis, Attack Surface Profiling, and GitHub Source Mapping Improvements

Ostorlab Team — Mon, 12 May 2025 00:00:00 +0200

Ostorlab's May 2025 update delivers comprehensive privacy analysis capabilities with 21 new data collection categories and enhanced verification tools. This release introduces specialized Attack Surface scan profiles for optimized security assessments, adds GitHub source code integration for precise vulnerability mapping, and implements QPS rate limiting for controlled scanning. Additional improvements include mobile scan URL regex controls, streamlined Jira integration, and expanded fingerprinting capabilities for improved detection accuracy.

Bypassing Obfuscation in Android Apps: A Dual Approach with DalvikFLIRT and LLM-Powered Rewrites

Ostorlab Team — Wed, 16 Apr 2025 10:00:00 +0200

This research introduces a pioneering dual approach that combines signature-based matching (DalvikFLIRT) with LLM-powered code transformation to bypass sophisticated Android app obfuscation, enabling automated security analysis of previously impenetrable code.

CNIL Standard Integration, SARIF Support, Copilot Enhancements, and Smarter Vulnerability Analysis.

Ostorlab Team — Mon, 07 Apr 2025 00:00:00 +0200

This release introduces CNIL standard support, SARIF export, and improved vulnerability insights with locations and advanced search. Copilot is more powerful, performance is faster, and asset and remediation workflows are smoother.

From Moonshot to Production: Building Ostorlab Copilot

Mouhcine Narhmouche — Mon, 24 Feb 2025 10:00:00 +0100

This article outlines our journey in implementing ostorlab copilot, the challenges we encountered, and the lessons we learned along the way.

Ostorlab's Security Scanner GitHub App,Ticket Aggregation V2, Copilot Launch, and Enhanced Security Features

Ostorlab Team — Thu, 20 Feb 2025 00:00:00 +0100

February's update introduces Ticket Aggregation V2 and Ostorlab Copilot, alongside improvements to reporting capabilities and detection mechanisms. These updates enhance vulnerability management, user experience, and security analysis across the platform.

Effective Vulnerability Ticketing System with Ostorlab

Ostorlab Team — Tue, 18 Feb 2025 18:00:00 +0100

This article announces Ostorlab's vulnerability ticketing system V2 and how it automates and streamlines the entire process of managing, and remediating security vulnerabilities through features like automated ticket creation, lifecycle management, policy enforcement, and integration with existing tools.

AI-Automated Attack Surface Management: The Future of Cybersecurity Discovery

Ostorlab Team — Fri, 14 Feb 2025 18:00:00 +0100

This article explores AI-automated attack surface management, its impact on cybersecurity, and how it automates asset discovery and vulnerability detection.

AI-automated Attack surface, Privacy Analysis, Wordpress agent, and more.

Ostorlab Team — Mon, 20 Jan 2025 20:00:00 +0100

Ostorlab's January 2025 update introduces AI-powered attack surface discovery and improves IDE performance. The release expands detection capabilities with new secret and privacy checks, adds a WordPress security agent, and implements additional threat fingerprints and CVE support. A new Privacy profile for compliance analysis is launched, along with enhancements to scan options and vulnerability reporting. These updates aim to improve asset analysis, security assessments, and risk mitigation across various digital environments.

Advanced Search Query, API Endpoints, Tons of new detections, and more.

Ostorlab Team — Mon, 02 Dec 2024 20:00:00 +0100

The December release introduces advanced inventory search with Python-like syntax, enhanced asset status filtering, API endpoint autodiscovery, and comprehensive scan summaries. Additionally, it adds GraphQL vulnerability detection, domain takeover prevention, new CVE detections, privacy compliance checks, and Jira integration improvements for streamlined issue management.

Pre-Auth Root RCE Vulnerability in CyberPanel: Deep Dive Exploit Analysis

Ostorlab — Wed, 30 Oct 2024 00:00:00 +0100

A technical analysis of a vulnerability in CyberPanel, a Pre-Auth Root RCE, including confirmed exploitation paths, investigated components, and research methodology findings.

Revamped Search, new detection capabilities, actively exploited CVEs and much more.

Ostorlab Team — Tue, 22 Oct 2024 20:00:00 +0200

The latest releases introduces a revamped search UI, new detection capabilities, attack surface & inventory performance improvements, plus much more.

Defending Against GraphQL Attacks: A Deep Dive into Common Vulnerabilities

Mouhcine Narhmouche — Mon, 21 Oct 2024 00:00:00 +0200

This article is an in-depth look at the most common GraphQL vulnerabilities, why they occur, and how they can be mitigated.

Assessing the Large-Scale Exposure of CUPS Vulnerabilities: Chained CVEs Leading to Remote Code Execution

Youssef Badaoui — Wed, 16 Oct 2024 00:00:00 +0200

This article assesses the large-scale exposure of systems to multiple CVEs affecting the CUPS printing service, which can be chained together to achieve unauthenticated remote code execution (RCE). We provide an overview of how these vulnerabilities, including CVE-2024-47176, work in tandem, walking through the exploit flow. Additionally, we analyze how many systems are potentially vulnerable and highlight a unique behavior observed during testing.

Threat Center v2: Staying Ahead of Vulnerabilities

Adnane Serrar — Thu, 10 Oct 2024 12:00:00 +0200

The Threat Center provides essential updates for organizations to stay informed about security threats, offering actionable intelligence and detailed asset information to help users proactively protect their systems.

Deep Dive: Stored XSS Vulnerability in LiteSpeed Cache Plugin for WordPress (CVE-2024-47374)

Nour Eddine Masdoufi — Thu, 10 Oct 2024 00:00:00 +0200

An in-depth look at the CVE-2024-47374 vulnerability affecting LiteSpeed Cache plugin for WordPress, its impact, and a technical breakdown of our detection method.

HTTP2, Private Custom Checks, actively exploited CVE and much more.

Ostorlab Team — Mon, 07 Oct 2024 00:00:00 +0200

The latest releases introduce HTTP/2 support, improve UI and detection, enhance privacy and security measures, and update custom checks and analysis environments for better performance.

Actively Exploited CVE-2022-21445, Deep Dive

Nour Eddine Masdoufi — Wed, 25 Sep 2024 00:00:00 +0200

The article delves into the technical details of this CVE, its potential impact, and the methods used to detect and exploit it.

Unraveling the VigorConnect Vulnerability: A Journey of Discovery and Correction

Nour Eddine Masdoufi — Thu, 12 Sep 2024 00:00:00 +0200

The article uncovers an Arbitrary File Read vulnerability in VigorConnect that lets attackers access sensitive files. The issue originates from improper input validation in file handling methods.

Enhanced Vulnerability Detection, Expanded Features, and Critical Fixes

Ostorlab Team — Mon, 09 Sep 2024 00:00:00 +0200

This update introduces enhanced vulnerability detection with AI improvements, new UI features, expanded support for asset types, upgraded network interception, and broader CVE coverage, alongside several bug fixes and optimizations across scanning, fingerprinting, and GitHub Actions.

OXO Titan, Support for CVSS4, and Attack Surface search with certificates

Ostorlab Team — Wed, 28 Aug 2024 16:00:00 +0200

Our latest release features a new OnPrem UI, better PDF Reports with insightful graphs, support for CVSS4, plus much more.

OXO Titan UI: Simplifying Security Scanning for Everyone

Mohamed El Yousfi — Mon, 26 Aug 2024 16:16:00 +0200

OXO Titan UI encapsulates OXO's capabilities within an accessible interface, democratizing advanced security scanning techniques. This article explores OXO Titan's journey from concept to reality, highlighting its key features and presenting a practical user workflow example.

Privacy Compliance Testing, Fingerprint detection, and User Experience Enhancements

Ostorlab Team — Mon, 12 Aug 2024 14:00:00 +0200

Dive into our latest release featuring the introduction of Privacy Compliance Testing, new detection of several fingerprints, and User Experience Enhancements.

Threat Center, Account Security Enhancements, and added detection

Ostorlab Team — Mon, 05 Aug 2024 13:00:00 +0200

Dive into our latest release featuring the introduction of a Threat Center, enhanced account security, and new detection.

Advanced Techniques for Bypassing 403 Errors

Othmane Hachim — Mon, 05 Aug 2024 00:00:00 +0200

Discover the comprehensive techniques that are commonly used to bypass 403 errors. Learn about the various methods used, including HTTP method fuzzing, request header manipulation, parameter tampering, and more.

Advanced XSS Protection, CircleCI Enhancements, and UI Upgrades in Our Latest Release

Ostorlab Team — Wed, 31 Jul 2024 15:00:00 +0200

Dive into our latest release featuring cutting-edge XSS detection, streamlined CircleCI workflows, sleek UI enhancements, and robust security integrations with Codecov and UV—designed to empower and secure your digital experience.

Revolutionizing Mobile Security Testing with Ostorlab's AI-Powered Monkey Tester

Ostorlab Team — Tue, 16 Jul 2024 00:00:00 +0200

Introducing the AI-powered Monkey Tester in the Ostorlab mobile vulnerability scanner, significantly boosting test coverage and speed for a more comprehensive and efficient testing experience.

CVE-2024-5315 Dolibarr SQL Injection Investigation

Youssef Badaoui — Sun, 14 Jul 2024 09:14:00 +0200

CVE-2024-5315, an actively exploited Dolibarr SQL Injection with in incorrect patched-in version.

Detection of CocoaPods Supply Chain Vulnerability, CCPA, SOC2 and more

Ostorlab Team — Mon, 08 Jul 2024 15:00:00 +0200

This update introduces new detection capabilities, new data & privacy controls, improved user experience across the platform, and bug fixes.

CocoaPods Supply Chain Fire: What Should You Know

Ostorlab Team — Wed, 03 Jul 2024 00:00:00 +0200

E.V.A Information Security uncovered critical vulnerabilities in CocoaPods, leading to immediate patches, and developers must now remove unclaimed packages, verify dependencies, and scan their applications to ensure security.

Bug Fixes, Detection, and Attack Surface Improvements

Ostorlab Team — Mon, 01 Jul 2024 16:00:00 +0200

This update introduces bug fixes, detection improvements, and attack surface enhancements to provide a more seamless user experience.

iOS TestFlight scan, Slack Integrations and other improvements

Ostorlab Team — Mon, 10 Jun 2024 19:00:00 +0200

This update introduces support for scanning apps using iOS TestFlight, Slack Integrations, support for scanning web apps with an SBOM, and other improvements.

Integrations, Dynamic analysis improvements, and a new standard support

Ostorlab Team — Mon, 27 May 2024 04:42:00 +0200

This update introduces multiple new integrations with CI/CD pipelines, improvements to dynamic traces interception & analysis, support for the MASVS v2.0.0 standard, and many bug fixes.

Discovery of hidden web paths, detection of libwebp vulnerability, and new CVE detections.

Ostorlab Team — Mon, 06 May 2024 18:00:00 +0200

This update adds the discovery of hidden web paths, detection of libwebp vulnerability, and new CVE detections.

🚀 OXO v1.0!

Ostorlab Team — Mon, 29 Apr 2024 18:00:00 +0200

OXO version 1.0, is 10x times faster, supports ARM64 architectures, and is packed with improved capabilities like scanning multiple assets, simpler and powerful CLI.

Better UI, more concise scan report, improved detection of insecure webview usage, and multiple bug fixes.

Ostorlab Team — Tue, 23 Apr 2024 00:00:00 +0200

This update improves the user interface of the platform, adds new detection for Webview-related vulnerabilities, and ships multiple bug fixes.

Apple Privacy: A Comprehensive Guide to Privacy Manifest Files

Amine Mesbahi — Thu, 18 Apr 2024 18:00:00 +0200

This article offers a guide to Privacy Manifest files in Apple's ecosystem, stressing their importance for transparency and compliance, especially with the upcoming 2024 mandate, outlining steps for implementation, and underscoring their role in promoting user trust and adherence to regulations.

Objective C instrumentation, detection of insecure data storage, Regex DoS, and multiple bug fixes.

Ostorlab Team — Mon, 15 Apr 2024 00:00:00 +0200

This update significantly improves objective-C instrumentation, adds new detection for insecure data storage and Regex DoS, and ships multiple bug fixes.

Enhancing PostMessage XSS Detection with Proxy Object Instrumentation

Alaeddine Mesbahi — Thu, 04 Apr 2024 18:00:00 +0200

The article introduces a new method for detecting PostMessage Cross-Site Scripting (XSS) vulnerabilities using JavaScript Proxy objects, which enhances traditional dynamic fuzzing techniques.

Ostorlab KEV update for 02 April 2024

Ostorlab Team — Tue, 02 Apr 2024 00:00:00 +0200

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Detection of Apple's Privacy Manifest, liblzma backdoor, and Attack Surface fixes.

Ostorlab Team — Mon, 01 Apr 2024 15:00:00 +0200

This update introduces fixes for the Attack Surface, detection for the liblzma backdoor, and a public store for agents.

Discovering & Monitoring Mobile Applications Attack Surface with Ostorlab

Amine Mesbahi — Tue, 26 Mar 2024 00:00:00 +0100

The article introduces Ostorlab Attack Surface Discovery as a solution for discovering and continuously monitoring mobile applications, alleviating the manual burden on security teams. It outlines steps for adding applications to an inventory, configuring monitoring rules, and emphasizes the platform's ability to streamline mobile application security management.

Addition of CSS Injection Detection, ARM64 support, and migration of Agent's Docker Images.

Ostorlab Team — Mon, 25 Mar 2024 11:00:00 +0100

This update introduces fixes for the Attack Surface, migration of Agent's Docker Images to Docker Hub, enhanced detection capabilities for vulnerabilities, and support for ARM64 architecture in OSS.

Security Landscape of Mobile Banking Applications in North America

Ostorlab Team — Tue, 19 Mar 2024 00:00:00 +0100

This article examines the security of mobile banking applications in North America, uncovering widespread vulnerabilities and the urgent need for enhanced cybersecurity measures. It highlights the fast-paced technological advancements in the sector, alongside challenges such as supply chain vulnerabilities and the adoption of potentially insecure programming practices.

Exposed Scan PCAP and JIRA custom Mapping

Ostorlab Team — Mon, 18 Mar 2024 04:42:00 +0100

This update introduces a series of new features related to the IDE, Jira integration, OXO, and many improvements to the platform.

Enhancements to the Open Source CLI, Platform, and Detection.

Ostorlab Team — Mon, 11 Mar 2024 17:00:00 +0100

This update introduces various improvements to the XSS scanner, the functionality of the open-source CLI, and monitoring rule creation.

Swift Under the Microscope: Practical Dynamic Instrumentation

Abderrahim Haddadi — Mon, 11 Mar 2024 00:42:00 +0100

Article on Swift Dynamic Instrumentation. The article explains the steps to perform dynamic analysis of Swift-based application, covering name mangling, Swift ABI & extraction of function arguments in Swift.

Ostorlab KEV update for 11th March 2024

Ostorlab Team — Mon, 11 Mar 2024 00:00:00 +0100

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Attack Surface, Remediation, Automation Rules, and Detection improvements

Ostorlab Team — Mon, 04 Mar 2024 15:00:00 +0100

This update introduce a series of updates aimed at enhancing user experience, platform improvements, and bug fixes across various features.

OXO Open-Source Improving

Ostorlab Team — Mon, 26 Feb 2024 10:00:00 +0100

The latest update of OXO open-source introduces substantial improvements, providing users with faster startup and execution times. Additionally, this update enhances search capabilities in the CLI for more effective querying. Users now also benefit from increased customization options, including the ability to define accepted agents and specify in_selector in the agent group definition.

Ostorlab KEV update for 26th February 2024

Ostorlab Team — Mon, 26 Feb 2024 00:00:00 +0100

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Test Credential Name

Ostorlab Team — Mon, 19 Feb 2024 10:00:00 +0100

The latest update introduces the addition of a "test credential name" feature, allowing users to label test credentials for easier identification and management.