http://search-lab.hu/ en Stay updated with SEARCH-LAB's blog. Explore posts on leveraging Generative AI for API testing and the power of embedding for contextual understanding. Discover more innovative insights and project updates. Mon, 30 Oct 2023 08:12:36 +0000 https://www.scademy.ai/post/automate-the-automator-harnessing-generative-ai-for-robust-api-testing Revolutionize API testing by leveraging Generative AI to 'Automate the Automator' Mon, 30 Oct 2023 08:12:36 +0000 https://www.scademy.ai/post/automate-the-automator-harnessing-generative-ai-for-robust-api-testing https://www.scademy.ai/post/unlocking-ais-full-potential-the-power-of-embedding-for-contextual-understanding Have you heard about embedding? If the answer is 'no', then this post is for you. Thu, 20 Jul 2023 07:03:22 +0000 https://www.scademy.ai/post/unlocking-ais-full-potential-the-power-of-embedding-for-contextual-understanding https://www.scademy.ai/post/verification-of-dynamic-behavior-with-large-language-models Unleashing LLM Power: Transforming Dynamic Code Testing. Fri, 09 Jun 2023 06:59:45 +0000 https://www.scademy.ai/post/verification-of-dynamic-behavior-with-large-language-models https://www.scademy.ai/post/beyond-static-code-analysis-understanding-the-semantics Using static code analyzers in the development phase improves your security posture. Wed, 07 Jun 2023 08:32:46 +0000 https://www.scademy.ai/post/beyond-static-code-analysis-understanding-the-semantics https://www.scademy.ai/post/a-comparative-look-at-static-code-analysis-and-large-language-models Semantic examination by GPT-4 reveals findings invisible to SAST. Sat, 29 Apr 2023 20:42:37 +0000 https://www.scademy.ai/post/a-comparative-look-at-static-code-analysis-and-large-language-models https://www.scademy.ai/post/manipulating-machine-minds-the-dark-art-of-ai-prompt-injection Are you worried about the safety of your data in the age of AI? Wed, 26 Apr 2023 08:17:31 +0000 https://www.scademy.ai/post/manipulating-machine-minds-the-dark-art-of-ai-prompt-injection https://www.scademy.ai/post/model-extraction-attacks-an-emerging-threat-to-ai-systems Creating LLM models is a resource-intensive and time-consuming task. Wed, 26 Apr 2023 08:17:31 +0000 https://www.scademy.ai/post/model-extraction-attacks-an-emerging-threat-to-ai-systems https://www.scademy.ai/post/gpt-4-limitations GPT-4 thinks lightning fast. But only if it knows where to go. Wed, 26 Apr 2023 08:15:45 +0000 https://www.scademy.ai/post/gpt-4-limitations https://www.securitydrops.com/erc20-token-standard/ ERC20 and BEP20 are well known token standards in the cryptocurrency world, but they don’t tie the developer’s hand as much as we might think. I created a token that works a bit differently than you would expect. Thu, 14 Apr 2022 08:00:00 +0000 https://www.securitydrops.com/erc20-token-standard/Richard Kovacs https://www.securitydrops.com/dirty-pipe/ Around February 2022, an innocent-looking Linux kernel vulnerability corrupted some log files. Digging in and analyzing the root causes led to discovering the dirty pipe vulnerability. This allows attackers with local access to escalate to root. Oh no, was it an overflow again? Not this time; read on to find out! Fri, 25 Mar 2022 13:52:06 +0000 https://www.securitydrops.com/dirty-pipe/Gergely Eberhardt https://www.securitydrops.com/log4shell-nobody-is-wrong-cve-2021-44228/ Every once in a while, there is that stupid one-liner implementation bug that can be found in all critical systems, and that fancy exploitation technique that nobody has thought of in the past century, which results in a security vulnerability that not only disrupts the whole internet, but all hell breaks loose for cybersecurity professionals, IT admins and developers alike. The Log4Shell vulnerability is not one of those. Even though the problem is more severe than that. Wed, 15 Dec 2021 09:30:57 +0000 https://www.securitydrops.com/log4shell-nobody-is-wrong-cve-2021-44228/Attila Szasz https://www.securitydrops.com/injections-defenses/ Injection defenses rely on making your code aware of the data structure it manipulates. If it is done well, your data structure internals are exposed just enough, so it is possible to hide them completely. Taking this approach will lead you to think of interfaces as security contracts. Wed, 14 Jul 2021 09:30:57 +0000 https://www.securitydrops.com/injections-defenses/Daniel Szpisjak https://www.securitydrops.com/the-sudo-bug/ Did you also think that Unix-based operating systems are the superior species in terms of security? Well, maybe you should reconsider that. In early 2021, a severe bug was found in them, which affected many Unix systems. When the report about it arrived, the bug was already patched, but let’s look at it in this article. Mon, 26 Apr 2021 15:29:26 +0000 https://www.securitydrops.com/the-sudo-bug/Richard Kovacs https://www.securitydrops.com/scademy/ Early March, I and SecurityDrops with me joined SCADEMY - Secure Coding Academy. Expect content. More and better quality content from me and from experienced peers alike. I will dedicate more time to the blog and curating its content. Thu, 18 Mar 2021 17:07:32 +0000 https://www.securitydrops.com/scademy/Daniel Szpisjak https://www.securitydrops.com/injections/ Injections are still one, if not the most serious, flaws a developer can make. This post deconstructs the vulnerability and puts it back together to offer you a solid understanding to build on. After reading it, you will never think of injections the same way. Fri, 14 Feb 2020 14:52:00 +0000 https://www.securitydrops.com/injections/Daniel Szpisjak https://www.securitydrops.com/mental-model/ Mental models help us learn faster and more efficiently. The security field can be viewed from two different viewpoints. One is very high-level, dealing with abstract ideas. Let’s call it macro. The other deals with the details, of how the smaller parts interact. That’s the micro. Thu, 07 Mar 2019 06:18:11 +0000 https://www.securitydrops.com/mental-model/Daniel Szpisjak https://www.securitydrops.com/inside-a-crypto-black-box/ AES, also known as the Advanced Encryption Standard, is one of the fundamental building blocks of today’s secure communications. Let’s take a peek inside and see how it works. Thu, 07 Feb 2019 05:35:39 +0000 https://www.securitydrops.com/inside-a-crypto-black-box/Daniel Szpisjak https://www.securitydrops.com/introducing-the-labs/ Optimal learning happens when theory meets practice. The Securitydrops Labs is designed to give you a training ground to practice your hands-on skills. It gives you a highly configurable web application, where you can play around in a sandbox. Wed, 30 Jan 2019 06:56:51 +0000 https://www.securitydrops.com/introducing-the-labs/Daniel Szpisjak https://www.securitydrops.com/the-ends-of-encryption/ End-to-end encryption means data is encrypted at the sender and only the final recipient can decrypt it. True end-to-end encryption has excellent privacy and security benefits. However, it also has a cost. As a developer, it is a great pattern to utilize to shield data from 3rd parties. Tue, 04 Sep 2018 21:20:55 +0000 https://www.securitydrops.com/the-ends-of-encryption/Daniel Szpisjak https://www.securitydrops.com/the-web-api-authentication-guide/ As a web developer, you have various choices regarding API authentication. This guide aims to provide you with a high-level overview of the six most used schemes. Inside, you will find a cheatsheet to help you choose. Fri, 22 Jun 2018 08:19:54 +0000 https://www.securitydrops.com/the-web-api-authentication-guide/Daniel Szpisjak https://www.securitydrops.com/tls-client-certificates/ TLS mutual authentication doubles down on HTTPS. Using this scheme your clients’ identity is proved by presenting certificates and proving ownership of a private key. This is a very potent tool and also a tradeoff. Wed, 25 Apr 2018 21:59:16 +0000 https://www.securitydrops.com/tls-client-certificates/Daniel Szpisjak https://www.securitydrops.com/the-glossary/ The Glossary describes common security jargon, phrases, abbreviations , and concepts succinctly and in a way that makes sense to you. Fri, 23 Mar 2018 12:15:19 +0000 https://www.securitydrops.com/the-glossary/Daniel Szpisjak https://www.securitydrops.com/http-signatures/ HTTP signature schemes provide integrity and authenticity on the application layer. Using them increase security but also incurs complexity. Fri, 09 Feb 2018 21:09:13 +0000 https://www.securitydrops.com/http-signatures/Daniel Szpisjak https://www.securitydrops.com/bearer-tokens/ Lots of modern web application utilize bearer tokens. They are ideal for backend integration, but can also be used on the frontend. Fri, 19 Jan 2018 14:48:04 +0000 https://www.securitydrops.com/bearer-tokens/Daniel Szpisjak https://www.securitydrops.com/auth-cookies/ Cookies are the de-facto authentication between browser and server. For a good reason, they can provide full-blown session management with low complexity. Fri, 12 Jan 2018 22:13:33 +0000 https://www.securitydrops.com/auth-cookies/Daniel Szpisjak https://www.securitydrops.com/http-digest/ HTTP Digest Authentication was designed to completely replace Basic Auth. It provides increased security at the cost of significant complexity… Tue, 14 Nov 2017 05:20:15 +0000 https://www.securitydrops.com/http-digest/Daniel Szpisjak https://www.securitydrops.com/basic-auth/ HTTP Basic Auth has been with us for ages. Some despise it for its insecurity, while others love it for its simplicity. Should you opt for using it or avoid it at all cost? Fri, 13 Oct 2017 03:32:14 +0000 https://www.securitydrops.com/basic-auth/Daniel Szpisjak https://www.securitydrops.com/the-web-authentication-guide/ As a developer, you will most likely get in the situation, where you have to decide how to authenticate your API. How would you deal with it? Wed, 27 Sep 2017 04:21:56 +0000 https://www.securitydrops.com/the-web-authentication-guide/Daniel Szpisjak https://www.securitydrops.com/data-integrity/ Data integrity is rarely talked about, even though it comprises the basis of many data flows a modern web application has to deal with. From a security perspective, integrity deals with protecting data from being modified (by unauthorized parties). There are various techniques to ensure integrity. I will guide you through the options, using real world examples. Once you finish, you will know more about this than most of the industry. Wed, 26 Jul 2017 21:34:07 +0000 https://www.securitydrops.com/data-integrity/Daniel Szpisjak https://www.securitydrops.com/untrusted-data/ “Never trust user input” - say the wise. Sound advice, although it raises more questions than it answers. First of all, what does it mean to trust a piece of data? Why not trust it? Is user input the only piece of data you should be careful with? Can you even trust any data? These are the questions I am exploring in this post. Assumptions When data enters your system, you are likely to have various assumptions about it. Mon, 26 Jun 2017 20:09:17 +0000 https://www.securitydrops.com/untrusted-data/Daniel Szpisjak https://www.securitydrops.com/security-for-software-engineers/ Solid security knowledge among developers is scarce these days, simply because it is not as spectacular and sexy as a new framework or a cool new tech. Nevertheless, it is real and will not go away anytime soon. Your best bet is to start learning about it right now. It will make you more valuable to your team and your organization. Do not think of this as a massive upfront investment; it is not. Fri, 02 Jun 2017 20:53:00 +0000 https://www.securitydrops.com/security-for-software-engineers/Daniel Szpisjak https://www.securitydrops.com/session-management/ Session management is an integral part of today’s web applications. You receive limited support from the HTTP protocol and have to handle most of this yourself. No wonder session management vulnerabilities consistently make it to the top 3 of the “OWASP Top 10” list. This post aims to introduce you to the model of session management. Disclaimer This post only covers the basics. The security of session management relies mostly on the IAAA (Identification, Authentication, Authorization, Auditing) model, which builds on session management. Sun, 23 Apr 2017 12:10:00 +0000 https://www.securitydrops.com/session-management/Daniel Szpisjak https://www.securitydrops.com/360-xss/ When a software developer first gets exposed to web security, he will inevitably memorize his first acronym: XSS! It stands for “cross site scripting”, and it is one of the oldest vulnerabilities around. Its origins are way back in the 90’s when Javascript was the new kid on the block. XSS (back then it was CSS) was its evil little brother, and it still thrives on its sibling’s success. One may wonder “Why is it called cross site scripting? Mon, 03 Apr 2017 19:57:06 +0000 https://www.securitydrops.com/360-xss/Daniel Szpisjak https://www.securitydrops.com/cookies/ Back in the 90s, someone wanted to store information on the clients, only it was not possible yet. Luckily the Netscape team quickly came to the rescue and implemented cookies. This was a very significant move which shaped the things to come. Cookies became the de-facto state in the statelessness of HTTP. Today they are essential and their security is critical. Here is what you need to know. The fundamentals Before getting into how cookies work let’s take a quick look at the basics. Wed, 15 Mar 2017 21:40:59 +0000 https://www.securitydrops.com/cookies/Daniel Szpisjak https://www.securitydrops.com/same-origin-policy/ When your browser opens a web page, it enforces various security rules. The most important one is the same-origin policy. It defines access rules for dynamic scripts and is considered to be the cornerstone of the web security model. The concept is rather old, it is from 1995 when Netscape Navigator 2 owned the streets of the web. Chances are, you two have already met during your development career, so no need for introductions. Wed, 18 Jan 2017 22:42:00 +0000 https://www.securitydrops.com/same-origin-policy/Daniel Szpisjak https://www.securitydrops.com/open-your-browser/ Today we live the era of the web and your browser is an integral part of it. As a developer, it is essential to know how stuff works to some degree, and understand how you might affect this behavior to increase security. This post is an intro to that topic! Let’s start with a bit of context, shall we? First, let’s try to define what web browsers are! They are applications used to render data; data that is fetched from a remote location. Thu, 12 Jan 2017 22:33:00 +0000 https://www.securitydrops.com/open-your-browser/Daniel Szpisjak https://www.securitydrops.com/thinking-like-an-attacker/ The best defense is a good offense! See things from your enemy’s point of view! It takes a thief to catch a thief! All great advice, however, it is a bit hard to utilize them without knowing the context in which they apply. The goal of this post is to provide that context. Who are the attackers? What are their goals? Where are they? That’s what we will cover! Who is the attacker? Wed, 04 Jan 2017 21:37:00 +0000 https://www.securitydrops.com/thinking-like-an-attacker/Daniel Szpisjak https://www.securitydrops.com/defense-in-depth-a-k-a-the-castle-approach/ Imagine you are back in middle school and your new science homework is The Egg Drop Project. For those of you not familiar with it, here is a brief description: your task is to design a protective structure for an egg. Once you finished, the egg will be placed in the shuttle you created and dropped from a certain height. The egg must survive the fall without harm! Here is a hint: defense in depth. Sun, 01 Jan 2017 21:30:00 +0000 https://www.securitydrops.com/defense-in-depth-a-k-a-the-castle-approach/Daniel Szpisjak https://www.securitydrops.com/states-of-data/ Probably the most valuable thing you need to protect is data. You may own this data, or you may just be the custodian. It might be sensitive such as PII and credentials or just metadata you collected and organized. No matter its type and content when you think about its security here is what you need to keep in mind. Data is kind of like water. Water is essential for life just as data is critical to the business. Wed, 28 Dec 2016 21:40:00 +0000 https://www.securitydrops.com/states-of-data/Daniel Szpisjak https://www.securitydrops.com/how-much-security-is-enough/ As a security engineer, I regularly work with developers. Together we draft various ideas and try to find the best possible solution to the problem at hand. During this process, the following question always comes up in some form: how secure should this be? Simple as it may seem, usually a lot of thought goes into answering this. Let’s see why! There are quite a few things in play here: legal and business requirements, the risk of exploitation, cost of mitigation, loss expectancy, business impact, etc. Mon, 26 Dec 2016 21:28:00 +0000 https://www.securitydrops.com/how-much-security-is-enough/Daniel Szpisjak https://www.securitydrops.com/a-guide-to-software-craftsmen-in-the-field-of-it-security/ Hey, I am Daniel and my mission is to guide software engineers, like you, in the field of IT security. Think of me as a good friend, who has been here for a while and knows the clever little tricks you need to stay out of trouble. Security used to be a hobby of mine; now it is my passion, my craft. This blog is the collection of my thoughts and notes about IT security. Mon, 19 Dec 2016 20:28:00 +0000 https://www.securitydrops.com/a-guide-to-software-craftsmen-in-the-field-of-it-security/Daniel Szpisjak