Application Security Insights

Building and breaking secure systems

Java deserialization security FAQ

27 Apr 2016

Java deserialization security FAQ

Details about the vulnerability class Untrusted Deserialization.

DevSecOps maturity model

25 Jul 2015

DevSecOps maturity model

Conference talk at OWASP AppSecEU about integrating security checks into DevOps processes.

Chrome SOP bypass with SVG

12 Jul 2014

Chrome SOP bypass with SVG

Writeup of my Same-Origin Policy Bypass in Chrome with SVG (CVE-2014-3160).

Generic XXE detection

12 Jul 2014

Generic XXE detection

Generic Detection of XML External Entity (XXE) Vulnerabilities.

Cross-Site WebSocket Hijacking (CSWSH)

31 Aug 2013

Cross-Site WebSocket Hijacking (CSWSH)

Details about the vulnerability class I identified in the HTML5 WebSocket specification (RFC 6455).

Best Practice ·Conference ·Vulnerability