My day to day activities consist primarily of penetration testing (white/grey/black). Throughout my engagements, I try to educate my clients on the differences of testing types. E.g., credentialed ...
There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
I have created a white-box fuzzer by extending the Crest. Now, I'm looking for a test suite (a set of c programs with known vulnerabilities) to test the functionality of my tool. where i can find ...
In a white-box attack context (e.g. PC, tablet, smartphone), there is no trusted entity, which can be used to guarantee some reasonable security. TPM is not considered a solution because it is not ...
We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process. We did specify what kind of tests he should be ...
What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...