Roozbeh @tracethecode

Security Researcher | App&Cloud Security Enthusiast London, England Joined March 2012

Tweets

130
Followers

118
Following

96
Likes

310

Roozbeh @tracethecode

a year ago

Conducting a pentest isn't just about finding vulnerabilities; it's crucial to show developers how to reproduce and properly fix issues. A good report includes NOT JUST evidence, but also clear steps for remediation. #Pentesting #CyberSecurity #Appsec

1 0 0 80 0

Roozbeh @tracethecode

3 years ago

TRACE may be a useful HTTP method for debugging, but it's also a major security risk in production environments. By enabling TRACE, sensitive user data could be exposed to attackers. Always disable TRACE in production environments! #cybersecurity #websecurity

2 0 2 222 0

Roozbeh @tracethecode

3 years ago

Reminder to developers: always use the verify() method when dealing with JWTs! Don't risk accepting arbitrary signatures by only decoding them with your JWT library. #cybersecurity #jwt #devtips

0 0 0 210 0

Roozbeh @tracethecode

3 years ago

Good collection of API Security tools and resources. github.com/arainho/awesom… #AppSec #BugBounty #CyberSecurtiy

1 0 0 244 0

PortSwigger Research @PortSwiggerRes

3 years ago

The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2022! portswigger.net/research/top-1…

7 229 595 116K 167

Roozbeh @tracethecode

3 years ago

AWSGoat : A Damn Vulnerable AWS Infrastructure. #Cloudsecurity #AWS #CyberSec github.com/ine-labs/AWSGo…

0 1 0 129 0

Roozbeh @tracethecode

3 years ago

False assumptions = vulnerabilities. Don't assume this #NodeJS code is enough to prevent #PathTraversal attacks. Don't overlook the power of URL encoding! Ensure proper decoding & sanitization of filenames for robust #CyberSecurity. Stay ahead of the game. #WebSecurity 💡

0 1 2 348 0

Download Image

Roozbeh @tracethecode

3 years ago

Don't underestimate the importance of function behaviour in penetration testing. A deep understanding of functions behaviour is the foundation for finding vulnerabilities. #infosec #pentesting #BugBounty

0 0 0 125 0

Roozbeh @tracethecode

3 years ago

Penetration testing is all about understanding a system's behavior. The key to finding vulnerabilities lies in comprehending the functions at play. #cybersecurity #penetrationtesting #AppSec

0 0 1 104 0

Roozbeh @tracethecode

3 years ago

Different developers bring different levels of security knowledge to the table. That's why understanding the application's functions and their behaviours are crucial during a penetration test. #developers #securityawareness #PenetrationTesting

0 0 1 168 0

Roozbeh @tracethecode

3 years ago

A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities. #informationsecurity #API #BugBounty github.com/Checkmarx/capi…

0 0 1 121 0

Roozbeh @tracethecode

3 years ago

PHP Development Server <= 7.4.21 - Remote Source Disclosure. #infosecurity #development #AppSec #phpdeveloper blog.projectdiscovery.io/php-http-serve…

0 0 0 104 0

PortSwigger Research @PortSwiggerRes

3 years ago

Just learned you can exploit blind file-reads in PHP by combining the dechunk filter with the PHP memory limit. This crazy finding by @hash_kitten is a great reminder to pay attention to CTF writeups! github.com/DownUnderCTF/C…

2 118 369 63K 112

Truffle Security @trufflesec

3 years ago

Truffle Security is proud to host a new XSSHunter, that finds new vulnerabilities trufflesecurity.com/blog/xsshunter/

15 225 646 107K 242

Roozbeh @tracethecode

3 years ago

APIs vs microservices! APIs allow communication between different services, while microservices represent a way of organizing and building those services. Think of APIs as the language, and microservices as the architecture. #APIs #Microservices #SoftwareArchitecture #cloud

0 0 0 73 0

Roozbeh @tracethecode

3 years ago

ASP.NET insecure file upload code: Attackers could try to upload files with different extensions that are associated with ASP.NET, such as ".aspx", ".ashx", ".asmx", or ".axd". #bugbountytips #pentest #ASP #coding #appsec

1 1 1 198 0

Download Image

Roozbeh @tracethecode

3 years ago

A simple #Vulnerable File Upload PHP code that is lacking security measures & is vulnerable to #PathTraversal attacks, also allows uploading executables with alternative extensions. #cybersecuritytips #infosec #Security #bugbountytips #PHP

0 0 0 133 0

Download Image

Roozbeh @tracethecode

3 years ago

Don't let a simple file upload be your server's downfall! Ensure file names are properly validated & sanitized, and reject any that contain "../" #WebDevelopment #CyberSecurity #CyberSecurityAwareness

0 0 0 120 0

Trickest @trick3st

3 years ago

250k subdomain combinations in 0.67 seconds with mksub🚀

15 96 453 65K 207

Download Image

Roozbeh @tracethecode

3 years ago

Here is a good collection of #bugbounty write-ups that can be helpful in understanding the methods and techniques to identify different #vulnerabilities. github.com/devanshbatham/… #CyberSecurity #bugbountyWriteups #PenTest