💥🐹 4 new Go Code Review Labs just dropped! 🐹💥 Read the code, peek at the diff, find the bug. Sharpen your skills: pentesterlab.com/badges/gola…

This XSS filter removes every script tag. Well, every other one. A live NodeList, a loop that removes items from it, and CVE-2020-15885. Free lesson: pentesterlab.com/training/on…

We love grep, but there's more to security code review than searching for dangerous functions and patterns. Those searches can give you useful starting points, but the real work is understanding what the application does, how its security controls work, and where its assumptions break down. A missing authorisation check won't necessarily contain a suspicious keyword, and a business logic flaw might use perfectly safe functions in the wrong order. Use grep to find places to look, but always take the time to understand what you're reviewing..

Finding bugs is only part of a pentest. Our Pentest Process badge is now fully available: 20 exercises following an engagement from scoping to reporting and retesting. Learn the process behind the pentest: pentesterlab.com/badges/pent…

My culture is not your costume.

New: Web Security Code Review, on-demand. 107 short lessons on finding vulnerabilities in source code. Four lessons are free with a PentesterLab account. Launch price $699 until Thu 5 Nov. pentesterlab.com/training/on…

WUBBA LUBBA DUB DUB! Can you guess the vulnerability? 🥒🐍 Wrong answers encouraged.

Two new on-demand courses, fully recorded and ready: 🔎 Web Security Code Review 🐹 Secure Coding for Go Developers, beyond the OWASP Top 10 Learn at your own pace. Launch discounts available now: pentesterlab.com/training/

In 2008, Debian disclosed that a change intended to silence Valgrind warnings had broken OpenSSL's random number generator. The change removed code that mixed entropy into its internal state, leaving the process ID as the only meaningful source of variability. Attackers could precompute the possible keys instead of breaking the cryptography. In 2026, eight of eMudhra's intermediate CA private keys turned out to be: 4, 56, 66, 115, 155, 156, 230, 237.

Assumptions are at the root of so many security issues. When testing an application or reviewing code, always ask yourself: "What assumptions did the developer make? What assumptions am I making when I say this is secure?" Maybe you're assuming that an input has already been validated, that a route requires authentication, or that a framework handles a security check for you. Each of those assumptions deserves to be verified. Questioning the developer's assumptions is part of the job, but questioning your own is just as important.

With moderation...

Getting a CVE is easy when you're the one writing the vulnerabilities. Just make sure you clarify what you mean by "responsible for 30 CVEs" on your resume... 😉

Put some Spark in your relationship. 💍

What do you wish someone had taught you before your first client pentest? We've just released Pentest Process: 9 exercises covering scoping, client communication, reporting and retesting. If you're mentoring a junior pentester, send them this: pentesterlab.com/badges/pent…

This is an image we keep using in our training, because you don't want to be the man at the bottom. In our experience, most people stop at roughly the same point: when it gets hard, they've run out of ideas, and they feel like they’ve tried everything. When you reach that point, go for a walk, take a break, or take a shower. Give yourself some time away from the problem, then come back and push a little further. Revisit an assumption, investigate the behaviour you couldn't quite explain, or try the idea you dismissed earlier. Coming back with a fresh perspective can help you see something you missed after hours of staring at the same code or requests. We've seen it again and again: some of the best bugs are discovered when you push a little further after you thought you were completely done.