Sjoerd Langkemper
follow
/
follow
/2021/10/15/git-submodule-update-remote-retrieves-default-branch-except-when-changed/
Git submodules update to default branch, except when it"s changed
follow
/2021/10/15/git-submodule-update-remote-retrieves-default-branch-except-when-changed/
follow
/2021/08/13/how-does-git-diff-ignore-matching-lines-work/
How does git diff --ignore-matching-lines work
follow
/2021/08/13/how-does-git-diff-ignore-matching-lines-work/
follow
/2021/07/02/long-password-denial-of-service/
Long passwords don"t cause denial of service when using proper hash functions
follow
/2021/07/02/long-password-denial-of-service/
states
follow
https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/en/0x11-V2-Authentication.md#:~:text=no%20longer%20than%20128%20characters
follow
/2021/04/04/remote-code-execution-through-unsafe-unserialize/
Remote code execution through unsafe unserialize in PHP
follow
/2021/04/04/remote-code-execution-through-unsafe-unserialize/
follow
/2021/01/06/adding-headers-to-image-request-using-service-workers/
Adding request headers to image requests using a service worker
follow
/2021/01/06/adding-headers-to-image-request-using-service-workers/
follow
/2020/09/30/iot-security-regulation/
IoT security regulation
follow
/2020/09/30/iot-security-regulation/
follow
/2020/07/01/non-numeric-input-infinite-loop-dos-in-centreon/
Infinite loop leads to denial of service in Centreon
follow
/2020/07/01/non-numeric-input-infinite-loop-dos-in-centreon/
follow
/2020/05/27/overwriting-httponly-cookies-from-javascript-using-cookie-jar-overflow/
Overwriting HttpOnly cookies using cookie jar overflow
follow
/2020/05/27/overwriting-httponly-cookies-from-javascript-using-cookie-jar-overflow/
follow
/2020/05/06/testing-android-apps-on-a-virtual-machine/
Testing Android apps on a virtual machine
follow
/2020/05/06/testing-android-apps-on-a-virtual-machine/
follow
/2020/04/29/combine-two-word-lists-for-cracking-passwords/
Combine two word lists for cracking passwords
follow
/2020/04/29/combine-two-word-lists-for-cracking-passwords/
follow
/2020/04/08/open-redirect-through-javascript-history-back/
Abusing javascript:history.back() as an open redirect
follow
/2020/04/08/open-redirect-through-javascript-history-back/
follow
/2020/03/25/on-perfectionism/
The struggle of perfectionism
follow
/2020/03/25/on-perfectionism/
follow
/2020/03/11/bypass-virus-scanners-by-renaming-files/
Bypass virus scanners by renaming files
follow
/2020/03/11/bypass-virus-scanners-by-renaming-files/
follow
/2020/02/19/how-to-open-a-compal-ch7465lg-ziggo-connect-box/
How to open a Compal CH7465LG-ZG Ziggo Connect Box
follow
/2020/02/19/how-to-open-a-compal-ch7465lg-ziggo-connect-box/
follow
/2020/02/12/the-case-for-client-side-hashing-logging-passwords-by-mistake/
The case for client-side hashing: logging passwords by mistake
follow
/2020/02/12/the-case-for-client-side-hashing-logging-passwords-by-mistake/
follow
/2020/01/29/grepping-functions-with-srcml/
Grepping functions with srcML
follow
/2020/01/29/grepping-functions-with-srcml/
Grepping functions with ANTLR
follow
/2018/04/11/grepping-functions-with-antlr/
srcML
follow
https://www.srcml.org/
follow
/2020/01/15/cracking-password-hashes-in-yclas/
Cracking password hashes in Yclas
follow
/2020/01/15/cracking-password-hashes-in-yclas/
follow
/2020/01/01/matrix-org-hack/
Matrix.org hack
follow
/2020/01/01/matrix-org-hack/
follow
/2019/12/18/different-csrf-token-for-each-form/
Should each form have a different CSRF token?
follow
/2019/12/18/different-csrf-token-for-each-form/
follow
/2019/12/04/xss-in-sakai/
XSS in username in Sakai
follow
/2019/12/04/xss-in-sakai/
follow
/2019/11/20/message-franking/
Breaking message franking
follow
/2019/11/20/message-franking/
follow
/2019/11/06/most-commonly-used-dutch-passwords/
Most commonly used Dutch passwords
follow
/2019/11/06/most-commonly-used-dutch-passwords/
follow
/2019/10/23/cheap-mictor-38-alternative/
A cheap alternative for Mictor 38 debugging connectors
follow
/2019/10/23/cheap-mictor-38-alternative/
follow
/2019/10/09/reflected-xss-in-yclas/
Reflected XSS in Yclas
follow
/2019/10/09/reflected-xss-in-yclas/
follow
/2019/09/25/second-order-sql-injection-in-zoneminder/
Second order SQL injection in ZoneMinder
follow
/2019/09/25/second-order-sql-injection-in-zoneminder/
searching for vulnerable projects
follow
https://www.sjoerdlangkemper.nl/2017/06/07/finding-vulnerable-code-in-github-with-bigquery/
follow
/2019/09/11/pentester-project-management/
My pen testing project setup
follow
/2019/09/11/pentester-project-management/
follow
/2019/08/28/insecure-direct-object-reference-in-growatt/
Insecure direct object reference in Growatt
follow
/2019/08/28/insecure-direct-object-reference-in-growatt/
follow
/2019/08/14/how-to-survive-an-office-job/
How to survive an office job
follow
/2019/08/14/how-to-survive-an-office-job/
follow
/2019/07/31/a-method-for-tls-on-iot-devices/
A method to do TLS on IoT devices
follow
/2019/07/31/a-method-for-tls-on-iot-devices/
follow
/2019/07/17/from-developer-to-pentester-part-two/
Learning how to be a pentester
follow
/2019/07/17/from-developer-to-pentester-part-two/
From developer to pentester
follow
/2017/08/16/from-developer-to-pentester/
follow
/2019/07/03/command-injection-on-commonaccord/
Command injection on CommonAccord
follow
/2019/07/03/command-injection-on-commonaccord/
follow
/2019/06/19/attacking-rsa/
Attacking RSA keys
follow
/2019/06/19/attacking-rsa/
follow
/2019/06/05/open-redirect-in-crushftp/
Open redirect in CrushFTP
follow
/2019/06/05/open-redirect-in-crushftp/
follow
/2019/05/22/logging-dns-requests-with-internet-sharing-on-macos/
Logging DNS requests with internet sharing on macOS
follow
/2019/05/22/logging-dns-requests-with-internet-sharing-on-macos/
follow
/2019/05/08/enisa-iot-technical-measures/
ENISA Technical Measures for IoT
follow
/2019/05/08/enisa-iot-technical-measures/
follow
/2019/04/24/bits-bytes-in-python-2-3/
Working with bits and bytes in Python 2 and 3
follow
/2019/04/24/bits-bytes-in-python-2-3/
bit flip
follow
/2018/04/25/bitflip-effect-on-encryption-operation-modes/
follow
/2019/04/10/quickly-set-up-a-test-mail-server/
Quickly set up a test mail server
follow
/2019/04/10/quickly-set-up-a-test-mail-server/
follow
/2019/03/27/hacking-the-motorola-mbp88connect-wifi-camera/
Hacking the Motorola MBP88Connect WiFi camera
follow
/2019/03/27/hacking-the-motorola-mbp88connect-wifi-camera/
follow
/2019/03/20/usb-to-serial-uart/
USB to UART serial bridges
follow
/2019/03/20/usb-to-serial-uart/
follow
/2019/03/13/coverage-of-a-security-assessment/
Coverage of a security assessment
follow
/2019/03/13/coverage-of-a-security-assessment/
follow
/2019/02/27/prevent-csrf-with-the-origin-http-request-header/
Prevent CSRF with the Origin request header
follow
/2019/02/27/prevent-csrf-with-the-origin-http-request-header/
follow
/2019/02/20/tplink-tl-wn823n-works-with-macos/
A USB Wi-Fi adapter that works with MacOS Mojave
follow
/2019/02/20/tplink-tl-wn823n-works-with-macos/
follow
/2019/02/13/securing-and-preventing-cyberattack/
Securing against cyber-attacks
follow
/2019/02/13/securing-and-preventing-cyberattack/
previous
follow
/2019/01/16/probability-of-cyberattack/
two
follow
/2019/01/30/impact-of-cyberattack/
follow
/2019/01/30/impact-of-cyberattack/
Impact of cyber attacks
follow
/2019/01/30/impact-of-cyberattack/
probability
follow
/2019/01/16/probability-of-cyberattack/
follow
/2019/01/16/probability-of-cyberattack/
Probability of cyber attacks
follow
/2019/01/16/probability-of-cyberattack/
impact
follow
/2019/01/30/impact-of-cyberattack/
Cross site request forgery (CSRF)
follow
/2019/01/09/csrf/
follow
/2019/01/02/jsonp/
Accessing cross-site data using JSONP
follow
/2019/01/02/jsonp/
follow
/2018/12/19/practice-hacking-with-vulnerable-systems/
Practice your hacking skills with these CTFs
follow
/2018/12/19/practice-hacking-with-vulnerable-systems/
follow
/2018/12/05/take-over-sessions-in-metasfresh-using-cors/
Take over sessions in Metasfresh using CORS
follow
/2018/12/05/take-over-sessions-in-metasfresh-using-cors/
follow
/2018/10/24/should-you-update-jquery/
Should you update jQuery over a hypothetical vulnerability?
follow
/2018/10/24/should-you-update-jquery/
follow
/2018/10/10/truncating-strings-with-mysql/
Truncating strings with MySQL
follow
/2018/10/10/truncating-strings-with-mysql/
follow
/2018/09/26/creating-custom-wordlists-for-password-cracking/
Creating custom word lists for password cracking
follow
/2018/09/26/creating-custom-wordlists-for-password-cracking/
follow
/2018/09/12/authorization-header-and-cors/
Which CORS headers do you need to send an Authorization header?
follow
/2018/09/12/authorization-header-and-cors/
follow
/2018/08/15/automating-path-traversal-with-protravel/
Automating path traversal with protravel
follow
/2018/08/15/automating-path-traversal-with-protravel/
follow
/2018/08/15/changing-your-password-with-csrf-in-icehrm/
Changing your password through CSRF in IceHRM
follow
/2018/08/15/changing-your-password-with-csrf-in-icehrm/
CSRF
follow
/2019/01/09/csrf/
follow
/2018/07/18/path-traversal-in-monstra-cms/
Path traversal in Monstra CMS
follow
/2018/07/18/path-traversal-in-monstra-cms/
follow
/2018/07/04/type-confusion-in-monstra-cms/
PHP type confusion on password comparison
follow
/2018/07/04/type-confusion-in-monstra-cms/
follow
/2018/06/20/discovering-subdomains/
Discovering subdomains
follow
/2018/06/20/discovering-subdomains/
follow
/2018/06/06/vulnerability-bingo/
Vulnerability bingo
follow
/2018/06/06/vulnerability-bingo/
follow
/2018/05/23/creating-a-dirsearch-list/
Finding common files in the webroot
follow
/2018/05/23/creating-a-dirsearch-list/
follow
/2018/05/09/attacking-postmessage-interfaces/
Detecting postMessage interfaces
follow
/2018/05/09/attacking-postmessage-interfaces/
postMessage mechanism
follow
https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage
follow
/2018/04/25/bitflip-effect-on-encryption-operation-modes/
Bitflip effect on encryption operation modes
follow
/2018/04/25/bitflip-effect-on-encryption-operation-modes/
bitflip attack
follow
https://en.wikipedia.org/wiki/Bit-flipping_attack
mode of operation
follow
https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation
follow
/2018/04/11/grepping-functions-with-antlr/
Grepping functions with ANTLR
follow
/2018/04/11/grepping-functions-with-antlr/
follow
/2018/03/28/intercepting-http-requests-with-mitmproxy/
Intercepting HTTP requests with mitmproxy
follow
/2018/03/28/intercepting-http-requests-with-mitmproxy/
follow
/2018/02/28/hacking-the-huawei-hg655d/
Hacking the Huawei HG655d
follow
/2018/02/28/hacking-the-huawei-hg655d/
follow
/2018/02/14/cc2530/
Experiences with the CC2530 Zigbee IC
follow
/2018/02/14/cc2530/
follow
/2018/02/07/dutch-ubuntu-mirror-behind-on-security-updates/
Ubuntu mirrors behind on security updates
follow
/2018/02/07/dutch-ubuntu-mirror-behind-on-security-updates/
follow
/2018/01/31/client-independent-upgrade-in-hash-functions/
Upgrading a password hash function
follow
/2018/01/31/client-independent-upgrade-in-hash-functions/
follow
/2018/01/17/problems-with-pwdhash/
Problems with pwdhash
follow
/2018/01/17/problems-with-pwdhash/
follow
/2018/01/03/testssl-sh-vs-owasp-o-saft/
Testssl.sh vs. OWASP O-saft
follow
/2018/01/03/testssl-sh-vs-owasp-o-saft/
testssl.sh
follow
https://testssl.sh/
OWASP O-saft
follow
https://www.owasp.org/index.php/O-Saft
follow
/2017/12/20/blamka-hash/
Password hashing considerations
follow
/2017/12/20/blamka-hash/
follow
/2017/12/06/cryptography-and-quantum-computers/
Breaking cryptography using quantum computers
follow
/2017/12/06/cryptography-and-quantum-computers/
follow
/2017/11/08/comparing-securestrings-in-dotnet/
Comparing secure strings in .NET
follow
/2017/11/08/comparing-securestrings-in-dotnet/
follow
/2017/10/25/strict-secure-cookies/
Leave secure cookies alone
follow
/2017/10/25/strict-secure-cookies/
follow
/2017/10/11/open-redirect-with-authentication-in-documentum/
Open redirect with authentication in OpenText Documentum
follow
/2017/10/11/open-redirect-with-authentication-in-documentum/
follow
/2017/09/27/some-libraries-evaluate-remote-javascript/
Libraries that evaluate remote JavaScript
follow
/2017/09/27/some-libraries-evaluate-remote-javascript/
follow
/2017/09/13/attacks-on-host-header/
Attacks on the Host header
follow
/2017/09/13/attacks-on-host-header/
follow
/2017/08/30/tamper-chrome/
Hacking from within the browser with Tamper Chrome
follow
/2017/08/30/tamper-chrome/
follow
/2017/08/16/from-developer-to-pentester/
From developer to pentester
follow
/2017/08/16/from-developer-to-pentester/
follow
/2017/08/02/burp-intruder-attack-types/
Burp intruder attack types
follow
/2017/08/02/burp-intruder-attack-types/
follow
/2017/07/19/drive-by-remote-code-execution-in-mamp/
Drive-by remote code execution in MAMP
follow
/2017/07/19/drive-by-remote-code-execution-in-mamp/
follow
/2017/07/05/prevent-session-hijacking-with-token-binding/
Prevent session hijacking with token binding
follow
/2017/07/05/prevent-session-hijacking-with-token-binding/
follow
/2017/06/21/bypass-csrf-check-using-referrer-policy/
Bypass CSRF checks using referrer policy
follow
/2017/06/21/bypass-csrf-check-using-referrer-policy/
CSRF protection
follow
/2019/01/09/csrf/
follow
/2017/06/07/finding-vulnerable-code-in-github-with-bigquery/
Finding vulnerable code on GitHub with Google BigQuery
follow
/2017/06/07/finding-vulnerable-code-in-github-with-bigquery/
follow
/2017/05/24/automating-attacks-with-tampermonkey/
Automating web application attacks with Tampermonkey
follow
/2017/05/24/automating-attacks-with-tampermonkey/
Tampermonkey
follow
https://tampermonkey.net/
Greasemonkey
follow
http://www.greasespot.net/
follow
/2017/05/10/generating-password-list-with-regexes/
Generating password lists with regular expressions
follow
/2017/05/10/generating-password-list-with-regexes/
follow
/2017/04/26/php-open-basedir/
Checking whether files exist outside open_basedir
follow
/2017/04/26/php-open-basedir/
open_basedir
follow
http://php.net/manual/en/ini.core.php#ini.open-basedir
follow
/2017/04/12/download-mercurial-hg-directory/
Downloading an exposed Mercurial .hg directory
follow
/2017/04/12/download-mercurial-hg-directory/
follow
/2017/03/29/vbulletin-random-number-function/
vBulletin random number function
follow
/2017/03/29/vbulletin-random-number-function/
random_int
follow
http://php.net/manual/en/function.random-int.php
random_bytes
follow
http://php.net/manual/en/function.random-bytes.php
follow
/2017/03/15/dont-use-base-convert-on-random-tokens/
Don"t use base_convert on random tokens
follow
/2017/03/15/dont-use-base-convert-on-random-tokens/
follow
/2017/03/01/bypass-ip-block-with-x-forwarded-for-header/
Bypass IP blocks with the X-Forwarded-For header
follow
/2017/03/01/bypass-ip-block-with-x-forwarded-for-header/
follow
/2017/02/09/cookie-prefixes/
Securing cookies with cookie prefixes
follow
/2017/02/09/cookie-prefixes/
follow
/2017/01/12/checking-passwords-against-a-dictionary-in-asp-net-mvc/
Checking passwords against a dictionary in ASP.NET MVC
follow
/2017/01/12/checking-passwords-against-a-dictionary-in-asp-net-mvc/
follow
/2017/01/05/book-review-bulletproof-ssl-tls/
Book review: Bulletproof SSL and TLS
follow
/2017/01/05/book-review-bulletproof-ssl-tls/
Bulletproof SSL and TLS
follow
https://www.feistyduck.com/books/bulletproof-ssl-and-tls/
follow
/2016/12/22/csrf-protection-by-default-in-asp-net-mvc/
Check CRSF token by default in ASP.NET MVC
follow
/2016/12/22/csrf-protection-by-default-in-asp-net-mvc/
CSRF
follow
https://en.wikipedia.org/wiki/Cross-site_request_forgery
follow
/2016/12/15/using-secret-salts-in-password-hashes/
Strengthening password hashes by brute-forcing random data
follow
/2016/12/15/using-secret-salts-in-password-hashes/
follow
/2016/11/28/header-injection-in-nikto/
Adding a HTTP header to Nikto requests
follow
/2016/11/28/header-injection-in-nikto/
Nikto
follow
https://github.com/sullo/nikto
follow
/2016/11/21/https-does-not-provide-privacy/
HTTPS does not provide privacy
follow
/2016/11/21/https-does-not-provide-privacy/
follow
/2016/11/14/economics-of-certificate-transparency/
The economics of certificate transparency
follow
/2016/11/14/economics-of-certificate-transparency/
follow
/2016/11/07/current-state-of-breach-attack/
The current state of the BREACH attack
follow
/2016/11/07/current-state-of-breach-attack/
follow
/2016/11/01/tenex-password-bug/
The password guessing bug in Tenex
follow
/2016/11/01/tenex-password-bug/
follow
/2016/10/11/ssrf-in-ladesk-liveagent/
SSRF in LiveAgent
follow
/2016/10/11/ssrf-in-ladesk-liveagent/
LiveAgent
follow
https://www.ladesk.com/
follow
/2016/09/28/attacking-jwt-authentication/
Attacking JWT authentication
follow
/2016/09/28/attacking-jwt-authentication/
follow
/2016/09/15/uploading-webshells-with-moxiemanager/
Uploading webshells using .NET MoxieManager
follow
/2016/09/15/uploading-webshells-with-moxiemanager/
follow
/2016/08/29/kayako-xss/
XSS in Kayako helpdesk software
follow
/2016/08/29/kayako-xss/
follow
/2016/08/23/compression-side-channel-attacks/
Compression side channel attacks
follow
/2016/08/23/compression-side-channel-attacks/
follow
/2016/08/19/recent-web-hacks/
Interesting recent web application hacks
follow
/2016/08/19/recent-web-hacks/
follow
/2016/08/04/intercepting-requests-from-a-smartphone/
Intercepting smartphone HTTP requests on MacOS
follow
/2016/08/04/intercepting-requests-from-a-smartphone/
follow
/2016/07/28/fuzzing-saml-with-samlrequest/
Fuzzing SAML with SAMLReQuest
follow
/2016/07/28/fuzzing-saml-with-samlrequest/
follow
/2016/07/20/block-iframe-loading/
Headers to block iframe loading
follow
/2016/07/20/block-iframe-loading/
content security policy
follow
https://developer.mozilla.org/en-US/docs/Web/Security/CSP
follow
/2016/06/23/insecure-tokens-in-kayako/
Insecure token generation in Kayako
follow
/2016/06/23/insecure-tokens-in-kayako/
Kayako
follow
http://www.kayako.com/
follow
/2016/06/09/how-phps-uniqid-works/
How PHP"s uniqid works
follow
/2016/06/09/how-phps-uniqid-works/
sessions
follow
https://github.com/laravel/framework/blob/master/src/Illuminate/Session/Store.php#L197
CSRF protection
follow
https://github.com/panique/huge/blob/master/application/core/Csrf.php#L41
follow
/2016/06/09/clearing-memory-in-python/
Overwriting memory in Python
follow
/2016/06/09/clearing-memory-in-python/
“Clearing secrets from memory”
follow
/2016/05/22/should-passwords-be-cleared-from-memory/
follow
/2016/05/25/iterative-password-hashing/
Requirements for iterative password hashing
follow
/2016/05/25/iterative-password-hashing/
PBKDF2
follow
https://en.wikipedia.org/wiki/PBKDF2
follow
/2016/05/22/should-passwords-be-cleared-from-memory/
Clearing secrets from memory
follow
/2016/05/22/should-passwords-be-cleared-from-memory/
follow
/2016/05/02/xss-in-useragent-header-in-bolt-cms/
XSS in user-agent header in Bolt CMS
follow
/2016/05/02/xss-in-useragent-header-in-bolt-cms/
follow
/2016/04/21/combining-csrf-with-timing-attacks/
Combining CSRF and timing attacks
follow
/2016/04/21/combining-csrf-with-timing-attacks/
follow
/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/
Preventing CSRF with the same-site cookie attribute
follow
/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/
follow
/2016/04/07/djangos-reset-password-mechanism/
Django"s reset password mechanism
follow
/2016/04/07/djangos-reset-password-mechanism/
follow
/2016/03/17/datatypes-for-pycrypto-in-python3/
Datatypes for pycrypto in Python 3
follow
/2016/03/17/datatypes-for-pycrypto-in-python3/
follow
/2016/02/29/opentape-authorization-vulnerability/
Opentape authorization vulnerability
follow
/2016/02/29/opentape-authorization-vulnerability/
Opentape
follow
http://opentape.fm/
follow
/2016/02/18/polymorphic-javascript-malware/
Polymorphic Javascript malware
follow
/2016/02/18/polymorphic-javascript-malware/
follow
/2016/02/11/cracking-php-rand/
Cracking PHP rand()
follow
/2016/02/11/cracking-php-rand/
follow
/2016/02/04/circumventing-authentication-of-a-webshell/
Circumventing authentication of a webshell
follow
/2016/02/04/circumventing-authentication-of-a-webshell/
follow
/2016/01/29/circumventing-xss-filters/
Circumventing XSS filters
follow
/2016/01/29/circumventing-xss-filters/
follow
https://stackoverflow.com/users/182971/sjoerd
follow
https://github.com/Sjord
follow
https://nl.linkedin.com/in/sjoerd-langkemper-86075246