Don’t just learn tools and payloads. Learn why vulnerabilities exist. Hands-on web hacking, security code review, and real-world CVE labs.
Melbourne, Victoria
Joined December 2011
- Tweets11K
- Following1
- Followers211K
- Likes11.7K
Pinned Tweet
💥🐹 4 new Go Code Review Labs just dropped! 🐹💥
Read the code, peek at the diff, find the bug.
Sharpen your skills: pentesterlab.com/badges/gola…
PentesterLab retweeted
If you're wanting to level up your code review skills, I would highly recommend @PentesterLab's on demand training, I've completed the training and the amount of information covered is insane and you learn techniques from an industry veteran @snyff.
pentesterlab.com/training/
Would you rather only be allowed to pentest using Nikto, or only be allowed to pentest Perl applications?
If you use a whole package for one small helper, consider the updates, maintenance and trust you take on. Removing unused functionality or replacing a tiny helper with simpler, tested code you can maintain may be worthwhile.
pentesterlab.com/blog/brace-…
Remember: the codebase you're reviewing is alive, and it won't stop changing just because you're taking notes.
When documenting a potential vulnerability, don't record only the filename and line number. Code moves, code changes, files get renamed, and your reference might point to something completely different by the time someone reads your findings.
Always keep the filename, line number, commit hash, and a copy of the relevant code, along with an explanation of the issue. If you include a link, make sure it points to that specific commit, not to the branch.
Your notes should still make sense after the code has changed.
PentesterLab retweeted
I just completed @Pentesterlab's Java Deserialization Badge!!!
Java gotcha: concatenating a null reference doesn't throw. It becomes the four characters "null".
In Tomcat's digest authentication, a missing user's password became "null" (CVE-2026-43512). When code hashes a lookup result, look for the null check.
pentesterlab.com/training/on…
Spend some time and tokens auditing the third-party code you rely on. Someone else may keep a zero-day private or publish it at the worst time for you. Your own reviews give you a chance to find and fix bugs earlier.
Make yourself comfortable, open PentesterLab, and spend the evening learning security code review. 🍿
After the recent PHP, Brotli and Linux kernel bugs, I think we have a lot of patching ahead. If every update is still a small project, now is a good time to make the next one easier.
A few practical ideas:
pentesterlab.com/blog/brace-…
A reminder to parents this Halloween 🎃
Please inspect your children’s candy carefully.
Some people are hiding NVIDIA DGX Sparks in trick-or-treat bags.
If you find one, don’t panic. Send it to us for safe disposal.
What does this Java print?
String password = null;
String s = "user:realm:" + password;
A) NullPointerException
B) user:realm:null
C) user:realm:
Tomcat had a CVE because of the answer (CVE-2026-43512).
pentesterlab.com/training/on…
How does a serialised Java object become code execution?
Our Java Deserialization badge helps you understand the mechanics: build payloads, explore deserialisation entry points, and construct gadget chains.
pentesterlab.com/badges/java…
This XSS filter removes every script tag. Well, every other one. A live NodeList, a loop that removes items from it, and CVE-2020-15885.
Free lesson: pentesterlab.com/training/on…
We love grep, but there's more to security code review than searching for dangerous functions and patterns.
Those searches can give you useful starting points, but the real work is understanding what the application does, how its security controls work, and where its assumptions break down.
A missing authorisation check won't necessarily contain a suspicious keyword, and a business logic flaw might use perfectly safe functions in the wrong order.
Use grep to find places to look, but always take the time to understand what you're reviewing..
