Stephen Rees-Carter @valorin@infosec.exchange

A01:2021 - Broken Access Control email scheduled to go out in 7 hours. It's a long one folks, but we cover a lot of ground and I hope it proves to be a great resource. I've also linked to a lot of prior tips and In Depths, so there is plenty to dig into.

Next week... crypto! 🤓

Working on my first @owasp@twitter.com Top 10 email for Laravel Security in Depth, covering 'A01:2021 - Broken Access Control' and how it relates to @laravelphp@twitter.com. It's a topic I'm always talking about in my talks and security audits, so I've got a lot to say!
#Laravel https://larasec.substack.com/

Importantly the two pieces of personally identifiable information (financial info and password) that can be changed were not accessed. 🤨

Pity the ones you can't easily change were accessed... 🤦
#OptusHack

📢 Hey, Tech Leads & Engineering Managers (and anyone else who manages devs)!

We're starting on the OWASP Top 10 next week in Laravel Security in Depth, sign up your team and I'll train them on essential @laravelphp@twitter.com security skills.🔥

Team signup @ https://larasec.substack.com/subscribe?group=true

Can anyone suggest a good IoT pool thermometer? Wifi would be nice, so I don't need to stuff around with any other hardware.
We currently just have Google Home, but I'm interested in diving into Home Assistant.

Starting next week: Laravel Security and the OWASP Top 10.🔥

Join me as we dive into the @owasp@twitter.com Top 10, covering a different risk each week and how they relate to @laravelphp@twitter.com security. This series is not to be missed!

https://larasec.substack.com/p/laravel-security-owasp-top-10-overview #Laravel

Surely you can detect malicious use too... It would follow a specific pattern and you could build some risk scores and throw up warnings.

But seriously @anydesk@twitter.com, why aren't there big scammer warnings I need to agree to before using your software??
There was absolutely nothing telling me a scammer might be using your software. It's a hard problem to solve but you're not doing anything...

Well that was fun, and a bit if a let down... strung along a eBay scammer for 30 minutes. They tried to install @anydesk@twitter.com (no surprise there!), and even after I got bored and told them who I was, they kept calling to try again. 🤣

Finally reached my favourite passage in The Hobbit.

Mr 6 fell asleep during it. Apparently my Smaug voice is very smooth and sleep inducing... Or maybe it was Smaug's dragon-spell. 🐲

In Depth #11: Insecure Direct Object Reference (IDOR)

In the eleventh In Depth we explored IDOR vulnerabilities through a series of fun interactive challenges, and learned about protecting routes and hiding information! 😈
https://larasec.substack.com/p/in-depth-insecure-direct-object-references