Security testing guides — vulnerability scanning, penetration testing basics, and secure SDLC practices.
Security Testing
Burp Suite has a reputation as a hacker's tool. The screenshots you see in penetration testing write-ups look intimidating — dozens of tabs, raw HTTP, cryptic payloads. But underneath the professional pentest workflow is a set of capabilities that are genuinely useful for developers who want to understand
Security Testing
Burp Suite is the standard tool for web application security testing. Security engineers use it to intercept HTTP traffic, find vulnerabilities, and test how applications respond to malicious input. This guide covers the fundamentals for getting started. Note: This guide is for authorized security testing only — penetration testing engagements, bug
Security Testing
Web application security testing with Burp is intuitive when there's a browser to proxy. API testing requires a different setup — no browser, no HTML rendering, just HTTP requests and JSON responses. Burp handles this well, but the workflow is different. This guide covers authorized security testing only. Test
Security Testing
Burp Intruder automates sending many variations of a request — testing dozens of payloads against a parameter without manual repetition. It's the right tool when you know what you want to test but need to do it at scale. This guide covers authorized security testing only. Intruder is a
Security Testing
Permit.io is a cloud-based authorization service that lets you define RBAC (Role-Based Access Control), ABAC (Attribute-Based Access Control), and ReBAC (Relationship-Based Access Control) policies in a UI and enforce them via a local PDP (Policy Decision Point) sidecar or hosted API. It uses Open Policy
Security Testing
Security teams, developers, and compliance officers often use "penetration testing" and "vulnerability scanning" interchangeably. They shouldn't. These are fundamentally different activities with different goals, different outputs, and different price tags. Choosing the wrong one for your situation wastes money and leaves gaps in your
Security Testing
Penetration testing (pentesting) is authorized, controlled hacking to identify exploitable vulnerabilities before attackers do. A structured methodology prevents scope creep, legal problems, and missed findings. The phases: scoping (what's in scope, rules of engagement), reconnaissance (gather information), scanning (enumerate attack surface), exploitation (verify vulnerabilities), post-exploitation (assess impact)
Security Testing
Web applications are the front door to your business. They handle user data, process payments, manage authentication, and connect to your most sensitive infrastructure. That makes them a prime target for attackers — and the reason penetration testing has become a non-negotiable part of any serious security program. This guide
Penetration Testing
Penetration testing automation runs security checks continuously and repeatably rather than as annual point-in-time assessments. Tools like Nuclei (vulnerability templates), Nmap (port scanning), SQLMap (SQL injection), and Nikto (web server scanning) can be combined into a pipeline that runs on every deployment. This guide covers how to build
OWASP ZAP
OWASP ZAP (Zed Attack Proxy) is the most widely used open-source web application security scanner. It acts as a proxy between your browser and the target application, passively scanning traffic for vulnerabilities. It also has an active scanner that sends attack payloads to find SQL injection, XSS, CSRF, and
Security Testing
Most security tools are designed to be run manually by security engineers during a dedicated audit phase. OWASP ZAP (Zed Attack Proxy) is different — it's designed to be automated. The ZAP team maintains official Docker images with CI-oriented scan modes, GitHub Actions integrations, and a configuration system
Security Testing
Security testing is not the exclusive domain of penetration testers. Developers who understand the OWASP Top 10 and can write test cases against each category catch vulnerabilities before they ever reach a staging environment — let alone production. This guide walks through each OWASP Top 10 item (2021 edition) with a