IDOR Vulnerabilities: How They're Found and How to Fix Them
IDOR flaws rarely show up in scanner output. How testers find broken object-level access control, and what actually fixes it in code.
Read articleKnowledge Base
ApplicationSecurity
Web, API and mobile applications fail in ways scanners do not model well, usually around access control and business logic. These articles cover the vulnerability classes that keep turning up in real assessments, what a tester checks, and what fixes them in code rather than at the perimeter.
All articles
9 articles
Cross-Site Scripting: Where It Still Appears and How to Stop It
Reflected, stored and DOM-based XSS explained, with the output encoding, CSP and testing steps that keep it out of production.
Read articlePreventing SQL Injection: Parameterised Queries and What Testing Adds
Parameterised queries stop most SQL injection. Where they get missed, how testers find what is left, and how to verify the fix holds.
Read articleThe OWASP Top 10, Explained for Developers
What each OWASP Top 10 category means in practice, which ones testers find most often, and how to design them out.
Read articleCommon Web Application Vulnerabilities and How They Get Exploited
The vulnerability classes that keep turning up in web application tests, why scanners miss the important ones, and what to prioritise.
Read articleFintech Application Security: What to Test Before Launch
Authentication, transaction logic, third-party APIs and data handling: the areas that matter most when testing a financial application.
Read articlePenetration Testing for E-commerce Sites
Checkout flows, payment integrations, discount logic and account takeover: where e-commerce platforms actually get broken.
Read articleMobile Application Penetration Testing
iOS and Android testing beyond the app binary: local storage, certificate pinning, backend APIs and platform-specific weaknesses.
Read articleAPI Penetration Testing
Authorisation flaws, object-level access control and undocumented endpoints. Why API testing needs documentation and credentials to be useful.
Read articleSave time and book a call with us
Enterprise-grade penetration testing, built around your business
CREST-registered testing delivered through a flexible PTaaS model — designed to fit your environment, risk profile and internal teams.