Pinned Tweet
💥🐹 4 new Go Code Review Labs just dropped! 🐹💥
Read the code, peek at the diff, find the bug.
Sharpen your skills: pentesterlab.com/badges/golang-…
Read the code, peek at the diff, find the bug.
Sharpen your skills: pentesterlab.com/badges/golang-…
5
13
100
35,770
Java gotcha: concatenating a null reference doesn't throw. It becomes the four characters "null".
In Tomcat's digest authentication, a missing user's password became "null" (CVE-2026-43512). When code hashes a lookup result, look for the null check.
pentesterlab.com/training/on-de…
In Tomcat's digest authentication, a missing user's password became "null" (CVE-2026-43512). When code hashes a lookup result, look for the null check.
pentesterlab.com/training/on-de…
0
2
14
2,796
Spend some time and tokens auditing the third-party code you rely on. Someone else may keep a zero-day private or publish it at the worst time for you. Your own reviews give you a chance to find and fix bugs earlier.
0
1
19
4,166
Make yourself comfortable, open PentesterLab, and spend the evening learning security code review. 🍿
2
20
169
6,995
After the recent PHP, Brotli and Linux kernel bugs, I think we have a lot of patching ahead. If every update is still a small project, now is a good time to make the next one easier.
A few practical ideas:
pentesterlab.com/blog/brace-you…
A few practical ideas:
pentesterlab.com/blog/brace-you…
1
1
15
2,581
A reminder to parents this Halloween 🎃
Please inspect your children’s candy carefully.
Some people are hiding NVIDIA DGX Sparks in trick-or-treat bags.
If you find one, don’t panic. Send it to us for safe disposal.
Please inspect your children’s candy carefully.
Some people are hiding NVIDIA DGX Sparks in trick-or-treat bags.
If you find one, don’t panic. Send it to us for safe disposal.
1
0
4
2,070
What does this Java print?
String password = null;
String s = "user:realm:" + password;
A) NullPointerException
B) user:realm:null
C) user:realm:
Tomcat had a CVE because of the answer (CVE-2026-43512).
pentesterlab.com/training/on-de…
String password = null;
String s = "user:realm:" + password;
A) NullPointerException
B) user:realm:null
C) user:realm:
Tomcat had a CVE because of the answer (CVE-2026-43512).
pentesterlab.com/training/on-de…
2
0
7
2,584
How does a serialised Java object become code execution?
Our Java Deserialization badge helps you understand the mechanics: build payloads, explore deserialisation entry points, and construct gadget chains.
pentesterlab.com/badges/java-de…
Our Java Deserialization badge helps you understand the mechanics: build payloads, explore deserialisation entry points, and construct gadget chains.
pentesterlab.com/badges/java-de…
0
0
5
2,857
This XSS filter removes every script tag. Well, every other one. A live NodeList, a loop that removes items from it, and CVE-2020-15885.
Free lesson: pentesterlab.com/training/on-de…
Free lesson: pentesterlab.com/training/on-de…
0
1
18
3,586
We love grep, but there's more to security code review than searching for dangerous functions and patterns.
Those searches can give you useful starting points, but the real work is understanding what the application does, how its security controls work, and where its assumptions authorisation check won't necessarily contain a suspicious keyword, and a business logic flaw might use perfectly safe functions in the wrong order.
Use grep to find places to look, but always take the time to understand what you're reviewing..
Those searches can give you useful starting points, but the real work is understanding what the application does, how its security controls work, and where its assumptions authorisation check won't necessarily contain a suspicious keyword, and a business logic flaw might use perfectly safe functions in the wrong order.
Use grep to find places to look, but always take the time to understand what you're reviewing..
1
3
11
2,844
Finding bugs is only part of a pentest.
Our Pentest Process badge is now fully available: 20 exercises following an engagement from scoping to reporting and retesting.
Learn the process behind the pentest:
pentesterlab.com/badges/pentest…
Our Pentest Process badge is now fully available: 20 exercises following an engagement from scoping to reporting and retesting.
Learn the process behind the pentest:
pentesterlab.com/badges/pentest…
2
2
26
3,810
New: Web Security Code Review, on-demand. 107 short lessons on finding vulnerabilities in source code.
Four lessons are free with a PentesterLab account. Launch price $699 until Thu 5 Nov.
pentesterlab.com/training/on-de…
Four lessons are free with a PentesterLab account. Launch price $699 until Thu 5 Nov.
pentesterlab.com/training/on-de…
0
4
7
2,620
