Don’t just learn tools and payloads. Learn why vulnerabilities exist. Hands-on web hacking, security code review, and real-world CVE labs.
Melbourne, Victoria
Joined December 2011
- Tweets11K
- Following0
- Followers209K
- Likes11.7K
Pinned Tweet
💥🐹 4 new Go Code Review Labs just dropped! 🐹💥
Read the code, peek at the diff, find the bug.
Sharpen your skills: pentesterlab.com/badges/gola…
Two new on-demand courses, fully recorded and ready:
🔎 Web Security Code Review
🐹 Secure Coding for Go Developers, beyond the OWASP Top 10
Learn at your own pace. Launch discounts available now:
pentesterlab.com/training/
PentesterLab retweeted
"She's a 4, but she's the private key of an intermediate certificate authority..."
In 2008, Debian disclosed that a change intended to silence Valgrind warnings had broken OpenSSL's random number generator.
The change removed code that mixed entropy into its internal state, leaving the process ID as the only meaningful source of variability. Attackers could precompute the possible keys instead of breaking the cryptography.
In 2026, eight of eMudhra's intermediate CA private keys turned out to be:
4, 56, 66, 115, 155, 156, 230, 237.
Assumptions are at the root of so many security issues. When testing an application or reviewing code, always ask yourself: "What assumptions did the developer make? What assumptions am I making when I say this is secure?"
Maybe you're assuming that an input has already been validated, that a route requires authentication, or that a framework handles a security check for you.
Each of those assumptions deserves to be verified.
Questioning the developer's assumptions is part of the job, but questioning your own is just as important.
Getting a CVE is easy when you're the one writing the vulnerabilities.
Just make sure you clarify what you mean by "responsible for 30 CVEs" on your resume... 😉
What do you wish someone had taught you before your first client pentest?
We've just released Pentest Process: 9 exercises covering scoping, client communication, reporting and retesting.
If you're mentoring a junior pentester, send them this:
pentesterlab.com/badges/pent…
This is an image we keep using in our training, because you don't want to be the man at the bottom.
In our experience, most people stop at roughly the same point: when it gets hard, they've run out of ideas, and they feel like they’ve tried everything.
When you reach that point, go for a walk, take a break, or take a shower. Give yourself some time away from the problem, then come back and push a little further.
Revisit an assumption, investigate the behaviour you couldn't quite explain, or try the idea you dismissed earlier. Coming back with a fresh perspective can help you see something you missed after hours of staring at the same code or requests.
We've seen it again and again: some of the best bugs are discovered when you push a little further after you thought you were completely done.
PentesterLab retweeted
Strengthening my Application Security skills with @PentesterLab !
My focus is on understanding how code works, identifying potential vulnerabilities, and learning how to fix them.
Portfolio: singhpallavi819.github.io/
#Cybersecurity #AppSec #PentesterLab #CodeReview
Do you want to be able to write your own Java gadgets like the ones in ysoserial?
Make sure you check out our Java Deserialisation badge: pentesterlab.com/badges/java…
We just dropped two new labs!
PentesterLab retweeted
There’s still enormous value in understanding how vulnerabilities actually work. That kind of knowledge never gets old. In fact, it’s probably becoming even more valuable.
Great work, @PentesterLab, on putting all of this knowledge together.
