DEV Community

Davi profile picture

Davi

404 bio not found

Location Brazil Joined Joined on  github website
Your S3 Bucket Might Be Public Right Now. We'll Tell You First.
roxdavirox profile
Davi

Your S3 Bucket Might Be Public Right Now. We'll Tell You First.

Comments
3 min read
API Security Testing: OWASP Top 10 for APIs
roxdavirox profile
Davi

API Security Testing: OWASP Top 10 for APIs

#osint #security
Comments
5 min read
Threat Intelligence 101: From Raw Data to Actionable Insights
roxdavirox profile
Davi

Threat Intelligence 101: From Raw Data to Actionable Insights

#osint #security
Comments
5 min read
Web Application Reconnaissance: Mapping the Attack Surface
roxdavirox profile
Davi

Web Application Reconnaissance: Mapping the Attack Surface

#osint #security
Comments
7 min read
JWT Security: How Misconfigured Tokens Expose Your APIs
roxdavirox profile
Davi

JWT Security: How Misconfigured Tokens Expose Your APIs

#jwt #apisecurity #authentication #securitytech
Comments
7 min read
GitHub OSINT: What Developers Expose Without Realizing It
roxdavirox profile
Davi

GitHub OSINT: What Developers Expose Without Realizing It

#osint #github #credenciais #recon
Comments
6 min read
Capital One 2019: SSRF, AWS IMDS, and 106 Million Exposed Records
roxdavirox profile
Davi

Capital One 2019: SSRF, AWS IMDS, and 106 Million Exposed Records

#securityincidents #cloudsecurity #ssrf #aws
Comments
6 min read
TLS Certificate Analysis: What Your SSL Config Reveals
roxdavirox profile
Davi

TLS Certificate Analysis: What Your SSL Config Reveals

#osint #security
Comments
6 min read
Kubernetes Attack Surface: What Exposed APIs and Misconfigured RBAC Reveal
roxdavirox profile
Davi

Kubernetes Attack Surface: What Exposed APIs and Misconfigured RBAC Reveal

#cloud #cybersecurity #kubernetes #security
Comments
5 min read
Email Header Analysis: What SMTP Metadata Reveals About Infrastructure and Identity
roxdavirox profile
Davi

Email Header Analysis: What SMTP Metadata Reveals About Infrastructure and Identity

#cybersecurity #infrastructure #networking #security
Comments
6 min read
Passive DNS: The Infrastructure History That Reveals Origin, Movement, and Campaign
roxdavirox profile
Davi

Passive DNS: The Infrastructure History That Reveals Origin, Movement, and Campaign

#cybersecurity #infrastructure #security
Comments
5 min read
Subdomain Takeover: When an Abandoned CNAME Becomes an Attack Vector
roxdavirox profile
Davi

Subdomain Takeover: When an Abandoned CNAME Becomes an Attack Vector

#aws #cybersecurity #infosec #security
Comments
5 min read
BOLA, Mass Assignment, and Rate Limit Bypass: Three Tests Every API Fails
roxdavirox profile
Davi

BOLA, Mass Assignment, and Rate Limit Bypass: Three Tests Every API Fails

#securitytech #apisecurity #penetrationtesting #owasp
Comments
5 min read
BGP and ASN Mapping: The Routing Table as an Honest Infrastructure Map
roxdavirox profile
Davi

BGP and ASN Mapping: The Routing Table as an Honest Infrastructure Map

#osint #networking #bgp #security
Comments
5 min read
Shodan, Censys, and FOFA: How Internet Scanners Already Mapped Your Attack Surface Before Your First Firewall Rule
roxdavirox profile
Davi

Shodan, Censys, and FOFA: How Internet Scanners Already Mapped Your Attack Surface Before Your First Firewall Rule

#cybersecurity #infosec #security
Comments
5 min read
DNS Rebinding: Your Browser as an Unauthenticated Internal Proxy
roxdavirox profile
Davi

DNS Rebinding: Your Browser as an Unauthenticated Internal Proxy

#cybersecurity #infosec #networking #security
Comments
6 min read
OAuth 2.0: redirect_uri, Open Redirect, and PKCE — Observable Pre-conditions Before Exploitation
roxdavirox profile
Davi

OAuth 2.0: redirect_uri, Open Redirect, and PKCE — Observable Pre-conditions Before Exploitation

#authentication #cybersecurity #infosec #security
Comments
6 min read
Exposed Buckets: How S3, GCS, and Azure Blob Are Passively Discovered and Exploited
roxdavirox profile
Davi

Exposed Buckets: How S3, GCS, and Azure Blob Are Passively Discovered and Exploited

#aws #cloud #cybersecurity #security
Comments
6 min read
Server-Side Template Injection: How to Identify the Engine and Escalate to RCE
roxdavirox profile
Davi

Server-Side Template Injection: How to Identify the Engine and Escalate to RCE

#cybersecurity #infosec #security
Comments
6 min read
The WebSocket Upgrade Boundary: The Authentication Blind Spot API Scanners Never Find
roxdavirox profile
Davi

The WebSocket Upgrade Boundary: The Authentication Blind Spot API Scanners Never Find

#api #authentication #cybersecurity #security
Comments
7 min read
Insecure Deserialization in APIs: How to Detect It Without Source Code Access
roxdavirox profile
Davi

Insecure Deserialization in APIs: How to Detect It Without Source Code Access

#api #cybersecurity #infosec #security
Comments
5 min read
Why API Key Rotation Solves the Wrong Problem
roxdavirox profile
Davi

Why API Key Rotation Solves the Wrong Problem

#api #architecture #cybersecurity #security
Comments
5 min read
Server-Side Prototype Pollution: From JSON Body to RCE via Node.js Gadget Chains
roxdavirox profile
Davi

Server-Side Prototype Pollution: From JSON Body to RCE via Node.js Gadget Chains

#cybersecurity #javascript #node #security
Comments
6 min read
Command Injection in APIs: Parameters That Reach ImageMagick, wkhtmltopdf, and ffmpeg
roxdavirox profile
Davi

Command Injection in APIs: Parameters That Reach ImageMagick, wkhtmltopdf, and ffmpeg

#api #backend #cybersecurity #security
Comments
5 min read
Path Traversal in APIs: Parameter Semantics, ZIP Slip, and Encoding Bypass
roxdavirox profile
Davi

Path Traversal in APIs: Parameter Semantics, ZIP Slip, and Encoding Bypass

#api #cybersecurity #node #security
Comments
5 min read
JWT Algorithm Confusion: RS256 to HS256, Psychic Signatures, and alg:none on Production APIs
roxdavirox profile
Davi

JWT Algorithm Confusion: RS256 to HS256, Psychic Signatures, and alg:none on Production APIs

#api #authentication #cybersecurity #security
Comments
6 min read
BOPLA: Why APIs Return Fields They Should Not and How to Detect It
roxdavirox profile
Davi

BOPLA: Why APIs Return Fields They Should Not and How to Detect It

#api #backend #cybersecurity #security
Comments
5 min read
HTTP Host Header in APIs: Reset Poisoning, Routing SSRF, and Cache Poisoning
roxdavirox profile
Davi

HTTP Host Header in APIs: Reset Poisoning, Routing SSRF, and Cache Poisoning

#api #backend #cybersecurity #security
Comments
5 min read
Business Logic in E-Commerce APIs: Price Manipulation, Negative Quantity, and Coupon Abuse
roxdavirox profile
Davi

Business Logic in E-Commerce APIs: Price Manipulation, Negative Quantity, and Coupon Abuse

#api #backend #cybersecurity #security
Comments
6 min read
API Login Is the Soft Target: Why Every Browser Defense Is Structurally Absent at the API Authentication Layer
roxdavirox profile
Davi

API Login Is the Soft Target: Why Every Browser Defense Is Structurally Absent at the API Authentication Layer

#api #authentication #cybersecurity #security
Comments
4 min read
Working: HTTP parameter pollution attacks APIs because WAFs evaluate one parameter value while frameworks execute a different one
roxdavirox profile
Davi

Working: HTTP parameter pollution attacks APIs because WAFs evaluate one parameter value while frameworks execute a different one

#api #backend #cybersecurity #security
Comments
5 min read
IDOR and BOLA: Why Object-Level Access Control Is Hard to Audit and Easy to Exploit
roxdavirox profile
Davi

IDOR and BOLA: Why Object-Level Access Control Is Hard to Audit and Easy to Exploit

#api #cybersecurity #security
Comments
4 min read
SSRF in APIs: Six URL-Accepting Parameter Types and the IMDSv1/IMDSv2 Decision That Determines Severity
roxdavirox profile
Davi

SSRF in APIs: Six URL-Accepting Parameter Types and the IMDSv1/IMDSv2 Decision That Determines Severity

#api #aws #cybersecurity #security
Comments
5 min read
Working: Prototype Pollution in Node.js APIs Is a Process-Wide Trust Failure, Not a Library Bug
roxdavirox profile
Davi

Working: Prototype Pollution in Node.js APIs Is a Process-Wide Trust Failure, Not a Library Bug

#backend #javascript #node #security
Comments
5 min read
VITE_ Is a Promotion Operator: How Build Pipelines Ship Server-Side Secrets to the Browser
roxdavirox profile
Davi

VITE_ Is a Promotion Operator: How Build Pipelines Ship Server-Side Secrets to the Browser

#frontend #javascript #security #webdev
Comments
5 min read
Web Cache Deception Against APIs: CDNs Cache What Backends Serve Privately
roxdavirox profile
Davi

Web Cache Deception Against APIs: CDNs Cache What Backends Serve Privately

#api #backend #cybersecurity #security
Comments
6 min read
Working: Math.random() Is Not Your Friend: PRNG Prediction and Timing Attacks in API Tokens
roxdavirox profile
Davi

Working: Math.random() Is Not Your Friend: PRNG Prediction and Timing Attacks in API Tokens

#cybersecurity #javascript #security
Comments
5 min read
SAML XSW: Signatures That Validate the Wrong Element
roxdavirox profile
Davi

SAML XSW: Signatures That Validate the Wrong Element

#authentication #cybersecurity #infosec #security
Comments
5 min read
Three Signal Channels Leak Valid Account Lists Before Authentication Completes: Status Code, Response Body, and Timing
roxdavirox profile
Davi

Three Signal Channels Leak Valid Account Lists Before Authentication Completes: Status Code, Response Body, and Timing

#api #authentication #cybersecurity #security
Comments
5 min read
CVE-2024-55591: How an Auth Bypass Became an Internet-Scale Firewall Takeover
roxdavirox profile
Davi

CVE-2024-55591: How an Auth Bypass Became an Internet-Scale Firewall Takeover

#cybersecurity #infosec #security
Comments
5 min read
HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways
roxdavirox profile
Davi

HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways

#api #cybersecurity #networking #security
Comments
5 min read
API Key Rotation Leaves Three Records Untouched: Git History, Access Logs, and the Attacker Who Watched the Fix Commit
roxdavirox profile
Davi

API Key Rotation Leaves Three Records Untouched: Git History, Access Logs, and the Attacker Who Watched the Fix Commit

#cybersecurity #git #github #security
Comments
5 min read
Webhook Signature Bypass: When the Receiver Skips the HMAC Check
roxdavirox profile
Davi

Webhook Signature Bypass: When the Receiver Skips the HMAC Check

#api #backend #cybersecurity #security
Comments
5 min read
Exposed OpenAPI Specs: A Complete Attack Map Before the First Request
roxdavirox profile
Davi

Exposed OpenAPI Specs: A Complete Attack Map Before the First Request

Comments
5 min read
HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control
roxdavirox profile
Davi

HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control

#api #backend #cybersecurity #security
Comments
5 min read
JWT aud Claim Bypass: Cross-Service Token Reuse in Microservice Architectures
roxdavirox profile
Davi

JWT aud Claim Bypass: Cross-Service Token Reuse in Microservice Architectures

#cybersecurity #kubernetes #microservices #security
Comments
6 min read
Terraform State Files: Your Entire Infrastructure Credential Inventory in One Plaintext File
roxdavirox profile
Davi

Terraform State Files: Your Entire Infrastructure Credential Inventory in One Plaintext File

#cloud #infrastructure #security #terraform
Comments
5 min read
Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials
roxdavirox profile
Davi

Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials

#api #cybersecurity #infosec #security
Comments
6 min read
Working: OTel Spans Are Secret Stores — How Distributed Traces Leak Bearer Tokens to Anyone With Observability Access
roxdavirox profile
Davi

Working: OTel Spans Are Secret Stores — How Distributed Traces Leak Bearer Tokens to Anyone With Observability Access

#backend #cybersecurity #devops #security
Comments
4 min read
Webhook Producers Are SSRF by Default: Seven CVEs the Security Guides Don't Mention
roxdavirox profile
Davi

Webhook Producers Are SSRF by Default: Seven CVEs the Security Guides Don't Mention

#backend #cybersecurity #infosec #security
Comments
5 min read
API Key Scope Validation Failures: When 'Read-Only' Is a Documentation Claim, Not a Backend Constraint
roxdavirox profile
Davi

API Key Scope Validation Failures: When 'Read-Only' Is a Documentation Claim, Not a Backend Constraint

#api #backend #cybersecurity #security
Comments
5 min read
Server-Sent Events Security: How EventSource Breaks Your API Authentication Model
roxdavirox profile
Davi

Server-Sent Events Security: How EventSource Breaks Your API Authentication Model

#api #authentication #backend #security
Comments
4 min read
API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin
roxdavirox profile
Davi

API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin

#api #architecture #cybersecurity #security
Comments
5 min read
GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls
roxdavirox profile
Davi

GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls

#api #cybersecurity #infosec #security
Comments
5 min read
RAG Poisoning Is a Supply Chain Attack, Not a Prompt Injection Variant
roxdavirox profile
Davi

RAG Poisoning Is a Supply Chain Attack, Not a Prompt Injection Variant

#ai #llm #rag #security
Comments
4 min read
Open-Source LLMs Are Unverified Dependencies: The Model Backdoor Gap npm Already Solved
roxdavirox profile
Davi

Open-Source LLMs Are Unverified Dependencies: The Model Backdoor Gap npm Already Solved

#cybersecurity #llm #opensource #security
Comments
5 min read
AI Agents Are eval(userInput) With Extra Steps
roxdavirox profile
Davi

AI Agents Are eval(userInput) With Extra Steps

#agents #ai #llm #security
Comments
5 min read
AI Agent Long-Term Memory Is an Unguarded Database: How Poisoning Attacks Survive Across Sessions
roxdavirox profile
Davi

AI Agent Long-Term Memory Is an Unguarded Database: How Poisoning Attacks Survive Across Sessions

#ai #cybersecurity #llm #security
Comments
5 min read
Agent Identity Spoofing in Multi-Agent Systems: Your Orchestrator Has No Idea Who It Is Talking To
roxdavirox profile
Davi

Agent Identity Spoofing in Multi-Agent Systems: Your Orchestrator Has No Idea Who It Is Talking To

#agents #architecture #cybersecurity #security
Comments
5 min read
JSON, CSV, and YAML Are Not Safe Formats for AI Agents: They Are Attack Vectors
roxdavirox profile
Davi

JSON, CSV, and YAML Are Not Safe Formats for AI Agents: They Are Attack Vectors

#ai #cybersecurity #llm #security
Comments
5 min read
loading...