Security Blog
Attack Techniques & Security Research
Technical articles on web application vulnerabilities, how automated scanning and manual testing work together, and what real attack patterns look like in practice.
GraphQL Security Testing: What Automated Scanners Actually Find
GraphQL's flexible query model creates an attack surface REST APIs don't have. Introspection exposes your entire schema. Nested queries exhaust server resources. Batching bypasses rate limits. This guide covers what these attacks look like at the HTTP level and how to test for them.
How to Answer a Security Questionnaire When You've Never Had a Pentest
A prospect sent a 40-question security questionnaire. You've never had a formal pentest. What the questions actually mean, what counts as acceptable evidence, and how to get a dated report before you reply.
DAST vs BAS vs Manual Pentest: Which Security Testing Approach Does Your Team Actually Need?
Three tools, three different questions about three different parts of your attack surface. Understanding the difference stops you buying the wrong tool and leaving real gaps in coverage.
How Penetration Testing Pricing Actually Works — and Where Automated Scanning Fits
Manual pentests are one invoice for one point in time. Retesting after your developers fix the findings is typically a separate cost. Here's how the pricing and remediation cycle works, and how automated scanning fills the gaps between engagements.
You Got an Email Saying Your Website Has Security Vulnerabilities. It's Probably a Scam.
Someone emails you claiming they found critical vulnerabilities on your site and wants payment. Here's what they actually did, why it's almost certainly a scam, what legitimate security research looks like, and what to do.
How Attackers Find Vulnerabilities in Your Web App — Before You Do
Attackers work systematically — subdomain enumeration, JavaScript analysis, authentication boundary mapping, input cataloguing, and chaining low-severity findings into critical exploits. Understanding the process is the fastest way to understand where you're exposed.
How to Test for SSRF (Server-Side Request Forgery)
SSRF forces your server to fetch attacker-chosen URLs — including AWS metadata endpoints that return IAM credentials with full account access. Attack patterns, bypass techniques, cloud metadata exploitation, and a six-step testing methodology.
What Enterprise Customers Ask About Security Before Signing
You're three weeks from closing your first enterprise deal — then the security questionnaire arrives. The exact questions, what reviewers are assessing, what strong answers look like, and what answers stall deals.
How to Test for XSS (Cross-Site Scripting) in Your Web App
XSS appears in three forms — reflected, stored, and DOM-based — each requiring a different testing approach. Payloads by reflection context, a six-step testing methodology, and HTTP proof-of-concept examples for each type.
Web Application Security Testing Checklist Before You Launch
50+ checks across authentication, authorization, injection, API security, data exposure, and infrastructure — with severity ratings so you know what to fix first. Every item is testable without a security background.
How to Test for IDOR Vulnerabilities in Your API
APIs expose IDOR differently than web apps — object references appear in URL paths, request bodies, and query parameters simultaneously. A structured testing methodology with HTTP examples for every pattern: sequential IDs, GUIDs, body parameters, and indirect references.
SOC 2, PCI DSS, GDPR: How Engineering Leaders Prepare for Compliance Audits with Attack Simulation
Compliance audits demand evidence that specific technical controls were tested — not just that a scan ran. This guide covers what SOC 2, PCI DSS, GDPR, HIPAA, and ISO 27001 auditors look for technically, and how compliance-aligned attack simulation generates the evidence to support them.
Free Web App Security Testing for Solo Founders and Small Teams
Most security testing tools are priced for enterprise budgets. The Nautillo Pro Starter plan gives solo founders and small teams real attack simulation — multi-step attack chains, proof of impact, PDF export — with no credit card and no time limit.
How to Test Your Web App for SQL Injection Without Breaking It
SQL injection still appears in production apps even those using modern ORMs. This guide covers the three injection types, a safe testing methodology that won't touch production data, and the ORDER BY blind spot most teams miss.
CORS Misconfiguration: How Attackers Exploit It and How to Test Yours
CORS misconfiguration is one of the most frequently confirmed vulnerabilities in modern web apps — and one of the most misunderstood. This guide covers the three exploitable patterns, end-to-end attack chains, and how to test and fix each one.
OWASP Top 10: Which Vulnerabilities Are Actually Exploitable in 2026
The OWASP Top 10 is a reference list, not a priority queue. This guide goes category by category — with real HTTP proof-of-concepts — to show which entries are genuinely exploitable in your app and how to test for them.
AI Prompt Injection: How Attackers Hijack LLM-Powered Web Apps
As AI features land in production web apps, prompt injection has emerged as a real attack surface. We break down how it works, show real exploit patterns, and explain how to test your app for it.
IDOR Vulnerabilities: Detection, Proof of Concept & Fix Guide
Insecure Direct Object Reference is one of the most common vulnerabilities found in web app simulations. This guide walks through real HTTP examples, CVSS scoring, and a testing methodology you can run today.
JWT Authentication Bypass: 4 Attack Techniques and How to Test for Them
JWT tokens are everywhere — and so are misconfigurations. We cover the four most exploited JWT weaknesses: alg:none, weak secret brute-force, RS256→HS256 confusion, and kid injection.