Louis Nyffenegger

Everyone is panicking about AI-generated zero days like it's an attacker story. It's not. Defenders can use the best models against their own code right now. Your progress compounds. Attackers' job gets harder. pentesterlab.com/blog/defende...

DO NOT JAVASCRIPT TODAY. I REPEAT: DO NOT, UNDER ANY CIRCUMSTANCES, JAVASCRIPT TODAY.

I spent last week, this week-end and the start of this week working on a redesign of @pentesterlab.com 's website. Aiming for something a bit more modern... Let me know what you think!

Our schedule is up, and we're excited to announce our speaker @snyff.pentesterlab.com is joining us on stage with I DON'T LIKE THIS CODE!!! Get ready to walk through a series of real-world inspired code snippets with one minute to figure it out. Only question, will there be jeopardy music?

Closing keynote for Day 1 announced for BSides Prague 2026 🎉 Louis Nyffenegger (@snyff.pentesterlab.com), application security expert and founder of PentesterLabs, is joining us! 📷 April 23, 2026 Don’t miss it. 📷🔥 #bsides #bsidesprg #keynote

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟵, 𝟮𝟬𝟮𝟲 Mostly AI... 💻 𝗕𝗿𝗼𝘄𝘀𝗲𝗿-𝗕𝗮𝘀𝗲𝗱 𝗣𝗼𝗿𝘁 𝗦𝗰𝗮𝗻𝗻𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗔𝗴𝗲 𝗼𝗳 𝗟𝗡𝗔 Leveraging Local Network Access to create a port scanner! wiki.notveg.ninja/tools/lna-po....

I wrote about what happens when you rewrite mature software with agents. You rebuild the features. You don't rebuild the scars. vinext: one engineer, one week, $1,100 in tokens. Then plenty of vulnerabilities found within days. pentesterlab.com/blog/what-yo...

SEE MUM, "I" CAN STILL FIND BUGS!

Today (2025-12-29) is 2026-W01-1 in ISO week-date 🤯\ So it’s the first day of ISO week-year 2026, even though the date is still 2025. (Week 1 = week with the first Thursday)

Black Friday at @pentesterlab.com 🧨 For a limited time: 🔒 1 year of PRO for $146.52 🎓 Student special: 3 months PRO for $25.99 Hands-on labs. Real CVEs. Security code review training used by real AppSec & pentest teams. ⏰ Offer ends 2 Dec 2025, 23:59:59 UTC 👉 pentesterlab.com/pro

I have been using docker for 10 years... Today I learned that you don't need to provide the full container id when you run docker exec...

Really awesome preso from @snyff.pentesterlab.com @pentesterlab.com over at BSides Perth. Jam packed with patterns, approaches, tips and tricks to level up finding bugs in code. #bsides #bsidesperth

I’ve spent 2 solid hours doing bug bounty and I still haven’t made $200k. Can someone tell me what I’m doing wrong? #bugbountytips

AI-generated code is reshaping secure code review—fewer trivial bugs, but more hidden threats. Read more in our new blog post: pentesterlab.com/blog/secure-... What do you think?

Think teaching devs to hack is risky? In reality, a bit of hacking knowledge helps them spot vulnerabilities early and build stronger apps. Discover why having devs with a 'hacker mindset' is a win for security: pentesterlab.com/blog/why-dev...

From now on, I'll call any snippet of vulnerable code shared on Social Media as "Security Code Review Porn" It gives the wrong expectations about what real code review actually involves.

Articles worth reading discovered last week: 🤝 blog.doyensec.com/2025/01/30/o... ☠️ www.feistyduck.com/newsletter/i... 📚 pathonproject.com/zb/?871f0933... And as always, it’s in our blog: pentesterlab.com/blog/researc... #PentesterLabWeekly

🚀 Level up your #CyberSecurity skills FOR FREE! 🛡️ Earn the Recon Badge with Pentesterlab and master: 🔍 Virtual Hosts 🌐 DNS Recon 🔒 TLS Recon ...and so much more! Start your journey today 👉 pentesterlab.com/badges/recon

...

Networking in InfoSec isn’t just about IP addresses and ports—it’s also about people! Discover how meetups, conferences, and volunteering can open big career doors in InfoSec. Read more: pentesterlab.com/blog/infosec...

Someone shared this write-up in the @pentesterlab.com 's discord: www.wiz.io/blog/nuclei-... I love this article so much! The content and the analysis are A+ I really like the 🚩 (very similar to pentesterlab.com/blog/another...)

Have a great weekend and enjoy some tunes: youtu.be/j_Md8_7mhOU

If your New Year’s resolution is to get better at web security code review, don’t miss our upcoming live training. Learn how to find vulnerabilities and strengthen your skills: pentesterlab.gumroad.com

Happy New Year! pentesterlab.com/gift/xDzcB35... (3-month) pentesterlab.com/gift/UBMtCsi... (3-month) pentesterlab.com/gift/BWEYEme... (3-month)

Golang: because hackers haven’t given up on SQL injection in 2024...

🎅 pentesterlab.com/gift/v5kegJq... (3-month) pentesterlab.com/gift/4VG6RYU... (3-month) pentesterlab.com/gift/lsgfEwJ... (3-month)

Cross-Site POST Requests Without a Content-Type Header by @lukejahnke https://nastystereo.com/security/cross-site-post-without-content-type.html #BBRENewsletter85

❤It is why I am a huge fan and student of @pentesterlab.com and @snyff.pentesterlab.com 😱This lab show me that I was wrong, since several years, recommending to dev teams using a hash of the token as identifier in a revocation list. 🥰Now, I know the correct recommendation to provide. #appsec #jwt

Want to level up your learning in security? 🚀 Stop scrolling and start reflecting. 'Reading Between the Lines' challenges you to dig deeper: 1️⃣ What can I learn from this? 2️⃣ What patterns apply elsewhere? 3️⃣ Why didn’t I spot this? The real breakthroughs come when you ask the right questions. 💡 👇

pentesterlab.com/gift/oNrufnj...

These are simple issues, but they illustrate how, by thinking of vulnerabilities as patterns rather than code, you can move from one language to another.

Guess who has two thumbs, just found another algorithm confusion vulnerability, and got accepted to speak at @cactuscon.bsky.social on algorithm confusion vulnerabilities? 👍 THIS GUY 👍

Cyber has more certs than /etc/ssl/certs/ca-certificates.crt

If you are a new PRO subscriber, make sure you order your set of free stickers!

Only content from Australia and New Zealand this week! Is the rest of the world asleep? 💎 nastystereo.com/security/rub... 🪄 srcincite.io/blog/2024/11... 🌐 nastystereo.com/security/cro... 👺 pulsesecurity.co.nz/articles/mss... 🔐 tierzerosecurity.co.nz/2024/11/26/d...

Encoding isn't magic ✨: It doesn’t bypass filters or hack systems unless something decodes it. Learn how to avoid this common security misconception: pentesterlab.com/blog/encodin... #AppSec #CyberSecurity #BugBounty

Given that simps0n isn’t on Bluesky yet, allow me to repost a link to his excellent weekly ezine 💎 Here’s today’s edition, "AppSec Ezine - 563rd" 📚

Programming languages should have functions/methods to validate if a hostname or origin are part of a domain... That would kill a *LOT* of vulnerabilities...

When you're just minding your own business building code review labs for @pentesterlab.com, and a new vulnerability jumps out at you...

@nastystereo.com seems alright at computers...

nastystereo.com/security/cro...

My latest blog post is live! nastystereo.com/security/cro... Read how to send a cross-site POST without including a Content-Type header (without CORS). It even works with navigator.sendBeacon

‼️Only valid until‼️ Tuesday, 03 Dec 2024 23:59:59 Don't miss this opportunity! It's also the perfect time to renew/extend your existing subscription! pentesterlab.com/pro

(H|Bl)ack Friday is Back! 🔥🔥🔥 Black Friday Special 🔥🔥🔥 Get full access to PentesterLab PRO for a year and pay $146.52 instead of $199.99 🎓📚✏️ Student Special ✏️📚🎓 Get full access to PentesterLab PRO for three months year and pay $25.99 instead of $34.99