Top all-time · #6739
Invicti
Company blog · netsparker.com/blogsecurity
Invicti is the company blog at netsparker.com, writing about security. Since 2011, 12 different Hacker News readers have linked it 46 times, most often “How I Hacked My Smart TV from My Bed via a Command Injection”. It is still writing: the last post was on 2026-10-22, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link Netsparker's security content, including an HTTP security headers whitepaper and a PHP type juggling post, mostly as sources. Comments also mention the Netsparker product. No comment judges the writing.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Accurate and automated application security testing that scales like no other solution. Secure thousands of websites, applications, and APIs with the industry’s only DAST-first AppSec platform.
Most-linked posts?
- How I Hacked My Smart TV from My Bed via a Command Injection3 people · 3 mentions · first linked 2017-04-06
- /2 people · 2 mentions · first linked 2014-12-17
What Hacker News says?
Thanks for the feedback. We are actually renewing our website and changing that slogan. This will be the new message, "Proof Based Scanning" and we tried to explain it in here : https://www.netsparker.com/blog/docs-and-faqs/proof-based-we...
Comment linking /blog/docs-and-faqs/proof-based-web-application-security-scanning/
on “A practical security guide for web developers”Submitted SQL Injection Cheat Sheet as a story · 47 points
HN discussionUse static source code analysis and dynamic web app scanners. They are easy to integrate into your SDLC, they are not going to replace manual testing or secure development practices but they'll help a lot. They'll pick up tons of stuff for free, they'll remind you best practices. I have a startup (at least it still feels like a startup!) and we are developing a web application security scanner called Netsparker [0].…
Comment linking /web-applications-advisories/
on “A practical security guide for web developers”Submitted How I Hacked My Smart TV from My Bed via a Command Injection as a story · 13 points
HN discussionhttps://www.netsparker.com/whitepaper-http-security-headers/
Comment linking /whitepaper-http-security-headers/
on “HTTP Security Headers – A Complete Guide”Submitted What Can You Learn from Advisories About Web Application Vulnerabilities? as a story · 11 points
HN discussionWe are developing a web application security scanner [1] and we indeed use max length setting and also detect binary responses, just tested this and as expected it worked fine. I'm actually surprised that many other scanners failed to do this. [1] https://www.netsparker.com
Comment linking /
on “Defending a website with Zip bombs”Submitted Collision Based Hashing Algorithm Disclosure as a story · 5 points
HN discussionYeah, but if you're worried about bugs and security holes, I'm not sure PHP can possibly help more than it hurts. E.g., type juggling: https://www.netsparker.com/blog/web-security/php-type-juggli...
Comment linking /blog/web-security/php-type-juggling-vulnerabilities/
on “A look at modern PHP”Submitted Passwords vs. Pass Phrases as a story · 5 points
HN discussionEven though I'm not a front-end developer, I dealt with WordPress advanced custom development for a certain amount of time to realize web development - as we currently know it - is not worth it...like *at all*! As an OCD person I cannot count the number of times I got panic attacks for realizing how many tests I needed to go through to test: * have I checked my PHP code, packages, and settings? Are they all good? *…
Comment linking /blog/web-security/private-data-stolen-exploiting-css-injection/
on “I don't want to do front-end anymore”Submitted How Type Juggling (PHP) Can Lead to Authentication Bypass as a story · 4 points
HN discussionSame guys hit Sun.com via SQL Injection as well - http://tinkode27.baywords.com/sun-com-sun-mycrosystems-vulne... Shameless self plug: Netsparker ( My startup: http://www.netsparker.com/ ) could have identified both of these vulnerabilities.
Comment linking /
on “MySQL.com compromised via (guess what?) SQL injection”Submitted Identifying WordPress Websites on Local Networks and Bruteforcing Login Pages as a story · 4 points
HN discussion> Existing solutions are either lacking or way too difficult to operate Give Netsparker[1] a go.. couldn't get much easier then this! [1] https://www.netsparker.com/
Comment linking /
on “CSRF in Doorkeeper OAuth2 gem”Submitted Show HN: Free Web Application Scanner to check for Shellshock and more as a story · 4 points
HN discussionWith 7 years experience of running a remote & distributed team (5+ countries) at Netsparker [1]. We have 4 platforms: * Bug Tracking / Project Management * Group Chat * Skype / Voice * Email Since we grew organically, here is how I shaped the culture from 2 team members to 20 and quite happy with it at the moment: Groupchat is for "2. Red Alerts" (via @everyone mentions), "3.Having Fun" and "4. Sense of belonging".…
Comment linking /
on “Is group chat making you sweat?”Submitted Discovering and Hacking IoT Devices Using Web-Based Attacks as a story · 3 points
HN discussionIt's a nice mix of issues. Web security (client/server-side) is a big field, and keep changing. We need a lot of awareness. If you like this kind of web security focused articles, our security researchers publish (almost weekly) very basic to advanced web security topics in our blog : https://www.netsparker.com/blog/web-security/ Some of them are very specific like; PHP Type Juggling Vulnerabilities: https://www.net…
Comment linking /blog/web-security/crlf-http-header/
on “Advanced web security topics”Submitted Pros and Cons of DNS Over HTTPS as a story · 3 points
HN discussion> ... I had to change and decided to jump into the startup world. You don't have to choose one of them. I was in a similar position about 6 years ago, software + security background and passion for startups which led me to start my own company ( https://www.netsparker.com/ ), we're building a tool to automate web app security and advancing the automated scanning in web apps, it's really fun stuff if you are into sec…
Comment linking /
on “How I started in web security”Submitted How I Hacked My Smart TV from My Bed via a Command Injection as a story · 3 points
HN discussionWe need to kill the cliche that language/framework doesn't matter but we also need to understand, it still won't solve all problems. I wrote about a similar topic from a web application security point of view: Why Framework Choice Matters in Web Application Security* ( https://www.netsparker.com/blog/web-security/why-framework-c... ) Also today there is enough data in the industry to prove this argument beyond any d…
Comment linking /blog/web-security/why-framework-choice-matters-in-web-application-security/
on “Software Security Is a Programming Languages Issue (2018)”Submitted HRef React Templating is not XSS-safe ▤ as a story · 2 points
HN discussionWe are using .NET Stack for our web app scanner. Both for desktop and ( https://www.netsparker.com/web-vulnerability-scanner/ ) and SaaS versions use .NET ( https://www.netsparker.com/online-web-application-security-s... ) We started with Bizspark as well, now we graduated and license cost is not much really. We also rely on MS stack for many things other than source code repository / CI etc.
Comment linking /online-web-application-security-scanner/
on “Ask HN: Who is using the .NET stack for their startup?”Submitted Analyzing Impact of WWW Subdomain on Cookie Security as a story · 2 points
HN discussionShameless plug: If you are looking for something like this for non-Google App Engine web applications we recently launched a SaaS Web Security Scanner - https://www.netsparker.com/online-web-application-security-s...
Comment linking /online-web-application-security-scanner/
on “Using Google Cloud Platform for Security Scanning”Submitted Using Google Bots as an Attack Vector as a story · 2 points
HN discussionMaybe not everyone knows this, it's called XSS. There is a good cheat sheet to protect against issues like this from OWASP : https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_P... Shameless plug: We develop a tool that detects vulnerabilities such as this automatically (even in JavaScript based web apps) - https://www.netsparker.com/netsparker/ There is also a free community edition which would possibly det…
Comment linking /communityedition/
on “Show HN: Drop-In Chat – Chatify your app”Submitted How I Hacked My Smart TV from My Bed via a Command Injection as a story · 2 points
HN discussion
