Top all-time · #10626
Websecurify Blog
Company blog · blog.websecurify.comsecurityai
Websecurify Blog is the company blog at blog.websecurify.com, writing about security and ai. Since 2010, 7 different Hacker News readers have linked it 92 times, most often “Hacking Node.js and MongoDB”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
Posts with practical examples of attacking web apps, such as hacking Node.js serialization, a qs/MongoDB issue in Express, and cracking captchas with OCR. Commenters link them as hands-on demos rather than praising the writing.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Research, techniques and tooling notes from Websecurify, a specialist consultancy at the intersection of AI and security.
Most-linked posts?
- Hacking Node.js and MongoDB3 people · 3 mentions · first linked 2014-08-11
- Pown proxy: Open-source cli proxy with rich ui support2 people · 2 mentions · first linked 2018-01-17
- Vortex - A Vagrant Alternative2 people · 2 mentions · first linked 2013-08-29
What Hacker News says?
I took the courtesy to convert these into pdf slides (for easier reading on iDevices, etc) you can download them from here ( http://blog.websecurify.com/uploads/aa_StartupSchool.pdf ) for now but it will be great if Gregory puts them on his website next to the github link. Thanks for the great work Greg!
Comment linking /uploads/aa_StartupSchool.pdf
on “Startup School 2013 Doodles”Submitted Proxy.app Lands In App Store as a story · 64 points
HN discussionI will use the opportunity to mention our own tool: https://rest.secapps.com/ - some of you may find it useful It has vars and rich text editing like Paw, i.e. you can build complex transforms by nesting what we call text items. Here is a blog post how this is done in practice: https://blog.websecurify.com/2017/02/hacking-node-serialize.... We are still working on the UX but there are a lot of cool features in the p…
Comment linking /2017/02/hacking-node-serialize.html
on “Paw – macOS HTTP client for testing and describing APIs”Submitted Hacking WordPress 4.7.0 – step-by-step as a story · 6 points
HN discussionMany types of CAPTCHA systems can be defeated with machine learning models and OCR. Google provides its own called Google Vision API. Here is a brief example how this is done in practice: https://blog.websecurify.com/2017/10/cracking-captchas.html Perhaps this is an old news as this technique has been out for a while but I find that it is still relevant in the many cases I have encountered. Furthermore, in my experi…
Comment linking /2017/10/cracking-captchas.html
on “AI Model Fundamentally Cracks Captchas, Scientists Say”Submitted Router Hacking 101 as a story · 5 points
HN discussionThese are a bit generic imho ... Here is something more specific related to the qs module in express and mongodb: http://blog.websecurify.com/2014/08/hacking-nodejs-and-mongo...
Comment linking /2014/08/hacking-nodejs-and-mongodb.html
on “Securing Node.js Applications”Submitted Network sniffing in your browser as a story · 4 points
HN discussionThe problem with this approach is that due to the way cookies work you can still leak stuff like session identifiers if you forget to enlist certain subdomains and you are browsing other unprotected sites. The privacy in this case is as good as the weakest link. I have multiple profiles under Google Chrome. One of them is for sensitive stuff where Panic Mode is installed and enabled always. I use it only for things…
Comment linking /2013/03/how-to-improve-your-browser-security-with-panicmode.html
on “Panic Mode: Privacy Extension for Google Chrome”Submitted How to use Google Chromebook for Web Security Testing as a story · 4 points
HN discussionhttps://blog.websecurify.com - and now it even redirects to HTTPS automatically. It was there all the time but for some reason it was turned off.
Comment linking /
on “Network sniffing in your browser”Submitted Hacking JSON Web Tokens as a story · 3 points
HN discussionSubmitted Pown Apps – scriptable desktop applications for Pown.js as a story · 3 points
HN discussionSubmitted Build JWT tokens easily as a story · 3 points
HN discussionSubmitted The Awesome HTTPView as a story · 3 points
HN discussionSubmitted The Price of Coffee | And Other Software Related Things as a story · 3 points
HN discussionSubmitted Landing AppBandit Public BETA as a story · 2 points
HN discussionSubmitted Easy web debugging tool for Node.js as a story · 2 points
HN discussionSubmitted Pown proxy: Open-source cli proxy with rich ui support as a story · 2 points
HN discussionSubmitted Pown Proxy as a story · 2 points
HN discussionSubmitted Open-source intelligence: Recon as a story · 2 points
HN discussionSubmitted Cracking CAPTCHAs Using Google Cloud Vision API as a story · 2 points
HN discussionSubmitted AWS S3 Bucket Discovery as a story · 2 points
HN discussionSubmitted AWS S3 Bucket Discovery as a story · 2 points
HN discussionSubmitted Share HTTP Requests JSFiddle-Style as a story · 2 points
HN discussionSubmitted Fuzz JSON with this one weird trick as a story · 2 points
HN discussionSubmitted Extracting HTTP from PCAP in Node as a story · 2 points
HN discussionSubmitted Binary Reverse Engineering Made Easy as a story · 2 points
HN discussionSubmitted Hacking JSON Web Tokens – Practical Guide as a story · 2 points
HN discussionSubmitted Shameless Plug: Unfold Beta as a story · 2 points
HN discussion