The Thirsty Robot

Here's some of what you missed in the discussion at 'The Thirsty Robot': Technical Musings: Vulnerable to attack... We started by talking about how to practice penetration testing - the art of seeing if a web-site (or network, or cloud server, or...) has any virtual 'open door' or probably more likely: 'doors accidentally left slightly ajar'. As always, it was noted that trying out techniques on other people's sites requires their permission, but we did gather some links to places which are designed to be tested: Vulnerable web-sites: https://securitytrails.com/blog/vulnerable-websites-for-penetration-testing https://resources.infosecinstitute.com/topic/top-5-deliberately-vulnerable-web-applications-to-practice-your-skills-on/ https://dst.com.ng/15-vulnerable-sites-legally-practice-hacking-skills/ And some vulnerable applications: https://owasp.org/www-project-vulnerable-web-applications-directory/ https://github.com/OWASP/OWASP-VWAD https://resources.in...

Here's some of what you missed in the discussion at 'The Thirsty Robot': Technical Musings: Instantiation. We discussed the problems when a software suite provides control over preferences and settings, but then does not instantiate them correctly when you start a new session or tab. This can lead to security/privacy problems where rules about restricted scope or domains are not followed, or where information leaks, and more. Testing this type of deep functionality can be a challenge with software that has lots of user control and many derived capabilities. Explore deeper:   Mocks     Control Conglomerate or Accretion. Stolen from geology, these are possible terms for describing software that has had functionality randomly added over time, without any clear overall plan or structure. A bit like someone else's toolbox where the drill bits are stored in the little metal box decorated with roses - if you don't know this then it can take some time to find the drill bits...