Skip to main content

Free 30-min security demo  — We'll scan your real code and show live findings, no commitment Book Now

Offensive360

Security Blog

Practical application security guides, vulnerability research, and DevSecOps insights from our security research team.

Filter:
Application Security

Roslyn Security Analyzer Rules for .NET: Complete CA Rule Reference

Every Roslyn security analyzer rule for .NET: CA2100, CA3001–CA3012, CA5350–CA5403 with vulnerable code, fixes, and /warnaserror CI/CD enforcement examples.

Roslyn analyzers .NET security SAST CA2100 RunAnalyzersDuringBuild dotnet security rules C# SAST static code analysis .NET static analysis Roslyn security rules
Vulnerability Research

2nd Order SQL Injection: Detection, Payloads & Fixes

2nd order SQL injection fires in a later query—not on input. Learn how to detect it manually, with SAST taint analysis, and how to fix it in PHP, Python, Java, and C# with parameterized queries.

2nd order sql injection second order sql injection second-order SQLi SQL injection OWASP SAST CWE-89 web security database security parameterized queries
Vulnerability Research

Fix CORS Wildcard Parsing Off-by-One Bug (Origin Bypass)

Fix the CORS wildcard parsing off-by-one bug: substring checks let evil-yourcompany.com bypass your allowlist. Secure origin validation with exact-match Set in Node.js, Python & Java.

CORS cors wildcard cors off-by-one fix cors wildcard parsing off-by-one cors wildcard parsing Access-Control-Allow-Origin origin allowlist bypass web security API security CWE-942 cors misconfiguration
Vulnerability Research

Access-Control-Allow-Headers: * Wildcard — When It's Blocked

Access-Control-Allow-Headers * wildcard: when browsers allow it, when credentials block it, why Authorization is excluded, and correct CORS header configs for APIs.

CORS Access-Control-Allow-Headers wildcard cors credentials web security API security CWE-942 cross-origin access-control-allow-headers wildcard cors wildcard headers
Application Security

dotnet ef RunAnalyzersDuringBuild=false — Exact Fix (2026)

dotnet ef migrations failing? Pass -- /p:RunAnalyzersDuringBuild=false after the -- separator. Copy-paste CLI fix with GitHub Actions, Azure DevOps & Docker examples.

dotnet ef RunAnalyzersDuringBuild RunAnalyzersDuringBuild=false dotnet ef migrations Roslyn analyzers .NET SAST Entity Framework static code analysis .NET security CI/CD security SAST
Vulnerability Research

CORS: Access-Control-Allow-Credentials with Wildcard Origin Explained

Why Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true can't be combined, what breaks, what the real risks are, and the correct CORS fix for credentialed requests.

CORS Access-Control-Allow-Credentials Access-Control-Allow-Origin wildcard CORS misconfiguration API security CWE-942 web security cross-origin credentialed requests
Vulnerability Research

2nd Order SQL Injection: How It Works, Detection & Fixes

2nd order SQL injection stores the payload safely then fires it in a later query, bypassing most scanners. Step-by-step examples in PHP, Python, Java & SQL Server with exact fixes.

2nd order sql injection second order sql injection stored sql injection SQL injection SAST CWE-89 OWASP web security database security second-order SQLi 2nd order SQLi
Application Security

Unified SAST + DAST Reporting: Single Dashboard for AppSec

Unified SAST & DAST reporting in one dashboard: eliminate duplicate findings, align severity scales, and auto-generate PCI-DSS, SOC 2 & ISO 27001 compliance evidence.

unified reporting SAST DAST DevSecOps application security sast dast unified reporting dast sast appsec platform security testing SAST DAST unified
Application Security

Android Security Testing Tools & Frameworks (2026)

Best Android security testing tools for 2026: MobSF, JADX, Frida, Drozer & SAST for Android Java/Kotlin. Static and dynamic analysis workflows for Android apps.

android security testing android security testing tools android security testing frameworks MobSF mobile security android SAST android DAST mobile app security android vulnerability android pentest
Tools & Comparisons

Best .NET Static Code Analysis Tools 2026 (C# SAST Ranked)

.NET static code analysis tools ranked for 2026: Roslyn analyzers, SonarQube, Checkmarx, Fortify & Offensive360 — compared by taint analysis depth, on-premise support & pricing.

.NET static code analysis C# security SAST .NET security Roslyn analyzers static code analysis tools .net application security code analysis Visual Studio security .net sast
Security Best Practices

OWASP API Security Top 10: Complete Guide & Code Examples (2026)

OWASP API Security Top 10 explained: BOLA/IDOR, broken auth, mass assignment, rate limiting, CORS misconfigs — each risk with working code fixes in Node, Python & Java.

api security best practices API security REST API security OWASP API Security API authentication rate limiting API authorization CORS JWT security API security 2026
Security Best Practices

API Security Checklist: 30 Controls to Test Before You Ship (2026)

A practical API security checklist covering authentication, authorization, rate limiting, input validation, CORS, logging, and OWASP API Top 10 — with pass/fail criteria.

api security checklist api security best practices OWASP API security API security audit REST API security API testing api security controls api security audit checklist api protection api security guidelines
Vulnerability Research

CORS Wildcard Risk: What It Is & How to Fix It (2026)

CORS wildcard (*) on authenticated APIs allows cross-origin data theft. See the exact attack, why reflected-origin is worse, and correct CORS configs for Node.js, Python & Java.

CORS Access-Control-Allow-Origin wildcard cross-origin API security web security CWE-942 cors wildcard parsing cors off-by-one fix cors wildcard
Vulnerability Research

Hardcoded Credentials Vulnerability (CWE-798): Checkmarx Fix & Remediation

Hardcoded credentials (CWE-798) are flagged by Checkmarx, Veracode, and Fortify as critical findings. Learn the exact remediation steps, how SAST scanners detect them, and how to fix hard-coded credentials across Python, Java, C#, and Node.js.

hardcoded credentials CWE-798 hardcoded passwords Checkmarx SAST secrets management hard-coded credentials remediation use of hardcoded password checkmarx
Vulnerability Research

HTML Injection: Attack Examples, Real Impact & Prevention (CWE-80)

HTML injection embeds fake login forms and phishing links into trusted pages — no JavaScript needed. Reflected, stored & DOM variants explained with output encoding fixes.

HTML injection web security XSS OWASP input validation output encoding CWE-80 application security html injection vulnerability what is html injection
Vulnerability Research

2nd Order SQL Injection: OWASP Definition, Detection & Fixes

2nd order SQL injection per OWASP WSTG-INPV-05: how deferred payloads evade scanners, how Checkmarx detects it, and parameterized query fixes in Java, Python, PHP & C#.

second order sql injection what is second order sql injection OWASP Checkmarx SQL injection second-order SQLi stored sql injection 2nd order sql injection second order sql injection owasp
Vulnerability Research

Command Injection: How It Works, Examples & How to Prevent It

Command injection lets attackers run OS commands on your server through unsanitized input. See how it works, real exploit examples in Python, PHP, and Java, and the correct fix.

command injection OS command injection CWE-78 OWASP web security application security SAST
Vulnerability Research

File Path Injection: What It Is, How It Works & How to Fix It

File path injection (CWE-22) lets attackers read, overwrite, or delete arbitrary files on your server. Learn how path traversal attacks work and how to prevent them in your code.

file path injection path traversal CWE-22 directory traversal file inclusion SAST web security application security
Application Security

What Is Static Code Analysis? How It Works (2026 Guide)

Static code analysis scans source code without running it — finding SQL injection, XSS, and hardcoded secrets. How taint analysis works and what to look for in a SAST tool.

static code analysis SAST code quality source code analysis static analysis tools code vulnerability scanning application security
Tools & Comparisons

Best Code Quality Analysis Tools 2026 — Ranked & Compared

Best code quality analysis tools for 2026: linters vs SonarQube vs SAST platforms. See what each tool finds, what it misses, and which stack combination catches the most bugs.

code quality analysis tools code quality analysis code quality tools static analysis SAST linter code review software quality DevSecOps code analysis tools
Vulnerability Research

How to Prevent Hardcoded Passwords in Source Code (CWE-798)

Hardcoded passwords are scraped from public repos within minutes. Fix CWE-798 with env variables, secrets managers, and pre-commit hooks — code examples for Python, Node & Java.

hardcoded passwords hardcoded secrets how to prevent hardcoded passwords credentials in source code AppSec secrets management CWE-798 detect hardcoded passwords
Vulnerability Research

Node.js vm Module Is Not a Security Mechanism: Sandbox Escapes & Fixes

The vm module is not a security mechanism — here's why: prototype chain escapes, deprecated vm2, and safe alternatives (isolated-vm, subprocess sandboxing) for untrusted Node.js code.

Node.js security vm module sandbox escape JavaScript security SAST code injection vm module security vm module not a security mechanism
Application Security

Best Code Vulnerability Scanning Tools 2026 (Ranked)

Code vulnerability scanning tools ranked for 2026: how taint analysis works, what each tool misses, and which SAST scanner finds SQL injection, XSS & secrets reliably.

code vulnerability scanner code vulnerability scanning tools SAST static code analysis source code security vulnerability scanning code vulnerability scanning source code vulnerability scanner code vulnerability scanning tool best code vulnerability scanner
Application Security

AI-Powered SAST: The Future of Code Security in 2026

Traditional SAST tools produce 30–70% false positive rates, causing alert fatigue. AI-powered static analysis changes the equation — here's how and what it means for your security program.

AI SAST false positives LLM DevSecOps code security 2026
Application Security

SAST Tool Pricing in 2026: The True Cost of Enterprise Code Security

Breaking down the five SAST pricing models used by Checkmarx, Veracode, Fortify, Snyk, and Semgrep — and what enterprise teams actually pay versus the quoted price.

SAST pricing Checkmarx Veracode Fortify Snyk enterprise security
Application Security

SAST vs DAST: Which Security Testing Do You Actually Need?

A practical comparison of SAST and DAST — what each finds, where they overlap, and why most teams need both. Includes decision framework and comparison table.

SAST DAST SAST vs DAST application security DevSecOps security testing
Application Security

What Is DAST? Dynamic Application Security Testing Explained for Dev Teams

DAST tests your running application for vulnerabilities by simulating real attacks. Learn how dynamic testing works, when it beats SAST, and how to set it up.

DAST dynamic analysis web application security penetration testing API security
Vulnerability Research

Access-Control-Allow-Origin: * Fix Guide (CWE-942)

How to fix Access-Control-Allow-Origin: * (CWE-942): replace the CORS wildcard with a validated origin allowlist in Express, Django, Spring Boot, and Nginx — with code examples.

CORS Access-Control-Allow-Origin wildcard CORS misconfiguration API security CWE-942
Application Security

Best Vulnerable Web Applications for Security Testing 2026

Best vulnerable web applications for 2026: DVWA, Juice Shop, WebGoat, bWAPP & NodeGoat with Docker setup commands, coverage map, and SAST/DAST benchmarking guide.

vulnerable web applications vulnerable web application DVWA WebGoat OWASP Juice Shop bWAPP NodeGoat security testing ethical hacking appsec practice vulnerable apps for security testing vulnerable web app practice web application security vulnerable applications
Application Security

What Is SAST? A Practitioner's Guide to Static Application Security Testing

Static Application Security Testing (SAST) analyzes your source code for security flaws before deployment. Here's how it actually works, when to use it, and what to watch out for.

SAST static analysis application security DevSecOps code review
Security Operations

Application Security Audit Checklist: 100+ Controls (2026)

Application security audit checklist with 100+ controls: SAST, DAST, API security, cryptography, headers & cloud — mapped to OWASP, PCI-DSS & SOC 2. Copy-ready.

security audit checklist application audit checklist application security audit checklist template 360 degree website security audit checklist OWASP SAST DAST appsec penetration testing
Application Security

DAST vs Penetration Testing: Key Differences (2026)

DAST vs penetration testing explained: automated scanner vs manual tester, cost ($500 DAST scan vs $15K–$50K pentest), what each finds, and when you actually need both.

DAST vs penetration testing DAST penetration testing pentest DAST vs pentest application security web app security dynamic application security testing sast vs dast and pentesting sast vs dast vs pentesting sast vs dast vs pentest dast vs pen testing automated security testing vs pentest web application security testing
Security Best Practices

API Security Best Practices 2026: 11 Controls (OWASP Top 10)

11 API security best practices with code examples: fix BOLA/IDOR, JWT algorithm confusion, mass assignment, rate limiting & CORS misconfigs mapped to the OWASP API Security Top 10.

API security REST API GraphQL OWASP API Security authentication rate limiting JWT api security best practices api security standards api protection REST API security API security controls API security guidelines
Tools & Comparisons

Top 10 Static Code Analysis Tools 2026 — Ranked

Top 10 static code analysis & code vulnerability scanning tools for 2026: ranked by taint depth, language support and real pricing. Checkmarx, Fortify, SonarQube & Offensive360 compared.

static code analysis tools SAST static analysis code analysis tools code vulnerability scanner code vulnerability scanning tools SonarQube Veracode Fortify SAST comparison 2026 code quality analysis tools SAST tools best static code analysis tool static code analysis tool comparison
Threat Detection

How to Detect Malicious Source Code in Your Codebase

Malicious code inserted via supply chain attacks, insider threats, or compromised dependencies can hide in plain sight. Here's how to detect it systematically.

malicious code supply chain security insider threat SAST code review backdoor detection
Vulnerability Research

2nd Order SQL Injection: Attack Steps, Examples & Fixes

2nd order SQL injection stores a payload that fires in a later query—invisible to most scanners. Step-by-step exploit, real code examples, and parameterized query fixes in PHP, Python, Java & C#.

SQL injection second-order SQLi 2nd order SQL injection 2nd order sql injection OWASP web security database security second order sql injection what is second order sql injection stored sql injection second order injection sql injection second order
Vulnerability Research

Log4Shell (Log4j) Vulnerability: What It Is and How to Remediate It

Log4Shell (CVE-2021-44228) is one of the most critical vulnerabilities in software history. This guide explains how it works, how to detect if you're affected, and the complete remediation steps.

Log4j Log4Shell CVE-2021-44228 Java JNDI injection RCE remediation
Vulnerability Research

Rust Vulnerabilities: Most Common Issues You Need to Know

While Rust provides memory safety advantages over C/C++, vulnerabilities still emerge — particularly when developers use unsafe code blocks or rely on libraries with security gaps.

Rust memory safety unsafe code DoS supply chain
DevSecOps

How to Secure Docker Containers — Security Guide

Docker containers offer enhanced isolation, but organizations must implement specific safeguards. This guide covers image scanning, least privilege, network policies, secrets management, and runtime monitoring.

Docker containers DevSecOps image scanning least privilege
DevSecOps

Jenkins Pipeline Security: How to Safely Manage CI/CD Pipelines

Jenkins interacts with multiple servers and components, making security crucial. This guide covers the most common Jenkins vulnerabilities and 13 best practices to secure your CI/CD pipeline.

Jenkins CI/CD pipeline security DevSecOps access control
Application Security

How to Perform a Secure Code Review — Step-by-Step

Code review is one of the most effective ways to catch security vulnerabilities before they reach production. This guide covers the process, tools, and best practices for meaningful security-focused code review.

code review secure SDLC AppSec best practices developer security
Vulnerability Research

OpenSSL Vulnerabilities CVE-2022-3602 and CVE-2022-3786: What You Need to Know

The OpenSSL Project disclosed two high-severity vulnerabilities in October 2022. Initially labeled critical, here's what they actually mean, who is affected, and what to do.

OpenSSL CVE TLS cryptography patch management
DevSecOps

How to Secure Kubernetes Secrets — K8s Security Guide

Kubernetes Secrets are base64 encoded but not encrypted by default. Learn how to properly secure sensitive data in K8s clusters with encryption, RBAC, and secrets management best practices.

Kubernetes K8s secrets management RBAC etcd encryption DevSecOps
Vulnerability Research

Spring4Shell — Critical Remote Code Execution in Spring Framework (CVE-2022-22965)

Spring4Shell is a critical RCE vulnerability (CVSS 9.8) affecting Spring MVC on JDK 9+. Here's what it is, whether you're affected, and how to patch it immediately.

Spring Java RCE CVE-2022-22965 Spring4Shell critical vulnerability
Vulnerability Research

13 Common Java Security Vulnerabilities & How to Fix Them

The most common Java vulnerabilities: SQL injection, XXE, insecure deserialization, SSRF, EL injection, path traversal, and more — each with vulnerable vs. secure Java code examples.

Java Java security Spring OWASP SQL injection XXE deserialization SSRF common Java vulnerabilities most common vulnerabilities in java
DevSecOps

CI/CD Pipeline Security Best Practices — Secure Your DevOps

Your CI/CD pipeline has access to source code, production secrets, and deployment infrastructure. Securing it is as critical as securing the application itself. Here's how.

CI/CD DevSecOps pipeline security secrets management supply chain
Vulnerability Research

How to Prevent Cross-Site Scripting (XSS) — Complete Guide

Cross-site scripting is consistently in the OWASP Top 10. This guide covers all three XSS types — reflected, stored, and DOM-based — with prevention strategies and code examples.

XSS cross-site scripting OWASP input validation web security CWE-79

Secure your code today

Offensive360 finds vulnerabilities in your source code and running applications — before attackers do.

Scan Your Code Learn About SAST