Attack and Defense
How a class of attack works, how it is detected, and how it is closed, written for the people running the systems.
-
Session tokens: what a stolen cookie can do, and what limits it
A stolen session cookie is a logged-in user. Why an idle timeout does not bound the thief, and what absolute timeouts, rotation and device binding change.
-
Ransomware kill chain mapped to the controls that interrupt each step
Eight stages of a ransomware intrusion mapped to MITRE ATT&CK v19.2 mitigations and CISA's guide, with a script that shows which stages your controls leave open.
-
SQL injection for people who write queries: mechanism, fix, test
How a string-built query lets input change the SQL, why parameterised queries end it, what OWASP and CWE-89 say, and a regression test you can run.
-
Credential stuffing: how it works, how logs show it, how to slow it
Why reused passwords from old breaches become logins on your site, the shape the attack leaves in your auth logs, and the OWASP and ATT&CK controls that limit it.
-
Phishing that beats MFA: adversary-in-the-middle for defenders
How a relay phishing page captures a one-time code and the session that follows, what ATT&CK, CISA and NIST say, and the controls that hold against it.