Read more
Security Tip: The Trap That Caught Me!
[Security Tip #135] During a recent pentest, I suddenly got hit with 403s on every request. It wasn't a WAF - it was a clever little trap one of my clients built to catch anyone poking at Livewire. Let me show you how it works. 🤓
5 years of Securing Laravel!
Yikes! I've been writing Securing Laravel for 5 years! 😲
Security Tip: Help Password Managers Get It Right!
[Tip #134] Laravel's password helper has a great little feature you may have missed: it can generate browser-friendly password rules automatically! 🤓
In Depth: From Serialised String to RCE!
[In Depth #42] unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code execution. Let's pull a real RCE apart. 😈