Prompt injection isn't the only risk in AI chat APIs. See how we found a GraphQL BOLA in a healthcare SaaS AI assistant and why the transport layer matters.
Resources
Blog
Nate Fair
Blogs by Nate Fair
Why traditional API pentests miss real commerce risk and how cart tokens, checkout flows, and cross-layer auth gaps expose customer data.
What being a hacker really means—no title required. After a decade in offensive security, Nate Fair shares honest lessons on hacking.
Introducing WebQL, an automated JavaScript analysis tool that leverages CodeQL to identify and exploit vulnerabilities in modern web applications like SPAs and PWAs. By automating the extraction, beautification, and analysis of client-side code, WebQL enhances penetration testing by uncovering security issues obscured by modern development practices.
Semgrep, or Semantic Grep (For Code) should be a part of your pentesting toolkit. If you think otherwise, read on to see why.
Our approach to mass exploitation of the latest and greatest vulnerability. On the chopping block, this time around: CVE-2024-3400.
