OS Command Injection Through Shell Invocation in Node.js
Shell syntax in user input gets parsed as commands, not safely passed as data.
Tariq Osei-Mensah
Senior Contributing Editor
Tariq Osei-Mensah
Tariq spent eight years as a penetration tester at a boutique security consultancy before moving into full-time writing and research; his hands-on work with web application assessments informs his deeply technical breakdowns of injection and authentication weaknesses.
7 stories
Insecure Deserialization in Java and Python Applications
Attackers can execute arbitrary code by exploiting how Java and Python deserialize untrusted data.
Tariq Osei-Mensah
Stored XSS in SaaS Collaboration Features and Rich Text Editors
Attackers exploit trust in collaboration tools by injecting malicious scripts into shared content.
Tariq Osei-Mensah
Insufficient Logging and Monitoring Gaps That Enable Attacker Dwell Time
Attackers operate undetected for weeks when logging and alerting gaps leave breaches invisible.
Tariq Osei-Mensah
Security Misconfiguration in AWS IAM Policies and S3 Buckets
Misconfigurations in IAM roles and S3 buckets remain the source of most cloud breaches.
Tariq Osei-Mensah
Broken Authentication in Microservices and Service-to-Service APIs
Microservices multiply authentication attack surfaces, and most teams aren't securing them.
Tariq Osei-Mensah
OAuth 2.0 Misconfiguration in SaaS Authorization Flows
Misconfigurations in OAuth 2.0 follow predictable patterns security teams can learn to spot.
Tariq Osei-Mensah