Kategori
Security & WAF
Alle verktøy og artikler i denne kategorien, samlet på ett sted.
Verktøy
CVSS vector decoder
Paste a CVSS v3.1 or v3.0 vector and get the score computed and mapped to a severity, with every metric spelled out. Local and offline; nothing is sent anywhere.
HTTP header-order fingerprint
Paste a request header block and see how header order and casing fingerprint the client - the passive-HTTP analog of JA3.
ZscalerPing IdentityJA3 / JA3N passive TLS fingerprint
Paste a JA3 string and it recomputes the JA3 hash, computes the permutation-stable JA3N, decodes the fields, and flags GREASE values.
ZscalerPing IdentityJA4 / JA3 TLS fingerprint decoder
Decode a JA4 TLS client fingerprint or a JA3 fingerprint into its fields, compute the hashed JA4 from raw values, or compute a JA3 MD5. It auto-detects which you paste. All in your browser.
ZscalerPing IdentityOGNL injection decoder
Paste an OGNL payload you found in a WAF or application log and read what it was trying to do. Separates a sandbox escape from an execution call, names the advisory family the shape is consistent with, and always states what it did not determine. Decodes only - it never evaluates the payload and holds no templates.
SAML Decoder
Paste a SAML Response or assertion (raw, base64, or URL-encoded) and decode its issuer, status, subject, conditions, audience, and attributes, with signature and weak-algorithm checks. Hardened against XXE.
Ping IdentitySecure Headers Analyzer
Paste an HTTP response and get a graded breakdown of its security headers, cookie flags, and cross-origin policy, checked against OWASP, RFC 6797, CSP Level 3, and RFC 6265bis.
SSRF URL classifier
Paste a URL and see where it actually points: loopback, a private or link-local range, a cloud metadata endpoint, CGNAT, reserved space, or the public internet. Decimal, octal, and hex IP obfuscation is decoded, dangerous schemes and embedded credentials are flagged, and an SSRF risk level is shown. It never resolves DNS and never sends the request.
User-Agent entropy analyzer
Paste a User-Agent string and see the identifying tokens it exposes, the distinguishing bits each contributes, and the Client Hints migration.
ZscalerPing IdentityXML Decoder
Paste XML and read its structure: the declaration, the DOCTYPE and any entities, the element tree with namespaces and attributes, plus a security check of the XML attack surface. Nothing is fetched or resolved.
Artikler
HTTP Security Headers: The Defense-in-Depth Layer
What HTTP security headers are, why they form a layer of defense on top of secure code rather than a replacement for it, the headers that carry the most weight, and how to read a response's posture at a glance.
LesRegex Quantifiers and Character Classes
A regular expression is built from two questions: what character do I want, and how many of them? Character classes answer the first, quantifiers answer the second. Get these two right and most of regex falls into place.
LesSAML 2.0: How Browser SSO Works
What a SAML assertion is, the roles of the identity provider and service provider, the SP-initiated Web Browser SSO flow end to end, and the difference between the HTTP-POST and HTTP-Redirect bindings that carry the messages.
LesContent Security Policy, Directive by Directive
How CSP works as a control against cross-site scripting and injection: the shape of a policy, why default-src matters, what 'unsafe-inline' and 'unsafe-eval' give away, how nonces and hashes allow specific inline code safely, and what report-only mode is for.
LesInside a SAML Assertion: Subject, Conditions, and Audience
The anatomy of a SAML assertion: the Subject and NameID formats, bearer SubjectConfirmation and the NotOnOrAfter / Recipient / InResponseTo checks, the Conditions validity window, the AudienceRestriction, and the AuthnStatement, with the validation a service provider must perform on each.
LesRegex Groups, Backreferences, and Lookarounds
Parentheses do far more than set precedence in a regex. They capture text for you to reuse, name the pieces you care about, and — with a question mark prefix — let you assert what comes before or after without consuming it.
LesCatastrophic Backtracking and ReDoS
Some innocent-looking patterns can take seconds, minutes, or effectively forever on a short string. The cause is catastrophic backtracking, and when an attacker controls the input it becomes a denial-of-service bug. Here is why it happens and how to write patterns that cannot.
LesHSTS and HTTPS Enforcement
How Strict-Transport-Security closes the HTTP downgrade window, what max-age, includeSubDomains, and preload each do, the trust-on-first-use gap that preloading removes, and the configuration mistakes that quietly disable it.
LesSAML Signatures and XML-DSig
How a SAML message is signed with XML Signature: the enveloped ds:Signature, the SignatureMethod and DigestMethod algorithms, why SHA-1 is weak, the difference between signing the Response and signing the Assertion, and how XML signature wrapping attacks work.
LesCookie Security Flags
How Secure, HttpOnly, and SameSite protect session cookies, what each SameSite value means, why SameSite=None requires Secure, and how the __Host- and __Secure- prefixes enforce those guarantees at the browser level.
LesRegex Anchors and Boundaries
Anchors match a position, not a character: the start or end of the string, or the edge of a word. They are the difference between a pattern that matches anywhere and one that matches only where you mean. This covers ^, $, \b, and their multiline behavior, plus the mistakes they cause.
LesXXE and Why a SAML Parser Rejects DOCTYPE
How XML External Entity (XXE) attacks work, the billion-laughs denial-of-service, why both depend on a DTD, and why a hardened SAML decoder rejects any DOCTYPE or entity declaration outright rather than trying to parse it safely.
LesClickjacking and Frame Control
What clickjacking is, how framing makes it possible, the difference between the legacy X-Frame-Options header and the modern CSP frame-ancestors directive, why ALLOW-FROM is obsolete, and how the two controls interact.
LesRegex Flags and Modes
A flag changes how the whole pattern matches: case sensitivity, whether ^ and $ see lines, whether the dot crosses newlines, and whether whitespace in the pattern is ignored. The same regex can match completely different things depending on its flags, so knowing them prevents a lot of confusion.
LesSAML Bindings and SP vs IdP Initiation
A SAML flow can start at the service or at the identity provider, and the messages can travel by two different bindings: an HTTP redirect with the message packed into the URL, or an auto-submitting HTML form that POSTs it. Which binding carries which message, and where the flow begins, explains a lot of SSO behavior.
LesThe SAML Proxy: Inserting an Identity Layer into a Session
A SAML proxy sits in the SSO flow rather than the packet path: it terminates the user's request, forces authentication against an identity provider, and only then lets the session through, using SAML's browser-redirect model. It can act as a service provider to the IdP and an identity provider to the app at once (a proxy or broker), which is how one login federates many downstream systems. This explains the roles, the flow, and why it is a proxy at all.
LesReading OGNL in a WAF Log: What the Payload Was Trying to Do
An OGNL payload in a log has two halves worth telling apart: something that tries to switch off the expression sandbox, and something that tries to run a command. A payload with both is an exploitation attempt. A payload with only the second is usually a scanner working through a list. A payload with neither is a probe checking whether input gets evaluated at all - and that answer decides whether anything else in the list could ever work.
LesXXE and External Entities
XML lets a document declare entities, and an external entity can point at a file or URL. A parser that resolves one can be tricked into reading local files or making server-side requests, the XXE vulnerability. The fix is blunt and effective: do not process a DOCTYPE at all.
LesBillion Laughs and Entity Expansion
Entities can reference other entities, and if each one multiplies the last, a tiny document can expand to gigabytes and exhaust memory. The billion laughs attack weaponizes this into a denial of service. The defense is to cap expansion or refuse the DOCTYPE outright.
LesHow CVSS Scoring Works
CVSS turns a short vector string into a 0 to 10 severity number using a fixed formula. The Base score is built from two sub-scores: Exploitability (how reachable and easy the flaw is) and Impact (how bad the outcome is). Everything else refines that base. This is arithmetic, not opinion, which is why a calculator can reproduce any published score exactly.
LesThe CVSS Base Metrics, Explained
The Base score comes from eight metrics in two families. Four exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) describe how hard the attack is, and four impact metrics (Scope, plus Confidentiality, Integrity, Availability) describe the damage. Scope is the subtle one: it is what lets a score exceed the vulnerable component's own boundary.
LesCVSS Temporal and Environmental Scores
The Base score is only the starting point. Temporal metrics lower it as facts emerge, such as a patch being released, and can only reduce the score. Environmental metrics let an organization re-score the flaw for its own systems by raising or lowering the importance of confidentiality, integrity, and availability and by overriding base metrics. Both are optional but produce a more honest number.
LesReading a CVSS Vector String
A CVSS vector is a compact, self-describing string: a version prefix followed by slash-separated metric:value pairs. Learning to read it directly, rather than trusting a rendered score, lets you spot transcription errors and understand exactly what a vendor claimed. The Base metrics are mandatory and the rest are optional.
LesCVSS Severity Bands, and What the Score Does Not Tell You
The 0 to 10 number maps to five qualitative bands from None to Critical. That mapping is useful for triage, but a CVSS Base score measures severity, not risk. It says nothing about whether a flaw is being exploited, how valuable the asset is, or what controls you have. Treating the base number as a priority queue is the most common way teams misuse CVSS.
LesCVSS v3.0, v3.1, and v4.0: What Changed
This decoder computes CVSS v3.0 and v3.1. The two v3 releases share a formula but differ in rounding and one environmental term, so scores can differ by a tenth. CVSS v4.0, released in 2023, is a larger redesign with new metric groups and no Scope metric, and its vectors are not compatible with v3 tooling. CVSS v2 is retired.
LesPassive TLS Fingerprinting: JA3, GREASE, and the Churn That Led to JA4
A ClientHello announces the client in the clear, and the combination of versions, ciphers, and extensions is characteristic of the software that sent it. This covers how JA3 turns that into a hash, why GREASE has to be stripped, how extension-order randomization broke JA3 (the churn), how JA3N and JA4 restore stability, and where a TLS fingerprint fits as a signal for secure web gateways and adaptive authentication.
LesWhat Is Server-Side Request Forgery (SSRF)
SSRF is a vulnerability where an attacker makes a server issue an HTTP request to a destination of the attacker's choosing. Because the request originates inside the server's network, it can reach internal services, cloud metadata, and loopback addresses that the attacker could never reach directly. The fix is to validate the destination, not the URL string.
LesPrivate, Reserved, and Public IP Ranges
An SSRF filter has to know which addresses are internal. This is the map: RFC 1918 private space, loopback, link-local, carrier-grade NAT, the documentation ranges, and everything else that is public and routable. Knowing the ranges is what turns a raw address into a safe-or-not decision.
LesIP Address Obfuscation Tricks
One IP address can be written in many forms: plain decimal, octal, hexadecimal, short-hand, and IPv4-mapped IPv6. Each form parses back to the same address, which is how attackers slip an internal target past a filter that only blocks the dotted-decimal spelling. This is why SSRF checks must decode, not string-match.
LesCloud Metadata Endpoints and SSRF
Every major cloud gives an instance a metadata service at a fixed link-local address, and it can return temporary credentials for the instance's role. That makes it the single highest-value SSRF target. Knowing the endpoints, and the IMDSv2-style defenses, is essential for both attack understanding and defense.
LesDefending Against SSRF with Allow-Lists
The durable SSRF defense is an allow-list of intended destinations, combined with resolving the address before you trust it and re-checking after redirects. Block-lists of internal ranges help, but they lose to obfuscation and DNS rebinding. This is the layered approach that holds up.
LesDangerous URL Schemes in SSRF
SSRF is not limited to http. Schemes like file, gopher, dict, and ftp let an attacker read local files or craft raw bytes to internal services such as Redis and SMTP. A URL fetcher that does not restrict the scheme hands an attacker a far more powerful primitive than a plain web request.
LesSSL Forward Proxy: How Outbound TLS Interception Works and What Breaks It
To inspect encrypted outbound traffic, a forward proxy performs a controlled man-in-the-middle: it terminates the user's TLS session, opens its own to the real server, and forges a certificate for that server signed by a private CA the organization's own devices trust. This explains the mechanics, the trust model that makes it safe (and dangerous), and why pinning, HSTS, and mutual TLS defeat it.
LesThe LGPD for Engineers: The Vocabulary That Matters
Brazil's data protection law assigns you a role, gives you ten legal bases instead of one, and puts a three-working-day clock on breach notification. What controlador, operador, and encarregado mean when you are the one running the systems.
LesPassive Fingerprinting: What You Emit Without Being Asked
Every connection announces its stack before a byte of application data flows. How a TCP SYN, a User-Agent string, and the mere order of HTTP headers each identify a client - and why a mismatch between them is the classic proxy and bot tell.
LesCheck Point's Three-Tier Architecture: Management, Gateway, and SmartConsole
Check Point separates the place policy is written from the place it is enforced, and that split explains almost everything else about the platform: why you install policy rather than just save it, why SIC exists, and why a gateway keeps working when the management server is down.
LesCheck Point Administrators, Sessions, and Objects: Publish Is Not Install
Check Point gives every administrator a private working session, so your changes are invisible to colleagues until you publish and inert on the gateway until you install. Those are two separate actions and confusing them is the most common early mistake on the platform.
LesCheck Point Logging and Monitoring: Where Logs Go and How to Ask Them Questions
A log only exists if a rule was set to create it, and it only survives if a log server was there to receive it. Once both are true, the Logs and Monitor view is a query interface rather than a list, and learning to ask it questions is the difference between finding an answer in seconds and scrolling.
LesCheck Point Identity Awareness: Writing Rules About People Instead of Addresses
Identity Awareness lets a rule say who rather than where. The gateway has to learn the user-to-address mapping from somewhere, and which source you choose decides how quickly identities appear, how accurate they stay, and what happens when someone changes desk.
LesCheck Point HTTPS Inspection, Application Control, and URL Filtering
Most traffic is encrypted, so the controls that decide which applications and sites are permitted can only see what the handshake reveals unless the gateway decrypts. HTTPS Inspection is what makes the rest work fully, and it is also the feature most likely to break something on the day you enable it.
LesCheck Point Threat Prevention: The Blades, Profiles, and Prevent Versus Detect
Threat Prevention is several engines under one policy, each catching a different stage of an attack. The setting that matters most is not which engines are on but whether each is preventing or only detecting, because that single choice decides whether you have protection or a report.
LesCheck Point Management High Availability: Active, Standby, and Why Failover Is Manual
A second management server protects the database, not the traffic. Gateways keep enforcing whatever happens to management, so what you are buying is the ability to keep changing policy — and the synchronisation status is the thing that tells you whether you actually have it.
LesCheck Point Site-to-Site VPN: Communities, Encryption Domains, and Why the Tunnel Is Empty
A Check Point VPN is built from communities rather than individual tunnel definitions, which is what makes many sites manageable. The recurring fault is not that the tunnel fails to establish but that it establishes and carries nothing, and that almost always traces to the encryption domain or to NAT.
LesCheck Point SmartEvent and the Compliance Blade: Turning Logs into Events Worth Reading
SmartEvent correlates logs into events so that a hundred related entries become one thing a person acts on. The Compliance Blade audits the configuration itself against best practice. Both are only as useful as the tuning, and an untuned SmartEvent is a second place to ignore alerts.
LesCheck Point Upgrades and Migrations: Order, Compatibility, and Getting the Database Out
Upgrade order is not a preference: management goes first, because a management server can manage older gateways and an older management server cannot manage newer ones. Migration is a different operation from upgrading, and the thing being moved is the database rather than the machine.
LesCheck Point ElasticXL: One Cluster Object, Many Members
ElasticXL is Check Point's newer clustering approach, built so that a cluster is configured and managed as a single entity rather than as members that each need attention. The operational argument is that adding capacity should not mean repeating configuration.
LesHow a Proxy Knows Who You Are: User Authentication Methods Inline
Policy per user is the whole promise of an inline proxy - which means the proxy must attach an identity to every flow, including the ones that cannot log in. The four working patterns: explicit 407 challenges, cookie-based web authentication, agent-asserted identity, and the surrogate-IP compromise - plus where each one breaks, because every one of them breaks somewhere.
LesData Loss Prevention: How Machines Recognize Secrets
Every DLP product answers the same question - is this outbound content sensitive? - with the same four instruments: patterns, dictionaries, exact data matching against fingerprinted records, and indexed document matching against fingerprinted files. What each instrument can and cannot recognize, why confidence scores and proximity exist, and why the hard part of DLP was never the matching.
LesSandbox Detonation: Judging a File by What It Does
Signatures recognize malware that has been seen; a sandbox convicts malware that has not - by running the file in an instrumented cage and watching its behavior. What detonation actually observes, why verdicts take minutes, the patient-zero window that timing creates, how hash sharing turns one verdict into everyone's protection, and the evasion arms race that keeps cage-builders employed.
LesBrowser Isolation: When You Cannot Trust the Page, Move the Browser
Remote Browser Isolation stops asking whether a page is safe and removes the question: the real browser runs in a disposable cloud container, and the endpoint receives only a rendered projection - pixels or a reconstructed DOM. What each rendering mode trades, why isolation is the answer for the uncategorizable middle, what it costs, and where its honest limits sit.
LesCORS Explained: The Border Control of the Browser
CORS is the most misunderstood error message in web development, because it punishes the wrong mental model. It is not a wall - the same-origin policy is the wall; CORS is the door: a header protocol by which a server volunteers 'that other origin may read my responses.' Simple requests vs preflights, what OPTIONS is doing in your network tab, why credentials tighten every rule, why '*' is not the fix, and why CORS never protected the server in the first place.
LesLDAP search filters: reading the parentheses
Every directory query - PingDirectory, Active Directory, any LDAP server - comes down to one filter string in prefix notation. How to read it: the operators, the six match types, the escapes, the famous AD bit-filter OIDs, and why an unindexed filter can take down a directory.
LesOAuth flows: choosing the grant in 2026
One decision starts every integration: which flow. The modern answer is short - authorization code + PKCE for humans, client credentials for machines, the device grant for TVs - and the reasons implicit and ROPC died are worth knowing by heart. RFC 9700 finally wrote it all down.
LesMemory safety: the bug classes and the defenses that answer them
Buffer overflow, use-after-free, null dereference, integer overflow - four names for two failures, staying inside an object and only touching it while it is alive. How each one works, why roughly seventy percent of serious vulnerabilities in large C and C++ codebases belong to this family, and what each defensive layer actually buys.
LesTor: how onion routing actually works, and what it does not protect
Onion routing was invented at a US Navy lab, and that paradox is the key to understanding it: anonymity only works if the crowd is diverse. How a three-hop circuit is built, what onion services really are, the threat model Tor openly admits it loses to, and why most Tor traffic never touches the dark web at all.
LesDNS blocklists: RPZ, ratings, and what a refused answer costs
Blocking a domain at the resolver is the cheapest security control there is, which is why every vendor sells one. How RPZ feeds work, what a vendor DNS rating actually rates, the two failure modes nobody plans for, and why the block you cannot see is worse than the one you can.
Les