Pinned
If you've seen me present, you know I introduce myself as a follower of Jesus. Everyone has an opinion of what that means. Can I challenge you to watch this explanation? It's more important than anything I've ever said, and may surprise you.
Tim Tomes
@LaNMaSteR53
Believer † | Husband :-* | Father \o/ | Veteran o7 | PractiSec | "Burp Suite master and king of making HTTP requests tremble."
- Just submitted a talk titled "Web Application Authorization: Taming the Perfect Storm" to the @WWHackinFest CFP. I am particularly excited about this one. It's the first time I'll be sharing how I tackle authorization outside the classroom, plus a few extra goodies.
- Greetings! There are 2 training opportunities currently available on my events page at practisec.com/events/: * PWAPT beginning April 7th * PBAT beginning June 9th Bundle them and save $500!
- Just pulled this gem out of a client code base: "AESKey": "dsfsfdfgsdfsgfdg", I guess their version of a cryptographically secure RNG is to smash the 4 main fingers of their left hand on the keyboard 4 times.
- This is real code I am working with today. This is an authorization check protecting admin-only resources. There are multiple ways to bypass this. What are they? For additional context, this is middleware for an Express.js back end.
