Doyensec

We're excited to celebrate an important milestone for two of our teammates, Matei Buzdea and Luca Molteni, as they transition from interns to full-time security consultants! 🎉 From day one, they've demonstrated curiosity, technical skill, and a passion for application security. Throughout their internships, they've contributed to client engagements, collaborated with our team, and continued to grow as security professionals. Investing in talented people and helping them develop into exceptional consultants is something we're proud of. We can't wait to see what they'll accomplish in this next chapter. Congratulations on making it official, we're excited to have you both on the team full time! 🚀 #ApplicationSecurity #AppSec #PenTesting #CyberSecurity #CareerGrowth #internships #doyensec #security

The @doyensec@infosec.exchange team had an amazing time at our latest retreat in 🇵🇹 Porto Portugal 🇵🇹! The Festa de São João 🔨was a blast, along with kayaking, a vineyard tour and wine tasting, a vibe coding hackathon and getting to spend time with a great group of people! We can't wait for the next one!! #doyensec #appsec #security

Hey pentesters📢, make your lives easier by using maSSO - a weaponized SSO Identity Provider for security testing of OIDC & SAML 2.0 Service Providers. The IdP your target trusts - that you fully control. Intercept, edit, re-sign. 👇 http://github.com/doyensec/maSSO #doyensec #appsec #security

Hey pentesters 📢, maSSO just leveled up: Duo Mode & Signer Tab have landed. Duo Mode: spin up two fully independent IdPs, manage from one dashboard. Does your target's SP actually keep "Org A" and "Org B" apart, or does a token from one slide right into the other? Now you can bring up the malicious IdPs in one command. Signer Tab: craft, sign, and verify JWTs or SAML assertions on demand, no active auth flow required. Prep test payloads and prove SP signature checks actually work before you ever replay anything. Same IdP your target trusts, now with two identities and a forge on tap. 👇 https://github.com/doyensec/maSSO https://youtu.be/cHwUKgk2LQ8

🇫🇷 Un petit bug with a big impact.

A vulnerability reported by Doyensec's French team members in Electron's shell.openPath() has now been patched. Apps relying on string-only path validation could be tricked into opening a different file via an embedded null byte.

Merci to the Electron maintainers for the quick fix.

https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx

#doyensec #appsec #security #electron #electronjs

"You don't need pentesters anymore." - Every hype cycle, ever. While the AI debate continues in Vegas, we'll be busy finding the bugs it missed and proving which "findings" were never vulnerabilities in the first place. Happy Black Hat & DEF CON! #BlackHat #DEFCON #AppSec #AI #CyberSecurity #HackerSummerCamp #doyensec #security