Penetration Testing
A Unique Model: In–Depth Knowledge,
Personal & Tailor-Made Approach
Hacking Training
Practical, hands-on, Lab-based
Live online training
Blog
-
WhitePaper Release: Defense against Client-Side Attacks
-
Tool Release: Serialized Payload Generator
-
Project Launch : Tracking Browser Security Enhancements
-
Flutter based Mac OSX Thick Client SSL Pinning Bypass
-
Let’s Cook ‘Compliance as Code’ with Chef InSpec
-
Security Architecture Review Of A Cloud Native Environment
-
Semgrep A Practical Introduction
-
Continuous Security Monitoring using ModSecurity & ELK
-
Exploiting VLAN Double Tagging
-
Automating Pentests for Applications with Integrity Checks using Burp Suite Custom Extension
-
Hacking AWS Cognito Misconfigurations
-
Cloud Services Enumeration – AWS, Azure and GCP
-
SQL Injection Lab
-
Identifying & Exploiting Leaked Azure Storage Keys
-
Achieving DevSecOps using AWS Cloud Native Services
-
Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net
-
Achieving DevSecOps with Open-Source Tools
-
Exploiting SSRF in AWS Elastic Beanstalk
-
Hunting the Delegation Access
-
Project Blacklist3r
-
Out of Band Exploitation (OOB) CheatSheet
-
NotSoSecure joins the Claranet Group
-
Data Exfiltration via Formula Injection #Part1
-
Analyzing CVE-2018-6376 – Joomla!, Second Order SQL Injection
-
Anatomy of a Hack: SQLi to Enterprise Admin
-
Vulnerable Docker VM
-
Instrumenting Native Android Functions using Frida
-
Maximum Password Length Reached!
-
One Rule to Rule Them All
-
Pwning with Responder – A Pentester’s Guide
-
MS17-010, the new MS08-067?
-
Anatomy of a Hack: SQLi via Crypto
-
Anatomy of a hack: Docker Registry
-
Pentesting Android Apps Using Frida
-
Active Directory Delegation and Manual Analysis
-
Hacking Crypto For Fun and Profit
-
Crafting your way through JSON Web Tokens
-
Bypassing Jailbreak Detection in iOS
-
ICMP Tunnels – A Case Study
-
Remote code execution via PHP [Unserialize]
-
How Cross-Site WebSocket Hijacking could lead to full Session Compromise
-
Malware Analysis
-
Abusing Oracle's CREATE DATABASE LINK privilege for fun and profit!
-
Pentesting Web Service with anti CSRF token using BurpPro
-
SqliLab CTF, Wrap Up!
-
Oracle Hacks Added to SQLi Lab
-
Hacking Oracle XE from Web
-
Penetration Testing: The Art or The Science?
-
Pwning Postgres 9.1
-
The Art of Exploiting Injection Flaws@Black hat Vegas 2013
-
A Collaboration worth mentioning..
-
What to/not to expect from pentest
-
Black Hat Eu 2012
-
Hacking Oracle From Web: Part 2
-
LDAP/XPATH Injection tools
-
APPSECUSA CTF! Another Write Up
-
BSQLBF v 2.7
-
Upcoming Conferences
-
Oracle CPU Jan 2011
-
Magento E-commerce Persistent XSS
-
Oracle CPU:October 2010
-
LFI..Code Exec..Remote Root!
-
Blackhat 2010
-
bsqlbf v 2.6
-
mysql exploitation with error messages
-
Blackhat, Defcon 2010
-
Infosec 2010
-
bsqlbf v2.5
-
Metasploit Oracle Windows
-
Hacking Oracle 11g
-
Local File Inclusion with Magic_quotes_gpc enabled
-
Open Redirection
-
Twitter
-
IIS 0 day vulnerability in parsing files
-
Exploiting Web Apps With Commerical Tools
-
PHP exploitation with Stefen Esser
-
Hacking JBoss with JMX Console
-
Oracle Security Training(s)
-
DBMS_DEFER_SYS; CVE-2008-2592
-
More on True And Error Blind Sql Injection
-
Bsqlbf v2.4
-
More on injecting PL/SQL from SQL Injections
-
Defcon 17 Slides, Demos and Tools
-
Bsqlbf in Action
-
Oracle SYS.LT.COMPRESSWORKSPACETREE Exploit
-
Defcon 17: See you there
-
Bsqlbf v 2.3 With Enhanced Oracle Exploitation
-
More On Oracle O.S command execution
-
Oracle O.S command execution through web apps
-
Oracle privilege escalations from web app
-
Troopers 09
-
Slides From OWASP Au 2009
-
Bsqlbf v2.2
-
My SQL Exfiltrating Data Over Out Of Band Channels(OOB)
-
SQL Injection & The Friendly Error Messages
-
MS-SQL [2000&2005] User Enumeration Via sp_who
-
OWASP Australia 2009
-
IIS Users Who's Who
-
Truecrypt running as sudo
-
MySql Stored Procedures And Functions
Hacking Training Classes
Lab-Based Training - Written by BlackHat Trainers - Available Globally
NotSoSecure classes are ideal for those preparing for CREST CCT (ICE), CREST CCT (ACE), CHECK (CTL), TIGER SST and other similar industry certifications, as well as those who perform Penetration Testing on infrastructure / web applications as a day job & wish to add to their existing skill set.
NotSoSecure Training Journey:
Beginner Friendly
Hacking 101
The Art of Hacking
2020 Edition
The Art of Hacking
2020 Edition
Infrastructure Hacking
2020 Edition
Web Hacking
Specialist Offensive Classes
2020 Edition
Advanced Infrastructure Hacking
2020 Edition
Advanced Web Hacking
NEW
Hacking and Securing Cloud Infrastructure
Specialist Defence Classes
2020 Edition
AppSec for Developers
NEW
DevSecOps
NEW
