What is vulnerability scanning and how do web vulnerability scanners work?

Fri, 24 Jan 2025

Vulnerability scanning is a fundamental cybersecurity practice for automating security testing. Especially in application security, it’s crucial to have a good vulnerability scanner that can automatically probe your app and API attack surface for security weaknesses and help your teams plug any identified vulnerabilities before they turn into data breaches or worse.

Leverage Browser Security Features to Secure Your Website

Tue, 14 Aug 2018

What the Reddit Hack Teaches Us About Web Security

Tue, 14 Aug 2018

State of Security for Open Source Web Applications 2018

Thu, 09 Aug 2018

Exploiting a Microsoft Edge Vulnerability to Steal Files

Wed, 01 Aug 2018

This blog post documents our Security Researcher Ziyahan Albeniz’s experiment in exploiting a Microsoft Edge browser vulnerability. He explains how a combination of SOP, the ability to email clickable links and a vulnerability in both the Windows Mail and Calendar applications actually enable the exploit. It includes his Proof of Exploit video.

Ferruh Explains Why Web Application Security Automation is a Must in Enterprises

Wed, 25 Jul 2018

Watch episode #98 of Enterprise Security Weekly, in which Ferruh Mavituna, our CEO, talks about penetration testing versus dynamic scanning tools, such as Netsparker; the differences between Waterfall and Agile methodologies; addressing vulnerabilities early in the SDLC; static integration; accuracy and trust; bug bounties; and workflow management.

What is an osquery Injection and How Does it Work?

Thu, 19 Jul 2018

Server-Side Template Injection Introduction & Example

Thu, 12 Jul 2018

This article introduces Server Side Templates and explains why and how they can be susceptible to Server-Side Template Injection vulnerabilities. It includes examples of HTML, PHP and CSS code and concludes with a list of recommendations on how to protect your web applications from attacks that exploit SSTI vulnerabilities.

Type Juggling Authentication Bypass Vulnerability in CMS Made Simple

Mon, 09 Jul 2018

Our researcher, Sven Morgenroth, explains how he found an Authentication Bypass in CMS Made Simple, what PHP Type Juggling is, and why you should never use the unserialize function together with user-supplied input.

Ferruh Mavituna Talks About Security in the SDLC on Paul’s Security Weekly Podcast

Thu, 17 May 2018

Watch episode #557 of Enterprise Security Weekly in which Ferruh Mavituna, Netsparker’s Founder and CEO, talks about the vital role of dynamic web application testing within the Software Development Life Cycle, the benefits and challenges of an early security focus, and Netsparker’s automation and integration facilities.

How you can steal private data through CSS injection

Fri, 09 Aug 2019

Introducing the Same-origin Policy Whitepaper

Fri, 06 Apr 2018

This blog post outlines the contents of our Same-origin Policy Whitepaper: The Definitive Guide to Same-origin Policy. It includes a discussion of SOP misconceptions and implementations. It is jointly by Alex Baker, an independent Security Researcher, together with Ziyahan Albeniz and Emre Iyidogan, two of Netsparker’s Security Researchers.