Security/OWASP: Guides and Practical Know-how | Page 17 | mironsoft Blog
Security/OWASP
-
-
Jun 11, 2025
SQL injection has been one of the most dangerous vulnerabilities in web applications for years, letting attackers read, alter or delete entire databases through manipulated input fields. This article explains the mechanics of classic and blind SQL injection, shows why escaping alone is not enough, and delivers practical solutions with prepared statements, safe ORM patterns and the Magento ResourceConnection API.
-
Jun 10, 2025
A rate limit keyed on IP address sounds like solid protection against brute force and API abuse, yet attackers routinely bypass it through IP rotation, distributed botnets and forged headers. We walk through the common bypass techniques and the more robust countermeasures that key on user accounts instead of raw IP addresses.
-
Jun 8, 2025
Multipart uploads in GraphQL are technically possible, but in practice they cause more problems than they solve. Anyone uploading files through GraphQL ends up fighting proxies, body size limits, missing caching, and resolvers that are hard to test. This article explains where the real limits lie and how presigned URLs solve the problem more elegantly.
-
Jun 5, 2025
A publicly reachable API without rate limiting is an open invitation for brute force attacks, credential stuffing and automated data scraping. The Symfony Rate Limiter offers three different algorithms, Token Bucket, Sliding Window and Fixed Window, and can be integrated into any controller, service or event listener within minutes.
-
Jun 4, 2025
A plain docker login stores credentials by default in plaintext in ~/.docker/config.json, readable by any process with file access. Credential helpers solve this by delegating passwords to a secure keystore, both locally and in CI pipelines.
-
Jun 4, 2025
curl -fsSL https://install.example.com | bash installs in a single line, but runs code with the calling user's full privileges before anyone has actually looked at it. Understanding exactly what risks this pattern brings makes it possible to substantially harden it with a few extra steps, without giving up all the convenience for end users.
-
May 31, 2025
Deployment scripts in practice often run with far more privileges than needed, usually because a blanket sudo grant feels more convenient than a precise rule. Taking least privilege seriously means writing targeted sudoers entries per script and skipping the SUID bit on shell scripts, which modern Linux kernels ignore for good reason.
-
May 28, 2025
XML parsers with external entity processing enabled can be abused for file disclosure or SSRF. We explain how XXE works, why many modern libraries disable it by default today, and how to explicitly harden DOMDocument in PHP.
-
May 26, 2025
Bash history is often the first data source an administrator checks after a security incident. Configured correctly with HISTFILE, HISTSIZE and HISTTIMEFORMAT, it provides a timeline of executed commands. But relying on it alone overlooks that any user with shell access can clear or manipulate their own history at any time, which is why auditd belongs in every serious hardening effort as an independent complement.