Results for “javascript-security”

Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic.

Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation.

Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.

Audits HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Secure Laravel applications with best practices for authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and deployment configurations.

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.

Audits frontend codebases for security vulnerabilities and bad practices, covering XSS, CSRF, DOM issues, CSP, input validation, file uploads, and Node.js/NPM dependencies across web, React, Astro, Twig, Node.js, and Bun.

Hardens Django applications against common vulnerabilities with production settings, authentication, authorization, SQL injection and XSS prevention, and secure deployment configurations.

Secure Perl applications against injection, taint, and web vulnerabilities with validated patterns for input handling, file operations, process execution, and DBI queries.

Performs authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.

Hunt Client-Side Path Traversal vulnerabilities where attacker-controlled input is concatenated into the path of a fetch() or XHR request, enabling redirection and chaining to XSS or data exfiltration.

Performs a full-stack security posture assessment with 0-100 risk scoring, scanning dependencies, code patterns, configuration, and data handling, then produces a prioritized report and routes to specialized skills.

Guides authorized reverse engineering of Chrome and Firefox browser extensions, covering manifest analysis, background workers, and credential or traffic logic recovery.