blog.includesecurity.com resources

blog.includesecurity.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-17.

AI 3 Talks 2 AuthZ 1 Fuzzing 1 OSINT 1 SSRF 1 XSS 1

Date Added	Resource	Excerpt
2026-08-17 2026	The AWS Console and Terraform Security Gap AuthZ	Terraform's default AWS configuration settings can inadvertently create vulnerabilities, differing from the security practices typically followed when using the AWS Console. This divergence highlights a security gap between infrastructure-as-code provisioning via Terraform and manual AWS UI creation. The post explores this growing disparity in AWS asset security settings.
2026-08-17 2026	CTFs in the AI Era AI Talks	At BSides 2026, Include Security witnessed AI's growing impact on CTF competitions. Winning strategies now emphasize speed and orchestration, leveraging lighter models for simple tasks and powerful AI for complex reasoning. This shift reflects AI's increasing effectiveness in solving diverse CTF challenges.
2026-08-17 2026	The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy AI OSINT	BrightData's SDK transforms smart TVs into proxy network nodes, enabling large-scale web scraping for AI and language model training. This technology effectively leverages consumer devices for commercial data collection within the "AI scraping economy."
2026-08-17 2026	Web App Pentesting in the AI Era AI Talks	The IncludeSec team investigated AI's role in web application penetration testing, specifically focusing on source code analysis. They compared frontier and locally-hosted AI models, explored different orchestration designs, and analyzed various language frameworks. Their findings suggest AI can enhance pentester results by improving quality, though it doesn't necessarily decrease time spent. The study offers practical insights for modern pentesters integrating AI into their workflows.
2026-04-03 2026	Coverage Guided Fuzzing - Extending Instrumentation to Hunt Down Bugs Faster Fuzzing	Library extending coverage-guided fuzzing instrumentation. This resource details modifying Fuzzilli's instrumentation for JerryScript to incorporate return addresses and symbolization of program counters, enhancing bug hunting beyond simple edge coverage. It leverages Clang's sanitizers, specifically `__sanitizer_cov_trace_pc_guard` and `__builtin_return_address`, to extract richer execution data for more effective vulnerability discovery in complex software.
2025-08-14 2025	Mitigating SSRF in 2023 SSRF	Library for understanding and mitigating Server-Side Request Forgery (SSRF) vulnerabilities. It highlights common SSRF attack vectors, exemplified by Python Flask applications, and details the ineffectiveness of incomplete allowlisting and blocklisting techniques, including bypasses via URL parsing tricks, DNS resolution variations, and time-of-check to time-of-use (TOCTTOU) flaws like HTTP redirects and DNS rebinding.
2025-04-23 2025	Cross-Site WebSocket Hijacking Exploitation in 2025 - Include Security Research Blog XSS	Analysis of Cross-Site WebSocket Hijacking (CSWSH) exploitation, detailing how browser security improvements like Third Party Cookie Restrictions, Private Network Access, SameSite=Lax by default, and Firefox's Total Cookie Protection increasingly limit its effectiveness. It recaps CSWSH prerequisites, including cookie-based authentication with SameSite=None and missing Origin validation on WebSocket servers, and explores how these mitigations impact exploitability through case studies.