blog.includesecurity.com resources

blog.includesecurity.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-09-01.

AI 3 Talks 2 AuthZ 1 Fuzzing 1 Mobile 1 OSINT 1 SSRF 1 XSS 1

Date Added	Resource	Excerpt
2026-09-01 2026	EncryptedSharedPreferences is Dead: Here’s What You Should Use Instead Mobile	Library for secure Android data storage. It addresses the deprecation of EncryptedSharedPreferences and Jetpack Security Crypto, recommending developers instead use Jetpack DataStore paired with Google Tink for direct cryptographic operations. This approach provides greater control and visibility into data transformation and storage, overcoming inconsistencies previously seen with EncryptedSharedPreferences and the Android Keystore.
2026-08-17 2026	The AWS Console and Terraform Security Gap AuthZ	Library for identifying security gaps between AWS Console defaults and Terraform-provisioned resources. It details common misconfigurations such as unencrypted RDS instances, vulnerable Lambda resource-based policies leading to "Confused Deputy" vulnerabilities, and unintended AWS IAM password policy resets. The library highlights how Terraform's AWS provider often inherits legacy API defaults, creating weaker security postures than console-created resources, and contrasts this with more secure defaults in Azure and GCP.
2026-08-17 2026	CTFs in the AI Era AI Talks	Library for application security professionals analyzing the impact of LLMs on CTF competitions. The resource details how advanced models like Claude Opus 4.6 and GPT-5.4-mini are automating challenges at events such as BSidesSF 2026 CTF, leading to rapid solves and full automation. It contrasts CTF methodologies with professional penetration testing, emphasizing that while LLMs excel at specific tasks, human expertise remains crucial for navigating complex systems, verifying findings, and understanding business context in real-world security assessments.
2026-08-17 2026	The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy AI OSINT	Library for analyzing Bright Data's residential proxy network, which utilizes an SDK embedded in consumer applications to turn devices like smart TVs into exit nodes for web scraping. This library details how the SDK functions, its integration with partner apps such as Petflix and PlayWorks, and the implications for users whose devices contribute to AI data collection without full awareness, highlighting the shift from datacenter-based scraping to utilizing residential IP addresses.
2026-08-17 2026	Web App Pentesting in the AI Era AI Talks	Library for AI-assisted web application security testing, detailing practical experiences with frontier and local models. This resource breaks down AI systems into models, inference engines, and harnesses, and explores their capabilities for vulnerability discovery. It highlights the importance of a three-way alignment between model, harness, and task, emphasizing that even advanced AI output requires human review for accuracy. The entry discusses building a simple harness to improve thoroughness and validation, advocating for execution-grounded proofs-of-concept over AI-generated reasoning, and notes the rapid evolution of AI tools in the cybersecurity landscape.
2026-04-03 2026	Coverage Guided Fuzzing - Extending Instrumentation to Hunt Down Bugs Faster Fuzzing	Library extending coverage-guided fuzzing instrumentation. This resource details modifying Fuzzilli's instrumentation for JerryScript to incorporate return addresses and symbolization of program counters, enhancing bug hunting beyond simple edge coverage. It leverages Clang's sanitizers, specifically `__sanitizer_cov_trace_pc_guard` and `__builtin_return_address`, to extract richer execution data for more effective vulnerability discovery in complex software.
2025-08-14 2025	Mitigating SSRF in 2023 SSRF	Library for understanding and mitigating Server-Side Request Forgery (SSRF) vulnerabilities. It highlights common SSRF attack vectors, exemplified by Python Flask applications, and details the ineffectiveness of incomplete allowlisting and blocklisting techniques, including bypasses via URL parsing tricks, DNS resolution variations, and time-of-check to time-of-use (TOCTTOU) flaws like HTTP redirects and DNS rebinding.
2025-04-23 2025	Cross-Site WebSocket Hijacking Exploitation in 2025 - Include Security Research Blog XSS	Analysis of Cross-Site WebSocket Hijacking (CSWSH) exploitation, detailing how browser security improvements like Third Party Cookie Restrictions, Private Network Access, SameSite=Lax by default, and Firefox's Total Cookie Protection increasingly limit its effectiveness. It recaps CSWSH prerequisites, including cookie-based authentication with SameSite=None and missing Origin validation on WebSocket servers, and explores how these mitigations impact exploitability through case studies.