The Great SSL Certificate Panic
submitted by /u/digicat [link] [comments]
Articles tagged with: #ssl
Clear filter
What's the rationale for reporting security headers, cookie flags, etc. in pentests?
Why do penetration testing reports include findings like missing security headers, weak cookie flags, detailed error messages/stack traces, open directory listings, outdated JS libraries , lack of account lockout/rate limiting, or TLS/SSL weaknesses? What's the rationale behind reporting these issues - is it just best practice, compliance (e.g. OWASP, NIST), or because they are stepping stones for bigger attacks? Which academic references or testing methodologies support including them?...