Security - Yarsa Labs DevBlog

XZ Utils Backdoor: Impact, Exploit Details, and Mitigation

Discover the impact, exploit details, and mitigation strategies of XZ backdoor (CVE-2024-3094). Uncover the timeline, exposure, and lessons learned from this supply chain attack

The Perils of Storing Passwords in Databases: A Security Nightmare

Enhance your database security with password storage methods like plain text, encryption, hashing, and more. protect your data!

Web Attack Surface Monitoring System: A Step-by-Step Tutorial

Set up a simple asset monitoring system leveraging open-source applications.

Testing JWT for Security Misconfigurations

JSON Web Tokens (JWTs) are frequently used as authentication or session, so it is very important to ensure their correct implementation. Some of the ways to check for misconfiguration are listed in this blog.

Journey to OSCP | My Experience

Experience my challenging yet fulfilling journey through the OSCP certification process and its impact on my career in infosec.

Identifying and Avoiding Phishing Attacks

Deceiving people on the internet can be easy when you can pose as a legitimate source. Phishing is an internet threat as such. So, to be safe, I have pointed out the common red flags to look out for and some security tips on how to stay safe from phishing attacks.

Why You Shouldn't Install APKs From Unknown Sources

Before you download and use an APK from a third-party site other than the Google Play Store, consider this: Am I putting myself at risk?

Tshark Basics: Part 2

In this second part of the multi-part article, we will go through the functionality of Tshark for doing basic network forensics.

Opinion: Avoid Using Public WiFi

Public WiFi is convenient. But it is also dangerous. Here's how your data could be compromised and how you can try to prevent it.

Why Security is Hard

Today, technology has made hacking a lot easier. However, it is the responsibility of the user to secure their own devices.

Misdirection Walkthrough

Misdirection is a machine that serves as a practice tool for OSCP students. Today, we will go over a simple method of exploiting a debug feature of a web application to gain root access.

How to Secure Your Windows 10 Device

Windows machines can be very vulnerable if they are not configured properly. Today, we will learn the best ways to secure your Windows 10 devices.

Configuring Burp Suite with Android Emulators

Using the Burp Suite Proxy and an Android Emulator, you can quickly monitor an app's requests and see what packets are being sent to and from the device.

Tshark Basics

Tshark is a terminal-based tool that is used to analyze network data on your computer. Let's go over the basics of its different commands and filters in this blog post.

The CIA Triad: An Explanation

CIA stands for Confidentiality, Integrity, and Availability. These three components make up the CIA Triad - a widely accepted model for information security.

Introduction to Using OSINT

Today I will show you how you can track your digital footprint and find if your data is available online using Open Source Intelligence, or OSINT.

Cross Compiling C Code for Linux

Cross-compiling comes in handy when compiling applications or exploits for a machine with a different architecture than your host machine.

File Transfer Methodologies

Today I will list out file-transfer methodologies present in Linux and Windows and how you can use them.

VulnHub - DevGuru: 1 Walkthrough

In this walkthrough, we will be solving a boot2root machine called DevGuru from VulnHub.

Facebook Phishing using EvilGinx

In this day and age, Phishing is a common occurrence that can be easily accessed by anyone. This educational article shows how easy it is to use EvilGinx to create a Facebook Phishing site and gives a cautionary tale about Phishing.

Getting Started on Cyber Security in Nepal

In the context of Nepal, we have a misconception of connecting every dots of cyber security and social engineering to cracking local wifi passwords, gaining unwanted access to someone's Facebook account or hopeless brute-forcing.