A JavaScript bridge with no origin check and a navigation policy with no host allowlist — how two missing lines of code chain into silent account takeover on iOS and Android. Background: The WebView JavaScript Bridge Mobile applications often embed a WKWebView (iOS) or WebView (Android) to render hybrid content: onboarding
The AI phone assistant told us it had updated a customer account. It hadn't. During an AI agent pentest, we called the assistant twice using the same account number but two different names. Each time, it appeared to find an account, but the details changed depending on which
OWASP released the 2026 edition of its Top 10 for LLM Applications in August. There are some notable changes in the ranking, but from a penetration testing perspective, the bigger change is what sits behind the model now. LLM applications are increasingly connected to internal data, APIs, tools and business
AI assistants do more than answer questions now. A support chatbot can pull up a ticket, a finance assistant can fetch an invoice, and an internal tool can change a record on someone's behalf, all through tool calls the model asks your backend to run. The model itself
At least, not in the way you expect. Every year, we speak with organisations planning their first penetration test. The reason is usually familiar. A client has asked about security. The board has raised concerns. There has been an incident. Or the business has simply decided it's time
As organisations continue adopting AI, one challenge quickly emerges: how do you manage access to multiple large language models (LLMs) in a secure and controlled way? For many organisations, the answer is an LLM gateway. If you're unfamiliar with the term, think of an LLM gateway as a
On the 11th of March 2026, the Iranian aligned Handala Hack (Handala) group claimed responsibility for a disruptive cyberattack which affected the medical multinational corporation, Stryker. The X account, @DarkWebInformer shared a screenshot [1] with Handala's claims which stated they had wiped "200,000 systems, servers and
It's a single line of code - easy to miss in a review, and present in more Android apps than you'd expect: webView.addJavascriptInterface(new AppBridge(), "NativeApp"); When it's configured correctly, it's fine. When it isn't (and that happens
There's a particular kind of screen you'll find in control rooms, substations, and utility plants the world over. It shows a live schematic of whatever process the facility is running (e.g. pumps, valves, electrical loads) and operators use it to make things happen in the
Stay informed with our expert articles and practical advice. Subscribe to our blog today.
Okay, so a disclaimer upfront… setting up a self-hosted local Minecraft server didn’t actually teach me anything about business-to-business sales. I mean, you were expecting that, right? If so, great, we’re on the same page, if not, well apologies, but hopefully there’s some value
In a previous post, we discussed how AI-assisted analysis has become a useful tool in offensive security engagements. This article demonstrates that methodology in practice, showing how it accelerated our work during a recent web application and API penetration test. The combination of AI assistance and human expertise enabled
At SilentGrid, we rarely get called in for full-scale load testing - but recently, we had an urgent client request to validate system performance under high user activity. The goal: ensure the system could handle the influx of users expected in the first weeks of operation. This was a great
A Threat That Has Evolved Beyond Nation-State Actors In the late 1950s, the Soviet embassy in The Hague placed an order for office furniture from a local Dutch company. This was the height of the Cold War, and American intelligence agencies had recently discovered a sophisticated listening device concealed
During one of our red team engagements late last year, we were given a challenge: Once inside the building, could we access employee lockers? At first glance, this didn’t sound too exciting. But like many things in security, the small details often hide the biggest risks. The Setup From
The integration of artificial intelligence into offensive security practices represents a significant evolution in how cybersecurity assessments are conducted. Last year, we wrote about how AI wouldn't replace us human testers at SilentGrid Security, this year, we're taking a look at how AI has helped us
Maximising Value in Offensive Security Assessments: Why More Information Leads to Better Results When organisations engage offensive security firms like SilentGrid for adversary simulation or penetration testing, a common assumption emerges: the assessment should mirror real-world attack conditions as closely as possible. This often translates to providing minimal information
When we first unleashed VexBot at BSides Canberra 2024, the response was electric. Players loved the challenge of hunting down five flags hidden behind an AI agent's defenses. But here's the thing about cybersecurity folks: they're never satisfied with "good enough." So,
The cybersecurity landscape is approaching a fundamental shift. While quantum computers remain largely experimental today, their eventual capability to break current encryption methods represents a significant concern for organisations handling sensitive data. This article examines the nature of this challenge and what it means for business security planning. The Quantum
Another year, another BSides Canberra in the books, and honestly? We're still recovering (in the best possible way). SilentGrid returned as a gold sponsor, setting up shop in the hardware area with all the essentials: t-shirts, webcam covers, stickers, and enough snacks to fuel a small army
This article discusses the key principles and practical considerations for conducting adversary-driven social engineering engagements that prioritise realism over volume. Providing organisations with meaningful insights into their ability to detect, investigate, and contain sophisticated social engineering attacks. Before diving into the methodology, techniques and technical details, I want to
The humble mainframe is often mentioned in the same breath as the word “legacy”. When we consider the speed at which new technology emerges, it would be easy to assume that these systems should have quickly become extinct in the face of things like cloud, DevOps, and AI, let alone
