Owasp Long Sleeve T-Shirts

Cool design for ethical hackers :) | Perfect for T-shirts, hoodies, mugs, stickers etc!

The Open Web Application Security Project is an online community that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.

For me, Dinosaurs reminds me of the time. The time they lived in and the time we are currently living in. There is a gap between those two, right? A TimeGap? Well, that's the theory!

The CAPTCHA is annoying for us as humans, but it could be a great way to stop automatic attacks or bots like brute force, CSRF or even XSS attacks.

When dealing with multithreading applications, it is important to make a copy of the input mutable object before processing it to avoid race conditions.

The helmet.js should be the minimum security requirement for node.js express applications. By doing so, developers can provide protection to the web application with the necessary secure http headers. This is a dark background with white letters design version.

A design about the the common weakness enumeration 20 also known as improper input validation. If user input is not properly escaped, sanitised and validated then the attackers can perform DoS, RCE or even tamper the information.

A shield design of the input validation steps that developers should do in the methods or functions that manipulates untrusted data. This is one of the best practice of OWASP for secure coding.

Fuzzing is an important testing to be done on running applications because it can catch flaws that static analysis can't like buffer overflows or memory corruption. This is a black background with white letters design version.

A funny design to concern developers that the usage of eval() to process or parse untrusted data could let attackers to inject code to run.

In case that x-powered-by header is delivered by your service, override it with misleading information to make attackers life harder like "Not Your Business 1.0"

Fuzzing is an important testing to be done on running applications because it can catch flaws that static analysis can't like buffer overflows or memory corruption.

To protect from file upload attacks on your website that could leave attackers to upload malicious software or backdoors, here's some of the protections to prevent such attacks.

One of the best practices stated in OWASP is to allow only to use local static DTD when processing XML to avoid XXE attacks.

This should be the input validation steps that the code must do to avoid processing harmful untrusted data.

Want to avoid the undesired clickjacking attack on your website? Then X-Frame-Options should be one of the headers to respond with sameorigin value. Or you can make it even more restrictive with deny. The result is avoiding any eventual attacker to use hidden frames to compromise the website user. This is a black background with white letters design version.

Esto es un diseño recordatorio a los desarrolladores para que eviten mostrar por pantalla errores que puedan dar pistas de cómo funciona la aplicación o revelar más información de lo preciso. En cualquier caso, hay que escribirlos en ficheros de logs.

HTTPOnly flag for cookies should be a must. This avoids other unwanted usages of cookies from your browser like scripts and only restricts its usage for HTTP.

OWASP is a foundation that provides trainings, guidelines and useful tools for cybersecurity professionals to make the internet a safe place. This is a black background with white letters design version.

A cool and funny way to remind one of the OWASP guidelines, the A3:2021. This design will guide your developers to follow the best practices to avoid Injections on code no matter it is LDAP, XML, SQL, Command and so on.

A design made for providing guidance to CSRF attack prevention. If it is not prevented adequately, it may leave attackers to trigger undesired actions from victims' browser like performing inadvertent transactions on your website.

Here's a cheat sheet like design to remind some of the secure coding measures to prevent all kind XSS attacks: Reflective, Stored or DOM based. Failing to do so, will imply code execution on victim's browser when visiting your site.

This should be the input validation steps that the code must do to avoid processing harmful untrusted data.

DevSecOps is an approach to software development that integrates security into the DevOps process, with the goal of delivering secure, high-quality software at a faster pace. A minimalist DevSecOps design would involve a streamlined, focused approach to security, with an emphasis on simplicity and efficiency. This is a design version with black background.

The Open Systems Interconnection model is a conceptual model that characterises and standardises the communication functions of a telecommunication or computing system without regard to its underlying internal structure and technology

This is one of the best practice which is a must when developing any web server that provides cookies. With the secure flag assigned on cookies, it will only be transferred through HTTPS.

In case that x-powered-by header is delivered by your service, override it with misleading information to make attackers life harder like "Not Your Business 1.0". This is a black background with white letters design.

Normally, any authentication through a website is done through HTTP POST method since a form is needed with login information. This could minimise the risk of disclosing the credentials when your browser stores the URL in plan text or even being written in logs on the server side.

HSTS is a must when it comes to securing web application HTTPS connections. So, if there is no HSTS header, no deal.

Never forget to handle a potential exception thrower code to avoid any undesired web application status. Run the code within a try and process the error on the catch section.

Any input that is controllable by the user is susceptible of being manipulated and turn it as an evil payload for remote code execution on the victim server.

Kind secure coding advice for developers to ensure that the content security policy header is used on http responses and mitigate XSS attacks on users visiting your website. This is a black background with white letters design version.

A design version with white letters and black background, This is a reminder for developers to replace any print used for debugging purposes with logger to write them in files.

A design about the the common weakness enumeration 89 represented in an iconic way. Good for secure coding guideline and awareness to avoid being vulnerable to sql injection attacks.

The helmet.js should be the minimum security requirement for node.js express applications. By doing so, developers can provide protection to the web application with the necessary secure http headers.

Developers are under great pressure with aggressive delivering dates but, one of the most important things that they shouldn't overlook, is to applying input validation in the functions or methods.