Hands-On Bug Hunting for Penetration Testers

Security by Obscurity – The Siren Song

The appeal—and trap—of security by obscurity is the ease with which strategies can be implemented, especially when compared to more rigorous credential management systems. Obscuring a piece of sensitive information just means scrambling it, rearranging and reordering it, until it looks like gibberish. Looks like is the operative phrase, since patterns can be detected outside the scope of human intuition or estimation.

The assumptions behind this sort of strategy invariably contain an element of human fallibility—someone couldn't find X, or trip across Y, because the odds are so stupendously against them, considering the scope of the application, the minimal nature of the vulnerability, and the implicitly ...