Rorot

Rorot (@rorot333) is an Information Security Professional with 5.5 years of experience in Penetration testing & Vulnerability assessments of web and mobile applications. He is currently a security researcher at Infosec Institute. Twitter: @rorot333 Email: rorot33@gmail.com

Articles from Rorot

What is an XXE attack?

May 15, 2018

XXE (XML External Entity attack) is now increasingly being found and reported in major web applications such as Facebook, PayPal, etc. For instance, a quick

Learn More

Pentesting SAP applications : An introduction

November 12, 2015

SAP (Systems-Applications-Products) is a software suite that offers standard business solutions; it is used by thousands of customers across the globe to man

Learn More

Identifying Vulnerable Code

June 24, 2015

No matter how much care you take during development of any software, security issues creep in. Hence, it is important to get the code reviewed for security l

Learn More

Cracking NQ vault step by step

April 14, 2015

The mobile encryption app NQ Vault has been in the news for bad reasons. Mobile encryption apps are commonly used to prevent access to sensitive data on the

Learn More

Understanding iOS Security: Part 1

March 19, 2015

Apple uses iOS (operating system) to power many of its mobile devices such as iPhone, iPad and so on. From the beginning, security has been placed at the cor

Learn More

Session hijacking cheat sheet

January 20, 2015

'Session Hijacking' is an old and routine topic in the field of application security. To make it more interesting, in this article, we are going to focus on

Learn More

Understanding Disk Encryption on Android and iOS

November 18, 2014

Introduction Mobile devices these days handle lots of sensitive information – messages, photos, contacts and more. The question about how this data is stored

Learn More

Padding oracle attack

July 25, 2014

Firstly, this vulnerability is not related to the Oracle database or the Oracle Company in any way. In cryptography, an 'oracle' is a system that performs cr

Learn More

Can My JavaScript Access Your Page Elements?

March 28, 2014

We all know that by using JavaScript you can do many things, for example read elements on a page, analyze the DOM, etc. Now assume that you logged into faceb

Learn More

ECC: A Case for Mobile Encryption

January 23, 2014

Introduction: It is needless to start this article by talking about the rise of mobile devices in the last few years. We all know how smart phones have swept

Learn More

The breach attack

October 7, 2013

Back in 2012, when Juliano Rizzo and Thai Duong announced the CRIME attack, a TLS / SSL Compression attack against HTTPS, the ability to recover selected par

Learn More

Android Master Key Vulnerability—PoC

August 28, 2013

The recently discovered master key vulnerability in Android has given a jolt to the Android team and other parties involved. This vulnerability allows attack

Learn More