BERRY9 IT Services: penetration testing articles https://berry9.com/blog/ 2026-11-04T00:00:00Z Thimmagurudu Bathini Active Directory Attacks in 2026: What Testers Check https://berry9.com/blog/active-directory-attacks-2026-badsuccessor-ad-cs-kerberoasting/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Identity is how most intrusions spread. The Active Directory paths testers check in 2026: Kerberoasting, certificate services, BadSuccessor and hybrid identity. Android App Penetration Testing Checklist for 2026 https://berry9.com/blog/android-app-penetration-testing-checklist/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini What an Android penetration test checks, the tools testers use, how OWASP MASVS fits in and what Google Play's new target API 36 rule means for your release. API Security Testing Checklist: Find Shadow APIs First https://berry9.com/blog/api-security-testing-checklist-and-shadow-apis/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini An API testing checklist for 2026: inventory and shadow APIs, authorization, tokens, rate limits, the OWASP API Top 10 and the new AI and tool endpoints. Black Box, Gray Box or White Box: Which Web App Test? https://berry9.com/blog/black-box-gray-box-white-box-web-application-testing/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Three ways to scope a web application penetration test, what each one finds, what it costs in time, and how to pick the right one for your application. Can VAPT Be Done Remotely? What Needs Access https://berry9.com/blog/can-vapt-be-done-remotely/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Most application and external testing runs well from a distance. Internal networks and Wi-Fi need access or a visit. Here is how to tell which one you need. CERT-In Rules: 6-Hour Reporting and 180-Day Logs https://berry9.com/blog/cert-in-incident-reporting-and-log-rules/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini CERT-In's 2022 directions ask for incident reports within six hours and logs kept for 180 days in India. What counts, what to prepare and where testing helps. Cyber Security Threats in 2026: What to Test First https://berry9.com/blog/cyber-security-threats-2026-what-indian-businesses-should-test/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The main threats in 2026 reports: identity attacks, edge devices, faster breakouts, AI-assisted attackers and supply chains, and what to test first. Do You Need a CERT-In Empanelled Auditor? https://berry9.com/blog/do-you-need-a-cert-in-empanelled-auditor/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Some buyers must use an auditor from CERT-In's list and many do not. Here is how to find out which applies to you and what to do if it does. DPDP Rules 2025: Security Safeguards Checklist https://berry9.com/blog/dpdp-rules-2025-security-safeguards-checklist/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini India's DPDP Rules were notified in November 2025, with most duties starting in May 2027. A checklist of security safeguards and breach steps to prepare. How Often Should You Do VAPT? A Practical Schedule https://berry9.com/blog/how-often-should-you-do-vapt/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Once a year is the usual minimum. When to test more often: after major changes, for high-risk applications and when a customer asks. A simple schedule. How to Prepare for a Penetration Test: A Checklist https://berry9.com/blog/how-to-prepare-for-a-penetration-test/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini A test goes faster and finds more when the groundwork is done. Here is what to settle on your side before the first request is sent. How to Read a VAPT Report: A Buyer's Guide https://berry9.com/blog/how-to-read-a-vapt-report/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini A good report tells management what to fix first and tells engineers how. Here is how to read one, what each part should contain and what to question. Internal vs External Network Penetration Testing https://berry9.com/blog/internal-vs-external-network-penetration-testing/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini External testing shows what the internet can reach. Internal testing shows what happens once someone is in. How to choose, the tools used and what to expect. OWASP Top 10:2025: What Changed and What to Test https://berry9.com/blog/owasp-top-10-2025-what-changed/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The OWASP Top 10:2025 adds supply chain failures and exception handling, and folds SSRF into access control. What each change means for testing. Customer Asked for a Pen Test Report? What to Send https://berry9.com/blog/penetration-test-report-for-security-questionnaires/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Enterprise customers now ask vendors for penetration test evidence. What the request means, what to share and how to prepare before the questionnaire arrives. Penetration Testing Tools in 2026 and Where AI Fits https://berry9.com/blog/penetration-testing-tools-2026-ai-and-automation/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The tools penetration testers use for web, API, mobile and network work in 2026, what AI-assisted testing can and cannot do, and how to judge a report. Startup's First Penetration Test: When and What to Test https://berry9.com/blog/startup-first-penetration-test-india/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini A guide for Indian startups: when to do a first penetration test, what to scope first, what to fix yourself and how to avoid paying for the wrong test. What Is VAPT? A Plain-English Guide for Business Owners https://berry9.com/blog/what-is-vapt-plain-english-guide/ 2026-11-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini VAPT explained for business owners: what gets tested, how an engagement runs from scope to retest, what you receive, and when your company needs one. Webhook Security: Signatures and Replay Defense https://berry9.com/blog/webhook-security/ 2025-01-13T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Webhooks are the API endpoints other systems call, and they should be defended as such. Signature verification, replay defense and idempotency. Wi-Fi Pen-Testing in the WPA3 Era https://berry9.com/blog/wifi-pentest-wpa3/ 2024-12-10T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini WPA3 closed most of the KRACK-era holes and has its own. Most enterprise networks also still mix WPA2 in. Here is a Wi-Fi test plan. Node.js Security Pitfalls: From Prototype Pollution to SSRF https://berry9.com/blog/node-js-security-pitfalls/ 2024-12-03T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Node's ecosystem moves fast and breaks things. Seven patterns that turn up often in code reviews, from prototype pollution to SSRF to deserialization. Deep-Link and Universal-Link Vulnerabilities https://berry9.com/blog/mobile-deeplink-vulnerabilities/ 2024-11-29T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Deep links and universal links are unauthenticated entry points into your app. Treat them like any other public endpoint, or expect to find bugs there. Rate Limiting, Anti-Automation and API Abuse https://berry9.com/blog/rate-limiting-api-abuse/ 2024-11-19T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Rate limiting is the boring defense that prevents the unsubtle attacks. Where it is usually missing, where it is usually wrong, and what good looks like. Race Conditions and TOCTOU Bugs in Web Applications https://berry9.com/blog/race-conditions-toctou/ 2024-11-05T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Time-of-check to time-of-use bugs let attackers double-spend, double-redeem and double-vote. Scanners miss them; they are obvious once you know where to look. Pen-Testing VPNs and Zero-Trust Gateways https://berry9.com/blog/vpn-zerotrust-pentest/ 2024-10-22T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini VPNs are the legacy remote-access perimeter and zero-trust is the replacement. Both are testable, and both have characteristic weaknesses. Insecure Data Storage in Mobile Apps https://berry9.com/blog/insecure-data-storage-mobile/ 2024-10-15T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Where mobile apps store data (SharedPreferences, Keychain, SQLite, files, WebView caches) and the patterns that are often broken on each. Prototype Pollution in 2025: From Toy to Tenant-Takeover https://berry9.com/blog/prototype-pollution-2025/ 2024-10-08T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Prototype pollution was a curiosity for years. It is now a reliable RCE primitive in Node and an XSS gadget in browsers. The bug, the gadgets, the fix. Java and Spring Security Pitfalls https://berry9.com/blog/java-spring-security-pitfalls/ 2024-09-30T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Spring Security is solid by default. The pitfalls come from the bits developers customize. Seven patterns that turn up in Spring code reviews. JWT Attacks in 2025: alg=none Is Gone, But These Aren't https://berry9.com/blog/jwt-attacks-2025/ 2024-09-22T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The alg=none bug is mostly gone. Algorithm confusion, kid header injection, weak HMAC secrets and JWE confusion are very much still here. Detecting Blind SQL Injection Without Output https://berry9.com/blog/blind-sqli-detection/ 2024-09-11T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Boolean and time-based blind SQL injection are the most common forms left in modern apps, and the slowest to test. Here is how to sequence the discovery. Firewall Bypass and Egress Filtering https://berry9.com/blog/firewall-bypass-techniques/ 2024-08-26T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Inbound firewall rules get audited. Egress filtering is what stops a foothold from becoming a breach. Here is what to test on the way out. Session Management Flaws: Cookies and JWTs https://berry9.com/blog/session-management-flaws/ 2024-08-17T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Sessions hold the long-term authentication state of an application. Get them wrong and every other defense is moot. Patterns to test and patterns that work. OWASP Mobile Top 10: What Each Item Involves https://berry9.com/blog/owasp-mobile-top-10/ 2024-08-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The OWASP Mobile Top 10 is the buyer-facing list and MASVS is the test plan. Here is what each item involves in a mobile test. Authentication Bypass: Eight Techniques Pen-Testers Use https://berry9.com/blog/authentication-bypass-techniques/ 2024-07-22T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Authentication bugs are rarely subtle. Many are one of eight well-documented patterns, and this is the checklist for them. SAST vs DAST vs IAST: A Tester's Take https://berry9.com/blog/sast-vs-dast-vs-iast/ 2024-07-15T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Static, dynamic and interactive application security testing each find different bugs. An honest comparison from a view that values manual review most. Broken Object-Level Authorization (BOLA): Still #1 https://berry9.com/blog/broken-object-level-authorization/ 2024-07-08T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini BOLA has been the top API risk in two consecutive OWASP revisions. It is not going away. Why it persists and how to test for it systematically. TLS Misconfigurations That Still Matter in 2026 https://berry9.com/blog/ssl-tls-misconfigurations/ 2024-07-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini TLS is largely a solved problem, except where it is not. The misconfigurations that still turn up in production, and why each one matters. File Upload Vulnerabilities: From Webshell to RCE https://berry9.com/blog/file-upload-vulnerabilities-2025/ 2024-06-28T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Unrestricted file upload remains one of the most reliable paths to remote code execution. Three things have to go right for the bug. Here is the test plan. Intercepting Mobile API Traffic: Certificate Pinning Bypass https://berry9.com/blog/mobile-api-traffic-interception/ 2024-06-17T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Many of the bugs in a mobile app live in the API it talks to. Seeing that traffic is step one, and modern apps pin certificates. Here is the workflow. CSRF After SameSite: Is It Really Dead? https://berry9.com/blog/csrf-2024-samesite/ 2024-06-02T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini SameSite=Lax by default killed most CSRF, but not all. Subdomain trust, GET requests with side effects and JSON-body CSRF still bite. GraphQL Pen-Testing: Introspection, Batching, and Authz https://berry9.com/blog/graphql-pentest/ 2024-05-26T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini GraphQL trades authorization per endpoint for authorization per resolver, and the resolver level is where the bugs hide. A GraphQL test plan. External Attack Surface Management in India https://berry9.com/blog/external-attack-surface-management/ 2024-05-19T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Most organizations cannot reliably list their public-facing assets, and the unknown ones are the ones that get breached. A grounded approach to EASM. SSRF in the Cloud Era: Exploiting IMDS and Beyond https://berry9.com/blog/ssrf-cloud-metadata/ 2024-05-09T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Server-Side Request Forgery joined the 2021 Top 10 for a reason. Cloud metadata endpoints turn a one-line bug into a credential heist. How to test for it. iOS Jailbreak Detection Bypass: A Pen-Tester's View https://berry9.com/blog/ios-jailbreak-detection-bypass/ 2024-04-21T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Jailbreak detection is a defense-in-depth measure, not a security boundary. Here is why, and how common implementations are bypassed. IDOR: The Bug That Keeps Slipping Through https://berry9.com/blog/idor-business-logic-flaws/ 2024-04-15T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Insecure Direct Object Reference is one of the most common serious flaws, and scanners rarely find it. How to test for it and how to design it out. Secure Code Review Checklist for Web Apps https://berry9.com/blog/secure-code-review-checklist/ 2024-04-09T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini A walkable checklist for manual secure code review: the categories to cover, what to look for in each, and what counts as a finding worth raising. SMB Shares: The Quiet Source of Many Breaches https://berry9.com/blog/smb-shares-misconfigurations/ 2024-04-02T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Open SMB shares are unglamorous. They are also where attackers find credentials, configuration files, customer data and backup keys. Stored, Reflected, DOM-Based XSS: A Tester's Cheat Sheet https://berry9.com/blog/xss-cheat-sheet-stored-reflected-dom/ 2024-03-21T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini XSS today is mostly DOM-based and mostly missed by scanners. A taxonomy with payload patterns, sink lists and what to test against each. SQL Injection in 2024: Modern Vectors https://berry9.com/blog/sql-injection-2024/ 2024-03-04T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini Parameterized queries fixed the easy cases. Modern SQL injection lives in JSON paths, second-order queries, ORM raw fragments and search filters. Active Directory Attack Paths and Their Fixes https://berry9.com/blog/active-directory-attacks/ 2024-02-26T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The path from a domain user to domain admin is often one of a few Active Directory attack classes. Here they are, with the fix for each. OWASP API Security Top 10 (2023): A Walk-through https://berry9.com/blog/api-security-owasp-2023/ 2024-02-14T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The 2023 revision of the API Top 10 is sharper and more specific. Here is what changed, what each item means and how each is tested. OWASP Top 10 (2021): A Walk-through for Engineers https://berry9.com/blog/owasp-top-10-2021-explained/ 2024-02-08T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The 2021 revision moved broken access control to number one and added three categories. Here is what changed and what testing each item involves. Internal Network Pen-Test: A Playbook https://berry9.com/blog/internal-network-pentest-playbook/ 2024-01-22T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini A walk-through of an internal network penetration test, from initial foothold to domain admin, and what the report covers along the way. Android App Pen-Testing with Frida and Objection https://berry9.com/blog/android-pentest-frida-objection/ 2024-01-09T00:00:00Z 2026-11-04T00:00:00Z Thimmagurudu Bathini The two tools that turn an Android test from a slog into a productive day: what they are used for, how they are set up, and the patterns each one finds.