PentesterLab

💥🐹 4 new Go Code Review Labs just dropped! 🐹💥

Read the code, peek at the diff, find the bug.

Sharpen your skills: pentesterlab.com/badges/golang-…

Would you rather only be allowed to pentest using Nikto, or only be allowed to pentest Perl applications?

If you use a whole package for one small helper, consider the updates, maintenance and trust you take on. Removing unused functionality or replacing a tiny helper with simpler, tested code you can maintain may be worthwhile.

pentesterlab.com/blog/brace-you…

Remember: the codebase you're reviewing is alive, and it won't stop changing just because you're taking notes.

When documenting a potential vulnerability, don't record only the filename and line number. Code moves, code changes, files get renamed, and your reference might point to something completely different by the time someone reads your findings.

Always keep the filename, line number, commit hash, and a copy of the relevant code, along with an explanation of the issue. If you include a link, make sure it points to that specific commit, not to the branch.

Your notes should still make sense after the code has changed.

Java gotcha: concatenating a null reference doesn't throw. It becomes the four characters "null".

In Tomcat's digest authentication, a missing user's password became "null" (CVE-2026-43512). When code hashes a lookup result, look for the null check.

pentesterlab.com/training/on-de…