Elusive Thoughts

Claude Safety Guide for Developers (2026) — Securing AI-Powered Development Application Security Guide — March 2026 🛡️ Claude Safety Guide for Developers Securing Claude Code, Claude API & MCP Integrations in Your SDLC 📑 Contents Why This Guide Exists The AI Developer Threat Landscape in 2026 Real-World CVEs: Claude Code Vulnerabilities Understanding Claude Code's Permission Model Prompt Injection: Attack Vectors & Defences MCP (Model Context Protocol) Security AI Supply Chain Risks Claude API Safety Best Practices Claude Code Hardening Checklist Integrating Claude Security into CI/CD Compliance Considerations (SOC 2, GDPR, AI Act) Resources & References 1. Why This Guide Exists AI-powered development tools have moved from novelty to necessity. Anthropic's Claude ecosystem — spanning Claude Code (terminal-based agentic coding), Claude API (programmatic integration), and the broader Model Context Protocol (MCP) integrati...

External Service Interaction & Out-of-Band Resource Loads — Updated 2026 External Service Interaction & Out-of-Band Resource Loads Host Header Exploitation // SSRF Primitives // Infrastructure Pivoting SSRF Host Header Injection CWE-918 OWASP A10:2021 Cache Poisoning Updated 2026 In the recent past we encountered two relatively new types of attacks: External Service Interaction (ESI) and Out-of-Band Resource Loads (OfBRL). An ESI [1] occurs only when a web application allows interaction with an arbitrary external service. OfBRL [6] arises when it is possible to induce an application to fetch content from an arbitrary external location, and incorporate that content into the application's own response(s). Taxonomy Note (2026): Both ESI and OfBRL are now classified under OWASP A10:2021 — SSRF and map to CWE-918 (Server-Side Request Forgery). ESI also maps to CWE-441 (Unintentional Pro...

Introduction The reason for this blog post is to advertise my book. First of all I would like to thank all the readers of my blog for the support and feedback on making my articles better. After 12+ years in the penetration testing industry, the time has come for me to publish my book and tranfer my knowledge to all the intersted people that like hacking and want to learn as much as possible. Also at the end of the blog you will find a sample chapter. About The Author Gerasimos is a security consultant holding a MSc in Information Security, a CREST (CRT), a CISSP, an ITILv3, a GIAC GPEN and a GIAC GAWPT accreditation. Working alongside diverse and highly skilled teams Gerasi- mos has been involved in countless comprehensive security tests and web application secure development engagements for global web applications and network platforms, counting more than 14 years in the web application and application security architecture. Gerasimos further progressing in h...

Filename   Brute-forcing  through MultiViews Vulnerability This is a small post about a way to easily get backup files on Apache web servers with Multiviews option enabled. There is no much information in Multiviews (an Apache feature) and some Web Application scanners report this as Apache mod_negotiation filename brute-forcing rather than Multiviews option enabled. Apache HTTPD supports content negotiation as described in the HTTP/1.1 specification (see http://www.w3.org/Protocols/rfc2616/rfc2616.html ). It can choose the best representation of a resource based on the browser-supplied preferences for media type, languages, character set and encoding. It also implements a couple of features to give more intelligent handling of requests from browsers that send incomplete negotiation information. What are resources A resource is a conceptual entity identified by a URI (RFC 2396). An HTTP server like Apache HTTP Server provides access to representations of the resource(s...