Think prepared statements automatically make your Node.js apps secure? Think again.

In my latest blog post, I explore a surprising edge case in the mysql and mysql2 packages that can turn “safe” prepared statements into exploitable SQL injection vulnerabilities.

If you use Node.js and rely on prepared statements (as you should be!), this is a must-read: https://blog.mantrainfosec.com/blog/18/prepared-statements-prepared-to-be-vulnerable

Been working with Function ID databases lately to speed up RE work on Windows binaries — especially ones that are statically linked and stripped. For those unfamiliar, it’s basically a way to match known function implementations in binaries by comparing their signatures (not just hashes — real structural/function data). If you’ve ever wasted hours trying to identify common library functions manually, this is a solid shortcut.

A lot of Windows binaries pull in statically linked libraries, which means you’re left with a big mess of unnamed functions. No DLL imports, no symbols — just a pile of code blobs. If you know what library the code came from (say, some open source lib), you can build a Function ID database from it and then apply it to the stripped binary. The result: tons of auto-labeled functions that would’ve otherwise taken forever to identify.

What’s nice is that this approach works fine on Windows, and I ended up putting together a few PowerShell scripts to handle batch ID generation and matching. It's not a silver bullet (compiler optimisations still get in the way), but it saves a ridiculous amount of time when it works.