https://sneakyottersec.github.io/tags/csp/ Recent content in CSP on Ottersec Blog Hugo en-us ottersec Wed, 10 Dec 2025 00:00:00 +0000 https://sneakyottersec.github.io/posts/bruno/ Wed, 10 Dec 2025 00:00:00 +0000 https://sneakyottersec.github.io/posts/bruno/ <h1 id="attacking-bruno--a-small-electron-for-a-nuclear-reaction">Attacking Bruno : a small Electron for a nuclear reaction</h1> <h2 id="0-introduction">0. Introduction</h2> <p><a href="https://www.usebruno.com/">Bruno</a> is the open-source alternative to Postman. Both tools are used for API testing and development and both aim at making API workflows less painful, which makes them a staple of any developer&rsquo;s toolbox. Bruno being an Electron application, it inherits the whole web attack surface <em>plus</em> a desktop one — and that combination is exactly what we are going to abuse here.</p>