--- title: Best InfoSec Write-ups posts — December 2022 | daily.dev description: The most upvoted InfoSec Write-ups posts from December 2022, curated by the daily.dev community. canonical: https://daily.dev/sources/infosecwriteups/best-of/2022/12 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/sources/infosecwriteups/best-of/2022/12 og:type: website og:site_name: daily.dev og:title: Best InfoSec Write-ups posts — December 2022 | daily.dev og:description: The most upvoted InfoSec Write-ups posts from December 2022, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of InfoSec Write-ups — December 2022 1. 1 [](https://daily.dev/posts/the-big-danger-with-laravel-env-file--6wil3mwta "The Big Danger With Laravel ( .env file )") Article InfoSec Write-ups · 4y The Big Danger With Laravel ( .env file ) The file in Laravel is a configuration file that contains sensitive information such as database credentials and API keys. It is important to keep this file secure and out of reach of unauthorized users. One potential security vulnerability with the file is that it is not included in the version control system (e.g. Git) by default. 21 4 2. 2 [](https://daily.dev/posts/exploiting-xss-with-javascript-jpeg-polyglot-dh6wzougv "Exploiting XSS with Javascript/JPEG Polyglot") Article InfoSec Write-ups · 4y Exploiting XSS with Javascript/JPEG Polyglot Polyglots are a combination of two different file types. Applications allow only certain file types on features like file upload and don’t allow other file types like.php or.js files as these can enable the attacker to upload malicious files on the application. Mozilla fixed this in Firefox 51 and after versions. 19 3. 3 [](https://daily.dev/posts/getting-started-with-reverse-engineering-nwhf7rqtj "Getting Started with Reverse Engineering") Article InfoSec Write-ups · 4y Getting Started with Reverse Engineering Software reverse engineering is a technique that converts a machine code of a program back into the programmable language statements which are called source code. Radare The Radare disassembler is an alternative to IDA. It has all the IDA features without being as robust and stable. But it’s free and open source. 13 4. 4 [](https://daily.dev/posts/flutter-programming-and-security-vulnerabilities-b4qdsrsqr "Flutter Programming and Security Vulnerabilities") Article InfoSec Write-ups · 4y Flutter Programming and Security Vulnerabilities Flutter is an open-source mobile application development framework created by Google. It is used to build natively compiled applications for mobile, web, and desktop from a single codebase. As with any software, it is important to keep Flutter up to date in order to address any vulnerabilities. 12 1 [See all InfoSec Write-ups archives](/sources/infosecwriteups/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/sources/infosecwriteups/best-of/2022/12#page","url":"https://daily.dev/sources/infosecwriteups/best-of/2022/12","name":"Best InfoSec Write-ups Posts — December 2022","description":"The most upvoted InfoSec Write-ups posts from December 2022, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/sources/infosecwriteups/best-of/2022/12#items","numberOfItems":4,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/the-big-danger-with-laravel-env-file--6wil3mwta","name":"The Big Danger With Laravel ( .env file )"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/exploiting-xss-with-javascript-jpeg-polyglot-dh6wzougv","name":"Exploiting XSS with Javascript/JPEG Polyglot"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/getting-started-with-reverse-engineering-nwhf7rqtj","name":"Getting Started with Reverse Engineering"},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/flutter-programming-and-security-vulnerabilities-b4qdsrsqr","name":"Flutter Programming and Security Vulnerabilities"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sources","item":"https://daily.dev/sources"},{"@type":"ListItem","position":3,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/sources/infosecwriteups/best-of"},{"@type":"ListItem","position":5,"name":"December 2022"}]}]} ```