--- title: Best InfoSec Write-ups posts — September 2025 | daily.dev description: The most upvoted InfoSec Write-ups posts from September 2025, curated by the daily.dev community. canonical: https://daily.dev/sources/infosecwriteups/best-of/2025/09 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/sources/infosecwriteups/best-of/2025/09 og:type: website og:site_name: daily.dev og:title: Best InfoSec Write-ups posts — September 2025 | daily.dev og:description: The most upvoted InfoSec Write-ups posts from September 2025, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of InfoSec Write-ups — September 2025 1. 1 [](https://daily.dev/posts/aspgoat-the-first-intentionally-vulnerable-modern-asp-net-core-app-for-owasp-top-10-onwc0nchn "AspGoat: The First Intentionally Vulnerable modern ASP.NET Core App for OWASP Top 10") Article InfoSec Write-ups · 1y AspGoat: The First Intentionally Vulnerable modern ASP.NET Core App for OWASP Top 10 AspGoat is a new intentionally vulnerable web application built with ASP.NET Core MVC, SQLite, and Entity Framework Core. It addresses the gap in security training tools for modern ASP.NET Core applications, offering hands-on challenges for OWASP Top 10 vulnerabilities including XSS, SQL injection, CSRF, SSRF, and more. The project includes secure coding challenges and comes with official Docker support for easy deployment. 28 1 2. 2 [](https://daily.dev/posts/how-to-prevent-csrf-attacks-in-your-applications-yom3shgrm "How to Prevent CSRF Attacks in Your Applications") Article InfoSec Write-ups · 1y How to Prevent CSRF Attacks in Your Applications Explores three major CSRF attack prevention strategies with practical demonstrations: SameSite cookie attributes that control cross-site cookie transmission, synchronizer token patterns that validate server-generated tokens, and double submit patterns that compare tokens from cookies and forms. Each mitigation addresses different core issues - browsers automatically attaching credentials and servers being unable to distinguish request origins. Includes live code examples and explanations of why attackers cannot forge CSRF tokens due to Same-Origin Policy restrictions. 16 3. 3 [](https://daily.dev/posts/how-to-ruin-your-weekend-building-a-diy-edr-muupsqr1q "How to Ruin Your Weekend: Building a DIY EDR") Article InfoSec Write-ups · 1y How to Ruin Your Weekend: Building a DIY EDR A detailed walkthrough of building a custom Endpoint Detection and Response (EDR) system called 'RottenTomato' from scratch. The project demonstrates kernel driver development, process monitoring through Windows callbacks, static analysis of executables, and DLL injection techniques for runtime monitoring. The implementation includes a kernel driver that intercepts process creation events, a static analyzer that examines binaries for suspicious characteristics, and a remote injector that performs user-space hooking to detect malicious memory allocations. 10 [See all InfoSec Write-ups archives](/sources/infosecwriteups/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/sources/infosecwriteups/best-of/2025/09#page","url":"https://daily.dev/sources/infosecwriteups/best-of/2025/09","name":"Best InfoSec Write-ups Posts — September 2025","description":"The most upvoted InfoSec Write-ups posts from September 2025, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/sources/infosecwriteups/best-of/2025/09#items","numberOfItems":3,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/aspgoat-the-first-intentionally-vulnerable-modern-asp-net-core-app-for-owasp-top-10-onwc0nchn","name":"AspGoat: The First Intentionally Vulnerable modern ASP.NET Core App for OWASP Top 10"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/how-to-prevent-csrf-attacks-in-your-applications-yom3shgrm","name":"How to Prevent CSRF Attacks in Your Applications"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/how-to-ruin-your-weekend-building-a-diy-edr-muupsqr1q","name":"How to Ruin Your Weekend: Building a DIY EDR"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sources","item":"https://daily.dev/sources"},{"@type":"ListItem","position":3,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/sources/infosecwriteups/best-of"},{"@type":"ListItem","position":5,"name":"September 2025"}]}]} ```