I think that as the web applications become more and more secure, we will start focusing more and more on the security of the whole development lifecycle. That includes attacks on CI/CD pipelines. I covered one of such attacks recently in my video Injecting code into...
#21
120 days of hunting
I appreciate any blogpost that gives us information not only about bugs and bounties but also about time spent. It gives us the context and understanding of whether reports are one-off lucky findings or vulnerabilities that the hunter can find regularly. Kuldeep...
WebSocket security scanner
Basics of WebSockets and Cross-site WebSocket Hijacking were already covered in the BBRE Premium, here’s the link in case you missed it. Today, we’ll take a look at automating scanning for WebSocket bugs. I’ve watched the whole talk from AppSec by Erik Elbieh about...
Common ENV variables with sensitive information
Every once in a while we encounter a bug that allows us to exfiltrate environment variables. It sounds cool and is easy to prove but what’s the real impact? It depends on what environment variables are defined. Maciej Pulikowski created a list of commonly used...
Is bug bouny hunter lifestyle healthy?
I know many people in our space will always tell you that bug bounty is awesome, bugs are everywhere and all you need to do is try harder. Such narrative gives viewers or readers positive emotions. Positive emotions result in more likes and views because it gives...
10 Burp shortcuts that will help you hack quicker
As said in the SQL injection article, to find great bugs you need a lot of time. How to save time? One of the things you can do is using shortcuts instead of using a mouse for common functionalities in Burp. Here are my top 10 shortcuts that will make your work...
SQL injection in today’s web
Every once in a while, I get asked about whether vulnerabilities like SQL injection are still there. When pentesting, I was encountering this bug class regularly but to be honest, I wouldn’t test for this on any bug bounty target. However, I see that some people are...