PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pentesting for Web Applications

hackerone.com | blog | #pentesting | #web-security | #idor | #owasp | #ptaas | #injection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne outlines its PTaaS web pentesting methodology based on OWASP Top 10 and PTES, covering common vulnerabilities like injection, XSS, SQLi, and IDOR, plus remediation best practices.
Published
Collected

Related coverage

blog · netspi.com
Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
A NetSPI walkthrough of CSRF basics and using Burp Proxy to fuzz parameters in CSRF-resistant apps, covering attack vectors from image tags to XSS-chained requests and why token fixes are imperfect.
blog · netspi.com
Presenting at OWASP AppSec Conference
A NetSPI preview of their OWASP AppSec talk on escalating privileges through database trusts, promising three root causes, three attack scenarios, and five fixes for weak app-DB configurations.
blog · hackerone.com
Breaking Down the OWASP Top 10: Injection
A walkthrough of OWASP Top 10 injection attacks - reflected and stored XSS, SQLi, SSTI, CRLF, header and command injection, and directory traversal - with concrete exploitation examples.
blog · hackerone.com
What Is the Difference Between Pentesting and Bug Bounty?
Pentesting and bug bounties complement each other: this guide compares consultancies, traditional PTaaS, community-driven PTaaS, and automated pentesting on effectiveness, efficiency, and value.
blog · hackerone.com
Use Hackerone’s Enhanced Pentest as a Service to Streamline Security Testing
HackerOne enhances its pentest as a service: ten-day average launch, real-time findings, 26 SDLC tool integrations, 60 days of free retesting, and about 20% of findings rated high or critical.
blog · hackerone.com
How to Catch Injection Security Vulnerabilities in Code Review
XSS, SQL injection, and path control flaws stem from unvalidated input. The guide shows how to spot missing validation and sanitization during code review, where automated scanners often fall short.
Back