PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

8 High-impact Bugs and How HackerOne Customers Avoided a Breach: SQL Injection

hackerone.com | vulnerability | #sql-injection | #owasp | #dod | #hacktivity | #starbucks | #vulnerability-series
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

This series entry covers SQL injection, fifth most rewarded on HackerOne, with disclosed Starbucks and US DoD reports showing how verbose errors and XML upload endpoints lead to database compromise.
Published
Collected

Related coverage

vulnerability · hackerone.com
8 High-Impact Bugs and How HackerOne Customers Avoided a Breach: Privilege Escalation
This series opener explains privilege escalation—vertical versus horizontal per OWASP—ranked fourth most rewarded on HackerOne, with disclosed reports illustrating its potential business impact.
research · hackerone.com
8 High-Impact Bugs and How HackerOne Customers Avoided a Breach: Information Disclosure
This series entry covers information disclosure (CWE 200), third most rewarded on HackerOne, and shows the company dogfooding its own public bounty and disclosure policy to illustrate the risk type.
vulnerability · hackerone.com
How Federal Agencies Use Vulnerability Disclosure Policies to Level Up Security
Vulnerability disclosure policies are becoming a requirement for federal agencies. The article recaps HackerOne's government work since Hack the Pentagon and five components of an effective VDP.
vulnerability · hackerone.com
Why Every Federal Agency Needs a VDP
A CISA draft directive requires all US federal civilian agencies to publish a vulnerability disclosure policy, following the DoD VDP model that surfaced 12,000+ vulnerabilities in three years.
vulnerability · hackerone.com
Using Bug Bounty Talent Pools to Attract and Maintain Top Talent
Bug bounty programs double as security talent pipelines: Hacktivity and Hacker101 help train researchers, while Shopify and Dropbox hired proven hackers directly from their HackerOne programs.
vulnerability · hackerone.com
How the Risk-Averse DoD Learned to Stop Worrying and Love the Hackers
A Security@ 2019 panel traces how the US DoD embraced hackers: its VDP and bounties surfaced 11,000+ valid vulnerabilities, saved taxpayers $64 million in three years and returned roughly 800% ROI.
Back