PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bug Bounties and NGWAF: 1+1=3

bugcrowd.com | blog | #bug-bounty | #waf | #bugcrowd | #application-security | #roi | #ngwaf
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd argues traditional WAF ROI decays as code changes, while NGWAFs add attack visibility and bug bounties deliver continuous returns, making the two complementary defenses for agile teams.
Published
Collected

Related coverage

blog · bugcrowd.com
Savant Forge: Automated offensive testing to keep pace with AI-generated code
Bugcrowd's Savant Forge combines fuzz testing with symbolic execution to surface real exploitable vulnerabilities in CI/CD pipelines, while Savant Runtime tracks live third-party components in production to support SBOM compliance.
blog · netspi.com
Thoughts on Web Application Firewalls
Pushes back on the claim that WAFs beat fixing vulnerable code: filters can be bypassed, need lengthy tuning, and have their own flaws, so WAFs belong in defense-in-depth, not code substitution.
blog · bugcrowd.com
Behind the scenes of PHP2Shell: What the last 72 hours taught us
PHP2Shell hit fast. Bugcrowd’s CISO shares what 72 hours of response taught us, plus three lessons for CISOs facing the next critical vulnerability.
blog · bugcrowd.com
CISA’s VDP platform: Five years of collaborative defense
CISA’s VDP Platform marks five years with nearly 45,000 submissions and 5,300+ vulnerabilities fixed across 60+ federal agencies. See the key findings.
blog · bugcrowd.com
Weird ways to hide shellcode
Discover a novel red teaming technique for hiding shellcode inside procedurally generated mazes, using shortest-path algorithms to disguise payloads from EDR and antivirus detection.
blog · bugcrowd.com
How to choose the right live hacking event for your organization
"ot sure which live hacking event fits your program? Compare Virtual, Live in the Loop, Bug Bash, and ReCON to find the right format, scope, and budget.
Back