PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Researcher Spotlight: Mongo

bugcrowd.com | research | #bug-bounty | #rce | #ctf | #bugcrowd | #interview | #xxe | #researcher-spotlight
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd spotlights Mongo, a former developer who reached 8th on its leaderboard within six months of his first submission, explaining his CTF roots and preference for hunting XXE and RCE bugs.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
blog · bugcrowd.com
Meet the Bugcrowd! Bug Hunter Profile of Osanda Malith Jayathissa (@OsandaMalith)
Bugcrowd profiles Osanda Malith Jayathissa, a Sri Lankan student who entered bug hunting in August 2013 with an XSS find in Adobe and within a month reached more than 20 organizations' halls of fame.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · bugcrowd.com
Supporting Researcher Success through Education & Collaboration
Bugcrowd added five Bugcrowd University modules on Burp Suite, SSRF, XXE, and recon, verified skills matching, and researcher collaboration with joint submissions and reward splitting.
research · portswigger.net
Top 10 web hacking techniques of 2018
James Kettle announces the Top 10 web hacking techniques of 2018 chosen from 59 nominations, including XS-Search on Google's bug tracker and XXE via local DTD files.
research · swarm.ptsecurity.com
Impossible XXE in PHP
PT SWARM shows an 'almost impossible' XXE in PHP is exploitable by defeating four defenses — disabled entity loading, LIBXML_NONET, missing NOENT, a DOM nodeType check — using parameter entities.
Back