PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Time Boxed Penetration Testing for Web Applications

projectblack.io | research | #penetration-testing | #methodology | #scoping | #web-applications | #time-boxed
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A definition of time boxed web application penetration testing and its priorities: high-risk areas like auth and privileged functions, client-specified priorities, and sampling to maintain breadth.
Published
Collected

Related coverage

research · portswigger.net
How I choose a security research topic
James Kettle on choosing security research topics: evaluate how quickly you can fail, chase what scares you, and know when to push on, using his race-conditions research as a case study.
research · portswigger.net
Hunting evasive vulnerabilities
James Kettle's Nullcon keynote explores evasive vulnerabilities from a decade of research — too advanced, too silly or well-masked to spot — extracting principles for finding overlooked flaws.
research · portswigger.net
How to turn security research into profit: a CL.0 case study
Strategies for turning security research into bounty profit, using the CL.0 desync class as a case study: assess competition, find gaps in released scanners, and act before a technique saturates.
research · bugcrowd.com
How to Write a Clear and Thoughtful Scope, A Deep Dive
Bugcrowd's scoping deep dive explains how ambiguous bounty brief scope leads researchers to under-test or over-test, urging explicit in-scope assets and exclusions in every bug bounty brief.
research · hackenproof.com
How to Read Any Smart Contract Project Without Getting Lost
A methodology guide on reading unfamiliar smart contract projects without getting lost, aimed at security researchers and auditors facing large, complex codebases.
research · eshard.com
Benchmarking side-channel solutions... Why? How?
# or with conda conda install scared` ... and then customize the example scripts below, based on this `random reader`. ## Random reader As explained, the `random reader` is the _fake_ dataset...
Back