Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Open-source security testing: the Bug Bounty guide to code analysis

yeswehack.com | blog | #bug-bounty | #open-source | #fuzzing | #sast | #codeql | #code-analysis

Summary

An open-source code-analysis guide for hunters: SAST, DAST, taint analysis, CFG and fuzzing compared; CodeQL and Snyk workflows; and a Zip Slip hunt in OWASP Juice Shop.
Published
Collected

original ↗

Related coverage

  1. Top 5 hacking tools for white-box pentesting (yeswehack.com)
  2. AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz (wiz.io)
  3. Introducing zeroday.cloud: First-of-its-kind cloud and AI hacking competition (wiz.io)
  4. What are business logic vulnerabilities, and why are they so hard to catch? (theori.io)
  5. Offensive Security with Large Language Models (2) (theori.io)
  6. ‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting (yeswehack.com)

back