PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Open-source security testing: the Bug Bounty guide to code analysis

yeswehack.com | blog | #bug-bounty | #open-source | #fuzzing | #sast | #codeql | #code-analysis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

An open-source code-analysis guide for hunters: SAST, DAST, taint analysis, CFG and fuzzing compared; CodeQL and Snyk workflows; and a Zip Slip hunt in OWASP Juice Shop.
Published
Collected

Related coverage

blog · wiz.io
AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz
Pillar 3 of the AI Threat Readiness framework: why traditional SAST misses AI-era logic flaws, and how Wiz uses repo prioritization, AI code scans and agentic workflows to fix them at source.
blog · bughunters.google.com
Finding Bugs in Chrome with CodeQL
A practical guide to using CodeQL, a semantic static analysis tool, to search for security vulnerabilities in the Chrome codebase.
blog · blog.quarkslab.com
Internship Offers for the 2026-2027 Season
The internship 2026-2027 season at Quarkslab is open! Our internship positions cover a wide range of topics and expertise, and aim at tackling new challenges in various fields.
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
blog · blog.trailofbits.com
Introducing mrva, a terminal-first approach to CodeQL multi-repo variant analysis
mrva is a terminal-first tool for CodeQL multi-repository variant analysis: it downloads pre-built databases via the GitHub API, runs custom queries locally, and prints SARIF results to stdout.
Back