PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

‘Feeling close to a critical vulnerability is incredibly addictive’ – YouTuber gregxsunday on the joys of Bug Bounty

yeswehack.com | vulnerability | #bug-bounty | #authentication | #interview | #youtube | #saml | #gregxsunday
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Interview with Grzegorz Niedziela (gregxsunday) of Bug Bounty Reports Explained: the pull of critical bugs, authentication and SAML flaws, Burp vs Caido, and tips for new hunters.
Published
Collected

Related coverage

blog · blog.trailofbits.com
SAML: A fractal of bad design
Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
blog · netspi.com
Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them
A practical guide to testing SSO solutions that use SAML, covering the IdP/SP message flow and common implementation mistakes involving signatures, assertions, and message expiration.
vulnerability · yeswehack.com
Vulnerability Disclosure Policy through the eyes of a bug hunter
An interview with ethical hacker Clement 'SaxX' Domingo on what a Vulnerability Disclosure Policy is, how it differs from bug bounty programs, and why few companies have set one up.
vulnerability · yeswehack.com
How we help our clients step-by-step in their Bug Bounty journey
Interview with YesWeHack's Head of Customer Success on guiding clients through their bug bounty journey: scoping and launching programs, keeping them attractive to researchers, managing relationships.
vulnerability · yeswehack.com
YESWEHACK PROPHILE ON SONNY
A YesWeHack 'Prophile' spotlight from July 2020 featuring ethical hacker Sonny, part of a series profiling members of the bug bounty community and their hunting stories.
Back