PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Top 5 hacking tools for white-box pentesting

yeswehack.com | blog | #pentesting | #fuzzing | #sast | #tooling | #vscode | #white-box
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Top 5 white-box pentesting tools: VS Code and its debugger, SonarQube for SAST, AFL++ for fuzzing and DevDocs — plus open-source targets paying bounties up to €10,000.
Published
Collected

Related coverage

blog · netspi.com
Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
A NetSPI walkthrough of CSRF basics and using Burp Proxy to fuzz parameters in CSRF-resistant apps, covering attack vectors from image tags to XSS-chained requests and why token fixes are imperfect.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
blog · yeswehack.com
Why pentests cause security debt
New features ship, dependencies update, new APIs are added… and all the while, despite your pentest program, security debt mounts up.
blog · yeswehack.com
Pentests are dead. Long live pentests.
Traditional pentests have created a cottage industry of painful admin. So what needs to change?
blog · yeswehack.com
White-box penetration testing: How to debug for JavaScript vulnerabilities
Guide to white-box pentesting of JavaScript apps in Docker: debugging in VS Code to trace payloads, plus common flaws — prototype pollution (CWE-1321), type confusion and XSS.
blog · yeswehack.com
White-box penetration testing: Debugging for Python vulnerabilities
Guide to white-box pentesting of Python apps in Docker: debugging in VS Code to track payloads, covering prototype pollution, template injection (CWE-1336) and path traversal.
Back