PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Web Application Black-Box Testing

yeswehack.com | blog | #bug-bounty | #pentesting | #fuzzing | #web-security | #methodology | #payloads | #black-box-testing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Black-box testing techniques for web applications: state transition, fuzzing, error guessing and payload design, plus how to spot behaviours like reflected output, errors and response-time changes.
Published
Collected

Related coverage

blog · netspi.com
Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
A NetSPI walkthrough of CSRF basics and using Burp Proxy to fuzz parameters in CSRF-resistant apps, covering attack vectors from image tags to XSS-chained requests and why token fixes are imperfect.
vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · yeswehack.com
Why pentests cause security debt
New features ship, dependencies update, new APIs are added… and all the while, despite your pentest program, security debt mounts up.
blog · yeswehack.com
‘I’m not the kind of person to rely on tooling’: Sn0rkY shares his Bug Bounty story and top tips
French hacker Sn0rkY shares his Bug Bounty methodology, views on AI tooling and advice for hunters in this YesWeHack interview.
Back