PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How I dumped users’ passports from the exchange

hackenproof.com | blog | #bug-bounty | #vulnerability-research | #data-exposure | #brute-force | #writeup | #crypto-exchange | #kyc
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A critical KYC flaw on a crypto exchange: predictable Unix-timestamp filenames and public storage let a researcher brute-force file URLs and dump users' passports.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
blog · hackenproof.com
How We Built an Autonomous AI Security Triager: From LLM to 20,000+ Real Reports
AI made bug hunters sharper, and report volume doubled. How HackenProof built an autonomous AI triager that now handles 70% of submissions.
blog · hackenproof.com
A Payment Platform for Security Researchers—No Bug Bounty Program Required
HackenProof launched a payment platform for rewarding researchers outside formal bug bounty programs: companies deposit funds, while the platform handles agreements, KYC, contracts and payouts.
blog · hackenproof.com
Global Crypto Regulations for Centralized Exchanges: EU, USA, Asia, Latin America & UAE Guide
A compliance map for centralized exchanges across the EU, US, Asia, Latin America and the UAE: MiCA, DORA, licensing and AML regimes, and why security testing now sits inside regulatory duties.
Back