PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking Down the Fortress: A Teen’s Unveiling of a Critical Bug in a High-Stakes Cryptoexchange

hackenproof.com | blog | #bug-bounty | #web3 | #vulnerability-research | #account-takeover | #web-security | #authentication | #crypto-exchange
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Writeup of a CVSS 10 account-takeover flaw in a crypto exchange's authentication and password-reset flow, found by teenage researcher Gowtham Naidu Ponnana.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
blog · certik.com
Clear Signing Under the Hood: A Technical Guide to ERC-7730
What the ERC-7730 standard does, how it works under the hood, and the security trade-offs that come with it.
vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
Back