PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

These Are the Bugs You Should Look for in Late 2020

bugcrowd.com | blog | #bug-bounty | #sql-injection | #xss | #idor | #bugcrowd | #business-logic | #owasp-top-10 | #business-logic-vulnerabilities
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd's Luke (hakluke) Stephens reviews late-2020 bug trends: most valid reports are still OWASP Top 10 classics like XSS, SQLi and IDOR, while business logic bugs increasingly dominate P1s.
Published
Collected

Related coverage

blog · xbow.com
Getting to “Should I?”, Instead of “Can I?”: How XBOW Finds IDORs With High Accuracy in Ambiguous Contexts
XBOW explains why IDORs are design flaws that scanners miss, and how its context-aware reasoning models expected access patterns to find high-accuracy IDORs in ambiguous authorization contexts.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
research · yokai.hakaisecurity.io
SQL Injection e Vulnerabilidade XSS no Centreon
Eu sou Daniel França Lima e sou pentester Jr e pesquisador de vulnerabilidades na Hakai Offensive Security. Com o objetivo de ajudar a comunidade de hackers, empresas e também aprimorar minhas habilidades, periodicamente busco por falhas em aplicativos do mercado com o objetivo de realizar divulgação responsável. Centreon é uma solução de monitoramento de ativos […]
research · yokai.hakaisecurity.io
SQL Injection and XSS Vulnerability on Centreon
I’m Daniel França Lima and i’m a penetration tester Jr and vulnerability researcher at Hakai Offensive Security. In order to help the hacking community, companies and also improve my skills, I periodically look for flaws in market applications with the goal of achieving responsible disclosure. Centreon is a system and network asset monitoring solution based […]
blog · bugcrowd.com
Behind the scenes of PHP2Shell: What the last 72 hours taught us
PHP2Shell hit fast. Bugcrowd’s CISO shares what 72 hours of response taught us, plus three lessons for CISOs facing the next critical vulnerability.
blog · bugcrowd.com
CISA’s VDP platform: Five years of collaborative defense
CISA’s VDP Platform marks five years with nearly 45,000 submissions and 5,300+ vulnerabilities fixed across 60+ federal agencies. See the key findings.
Back