Мой любимый ежегодный рейтинг — Top 10 web hacking techniques, который готовит сообщество исследователей по инициативе компании PortSwigger. В рейтинг попадают материалы, в которых делятся инновациями в области поиска и эксплуатации уязвимостей. Сегодня я хочу рассказать об исследованиях, которые показались мне наиболее интересными, потому что показывают не просто отдельные уязвимости, а целые категории проблем и новые методы атак.
Back in 2020, when X was still called Twitter, I created a simple Telegram bot that analysed Twitter feeds and identified interesting ideas related to vulnerability detection. Every day, it analysed all the posts with the #bugbountytips hashtag from the previous 24 hours, selected the posts with the highest reach based on the number of likes and retweets, and published them to the feed.
Since then, Twitter has shut down its API and rebranded as X and implemented anti-scraping measures to block content harvesting. However, the number of valuable ideas and the size of security community on the platform have not decreased.
With a bit of vibe-coding, the bot can be brought back to life:
Link in comments. If you have any ideas for hashtags or sources to add for monitoring, please share them in the comments or via DM.
В начале была проблема. В международной корпорации, где вместе с командой продуктовой безопасности я строил процессы разработки, была нехватка инженеров Application Security. На несколько тысяч разработчиков оказалось всего несколько AppSec-специалистов, и с ростом скорости производства становилось сложнее исправлять обнаруженные дефекты.
If you ask a product security engineer, what is the main entry point for an organization’s adversary to gain access to their crown jewels, he would answer: “a human.” He most likely means those employees with a low level of security awareness. In today’s reality, security engineers are the guards of employees’ security-related code of conduct. But who guards the guards?
Based on real scenarios of supply chain attacks, we’ve performed for various software developing companies, we demonstrated the weakest points of the “Agile Security” paradigm in software development lifecycle and redefine Code of Conduct for product security.
The research is presented at OWASP Israel.