Home Tags Posts tagged with "bug bounty"
Tag:

bug bounty

Blog

Bug Hunting Hub goes offline with Bug Hunting Village

by Denis Makrushin

Organised within a separate section at PHDays for the first time, leading security researchers and bug hunters will share the results of their work, and owners of bug bounty programs can attract bug hunters by making an announcement. During the event, our sponsors and partners will announce the highest bounties for their vulnerability disclosure programs, and the most active bug hunters will be additionally awarded by organisers.

Submit your talk, workshop or just register yourself to participate here (for Russian-based submissions).

TwitterLinkedinVKTelegram
Research

JavaScript prototype pollution: practice of finding and exploitation

by Denis Makrushin

https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2

Finally, the English version of “JavaScript prototype pollution: practice of finding and exploitation” article is prepared. Using the techniques Nikita Stupin discovered CVE-2020–28460 in multi-ini parser and a vulnerability in the merge-deep package. With the first one, everything went smoothly, but with the second one, a funny situation came out: after sending the report, the maintainer did not get in touch for a long time, and as a result, GitHub Security Lab found the same vulnerability, managed to reach the maintainer earlier and registered it (GHSL-2020–160). All details related to these vulnerabilities, discovery and exploitation techniques, and recommendations on how to protect your applications are collected in the article.

TwitterLinkedinVKTelegram
Blog

JavaScript prototype pollution: discovery and exploitation guide (Ru)

by Denis Makrushin

https://habr.com/ru/company/huawei/blog/547178/

If you regularly monitor bug bounty reports, you’ve seen “JavaScript prototype pollution” titles. Nikita Stupin decided to dig deeper into the category of vulnerabilities, impacting JavaScript applications, and prepared the practical guide of its discovery and exploitation. Soon we will also prepare an English version of the paper, but currently, you have to manage by yourself to translate it.

TwitterLinkedinVKTelegram
Blog

“Web Application Bug Hunting” Workshop on #SINCON2020

by Denis Makrushin

For everyone who wants to start the new year productively and begin the journey in application security, I will introduce “Web Applications Bug Hunting: Fundamentals and Learning Path” workshop on SINCON.

Continue Reading
TwitterLinkedinVKTelegram
Load More Posts