SSRF vulnerabilities and where to find them
TL/DR: It’s no secret that cloud architectures have several characteristics that make SSRF attacks challenging to defend against. While SSRFs are not a new threat …
Detectify Crowdsource
How To Hack Web Applications in 2022: Part 2
TL/DR: Web applications have both authentication and authorization as key concepts and if bypassed by an attacker, it can compromise sensitive data. With threats such …
Module disclosures now available for hackers on Detectify Crowdsource
TL/DR: As part of ongoing efforts to enhance the experience of our community of ethical hackers on Crowdsource, Detectify announced today the availability of module …
Account hijacking using “dirty dancing” in sign-in OAuth-flows
TL;DR Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens could leak to an attacker. This could be used in attacks for single-click account takeovers. Frans Rosén, Security Advisor at Detectify goes through three different scenarios found in the wild below.
Hack with ‘goodfaith’ – A tool to automate and scale good faith hacking
TL/DR: The tough part about hacking is to stay in scope. Hacker and security researcher Ryan Elkins (@ryanelkins) revealed a new tool that is intended to …
Detectify awarded its biggest bounty ever during the height of Log4j
tl/dr: We paid out over $57,000 in bounties to Detectify Crowdsource hackers for Log4j vulnerabilities over the last month. Over the course of the last …
How I found the Grafana zero-day Path Traversal exploit that gave me access to your logs
TL/DR: On December 2, open-source analytics solution Grafana released an emergency security patch for critical zero-day Path Traversal vulnerability CVE-2021-43798, after proof-of-concept code to exploit …
10 Types of Web Vulnerabilities that are Often Missed
Detectify Crowdsource is not your average bug bounty platform. It’s an invite-only community for ethical hackers passionate about securing modern technologies and end users. Crowdsource …