A bug bounty program, also known as a vulnerability rewards program (VRP), is a crowdsourcing initiative that rewards individuals for discovering and reporting software bugs. As part of an organization’s vulnerability management strategy, bug bounty programs are frequently initiated to supplement internal code audits and penetration tests. Many software vendors and websites have bug bounty […]
Is bug bounty a full-time job? Read More »
The development of cloud computing architectures has forced businesses to reconsider how they expand their applications. Companies were encouraged to abandon full-stack application deployment via infrastructure such as virtual machines in favor of a microservices strategy based on APIs built of numerous interoperating services. The market for APIs is growing, and so is the threat
Is an API gateway sufficient for security? Read More »
Bounty hunting is still a popular business, according to a recent report, with the vast majority of ethical hackers wanting to do more. According to a survey, 96 percent of respondents wanted to spend more time bounty hunting, with two-thirds considering it a full-time job. The biggest draw, according to nearly half of those polled,
The Most Recent Bug Bounty Programs For July 2022 Read More »
An attacker’s life is made easier by revealing system information, which provides them with a playbook of vulnerabilities to probe for. Although it may not be possible to completely obscure your technology stack, a few simple steps can deter most attackers. Scrub any debug or error information that may reveal what is happening behind the
What is Banner Information Leak Vulnerability? Read More »
Some smartphone attacks necessitate physical access to the device and interactions with the touchscreen. So, as long as no one touches your phone, it’s safe, right? Wrong, according to a new study by security researchers from Zhejiang University in China and the Technical University of Darmstadt in Germany. The paper (PDF), which will be presented
The Heartbleed Bug is a serious flaw in the widely used OpenSSL cryptographic software library. This flaw allows information to be stolen that would otherwise be protected by the SSL/TLS encryption used to secure the Internet. SSL/TLS ensures Internet communication security and privacy for applications such as web, email, instant messaging (IM), and some virtual
What is Heartbleed OpenSSL Vulnerability? Read More »
A security researcher Paulos Yibelo discovered an interesting, albeit incomplete, technique for circumventing CSP (Content Security Policy) controls using WordPress which is marked as a critical vulnerability. The hack, discovered by security researcher Paulos Yibelo, is based on exploiting the same-origin method execution and went public with the findings through a technical blog post. To
WordPress CSP Bypass Exploit Read More »
Systems that implement a proper user management system include a Forgot Password service that allows the user to request a password reset. Despite the fact that this functionality appears to be simple and easy to implement, it is a common source of vulnerabilities, such as the well-known user enumeration attack. To protect the forgot password
Forgotten Password Cheat Sheet for Developers Read More »
What Is a SOAP API? SOAP is a standard communication protocol system that allows processes running on various operating systems such as Linux and Windows to communicate using HTTP and its XML. SOAP-based APIs are intended for the creation, recovery, updating, and deletion of records such as accounts, passwords, leads, and custom objects. SOAP APIs
SOAP’s Top Vulnerabilities Read More »
Cookies can be restricted based on their domain or path. This check just looks at domain scope. A cookie’s domain scope specifies which domains may access it. A cookie, for example, can be rigidly scoped to a subdomain, such as www.nottrusted.com, or loosely scoped to a parent domain, such as nottrusted.com. In the latter situation,
What is Loosely Scoped Cookie Vulnerability? Read More »
