/r/websec
In a world that is increasingly online Web Security takes on an important role. The exploitation of a single popular web server can be used to infect hundreds or thousands of individuals, compromise user identities, and otherwise add a lot of ick to someone's day.
Websec was created as a forum for discussed all web based vulnerabilities. This includes attacks directly against websites (XSS, SQL Injection, CSRF, code injection) as well as those that target infrastructure (DNS-based attacks, mitm). This intention is to go beyond just the basics for people who need practical knowledge (either as developers or hosts) to keep their projects secure.
We also encourage the discussion of active exploits, particularly in situations where the affected party was unresponsive. As the goal is education, novel approaches and explanations are appreciated.
/r/websec
I need to find out if the code they want me to run contains any vulnerabilities or malware. This is typically for an interview.
I know the basics of web development and I have just begun my learning in Web security. I’m following the Web Application Hackers Handbook. What can I do so that I gain hands-on experience?
I have a very basic question to ask regarding the web-security.
I have asked this question bcoz I have seen so many things that you can do while you are working with a local server over http://
protocol but such features ain't available with the file:///
scheme (directly opening an HTML
file into a browser with file:///
scheme). I know, such features are restricted over file:///
scheme due to security vulnerabilities.
Assume that someone is accessing his HTML
webpage locally using file:///
protocol and he is not using a local server to access or view an HTML
webpage, then how allowing many features of https://
protocol to a file:///
scheme as well can introduce security vulnerabilities?
I already tried to ask chatgpt but didn't get any practical examples that make sense.
Plz, can someone explain it with some examples?
Hi everyone,
I hope you're all doing well!
I wanted to share a tool that could be very useful for those of you building web and mobile applications, especially when it comes to securing your APIs.
We all know that the security aspect of most websites is often under-tested. Attackers can bypass the UI and call APIs directly, extracting more information than intended and discovering business logic vulnerabilities.
What if you could remove your APIs and source code from the attackers' landscape entirely? Codesealer does just that with end-to-end API encryption. By concealing all API endpoints behind an opaque /x endpoint and encrypting all API requests beyond TLS, it prevents request forgery and manipulation.
And all this without any code changes on your side. Sounds cool?
I'd love to hear your thoughts on this approach.
Just released pphack, a CLI tool for scanning websites for client-side prototype pollution vulnerabilities.
Try it at https://github.com/edoardottt/pphack.
If you want to provide any feedback or you have doubts just open an issue :)
If we are not logged in to any web page, then what all test cases can we perform for pentesting process?
If anyone here is interested in code review based testing then you should check out the Patchstack bug bounty program, which pays bounties for vulnerabilities found in any WordPress plugins (more than 60K in WP.org repo).
There are guaranteed bounties that are paid out each month based on research score and just for November alone they set up over $4000 USD for those who report new vulnerabilities. There are also individual bounties for specific vulnerability types, etc.
I think it’s a great way to get started with bug hunting and maybe earn your first $ and CVE. Patchstack itself btw also assigns CVEs (is one of the biggest CVE assigner in the world). It could also be a good change for the more seasoned bug bounty hunters who have been doing blackbox testing and want to try something different and more in the direction of whitebox / code review.
The recent event announcement: https://x.com/patchstackapp/status/1723241552997159145
The bounty program website: https://patchstack.com/alliance/
There is also an active discord community where most of the info is posted: https://discord.gg/Xe2T5JjKbn