I need to find out if the code they want me to run contains any vulnerabilities or malware. This is typically for an interview.

I know the basics of web development and I have just begun my learning in Web security. I’m following the Web Application Hackers Handbook. What can I do so that I gain hands-on experience?

I have a very basic question to ask regarding the web-security.

I have asked this question bcoz I have seen so many things that you can do while you are working with a local server over http:// protocol but such features ain't available with the file:/// scheme (directly opening an HTML file into a browser with file:/// scheme). I know, such features are restricted over file:/// scheme due to security vulnerabilities.

Assume that someone is accessing his HTML webpage locally using file:/// protocol and he is not using a local server to access or view an HTML webpage, then how allowing many features of https:// protocol to a file:/// scheme as well can introduce security vulnerabilities?

I already tried to ask chatgpt but didn't get any practical examples that make sense.

Plz, can someone explain it with some examples?

Hi everyone,

I hope you're all doing well!

I wanted to share a tool that could be very useful for those of you building web and mobile applications, especially when it comes to securing your APIs.

We all know that the security aspect of most websites is often under-tested. Attackers can bypass the UI and call APIs directly, extracting more information than intended and discovering business logic vulnerabilities.

What if you could remove your APIs and source code from the attackers' landscape entirely? Codesealer does just that with end-to-end API encryption. By concealing all API endpoints behind an opaque /x endpoint and encrypting all API requests beyond TLS, it prevents request forgery and manipulation.

And all this without any code changes on your side. Sounds cool?

I'd love to hear your thoughts on this approach.

Just released pphack, a CLI tool for scanning websites for client-side prototype pollution vulnerabilities.

• Fast (concurrent workers)
• Default payload covers a lot of cases
• Payload and Javascript customization
• Proxy-friendly
• Support output in a file
• Rate-limit supported

Try it at https://github.com/edoardottt/pphack.

If you want to provide any feedback or you have doubts just open an issue :)

If we are not logged in to any web page, then what all test cases can we perform for pentesting process?

If anyone here is interested in code review based testing then you should check out the Patchstack bug bounty program, which pays bounties for vulnerabilities found in any WordPress plugins (more than 60K in WP.org repo).

There are guaranteed bounties that are paid out each month based on research score and just for November alone they set up over $4000 USD for those who report new vulnerabilities. There are also individual bounties for specific vulnerability types, etc.

I think it’s a great way to get started with bug hunting and maybe earn your first $ and CVE. Patchstack itself btw also assigns CVEs (is one of the biggest CVE assigner in the world). It could also be a good change for the more seasoned bug bounty hunters who have been doing blackbox testing and want to try something different and more in the direction of whitebox / code review.

The recent event announcement: https://x.com/patchstackapp/status/1723241552997159145

The bounty program website: https://patchstack.com/alliance/

There is also an active discord community where most of the info is posted: https://discord.gg/Xe2T5JjKbn