Collaborate Disseminate
I found a ᴄꜱʀꜰ case on coinexchange.io, I submitted a bug which was accepted 3 months ago and they said they will come back to ask for my identity verification for payment.
But I didn’t heard them back despite talking to the… Continue reading I submitted a bug for https://coinexchange.io which was accepted for payment and fixed but not paid. What’s next? [on hold]
Paying through bank transfer to other account without direct debit is more and more common these days.
Some of them are online services running bug bounties with availability of payment through bank transfer for the eurozone.
SEPA has a s… Continue reading How to check if direct debit whitelisting is in place for a specific account number?
There was a bug in Widevine last year which enabled downloading Encrypted Media Extension Content.
They stated that they would give full details after 90 days. Was this meant for public disclosure or full details only to a s… Continue reading Are the details about the Widevine bug now public?
There are multiple reports of a reᴄᴀᴘᴛᴄʜᴀ v2 bypass. Most of the time, the explanation is neural networks services provided by Google or ɪʙᴍ.
But there is something I am failing to understand: for most ᴄᴀᴘᴛᴄʜᴀ (including reᴄ… Continue reading How was Google recaptcha v2 bypassed several times?
I know more specific questions asked this for ajax and that the answer is no, but I’m wanting to see a broader and newer scope.
If I’m getting redirected to a random url through a http 302 redirect which again redirects to f… Continue reading How to catch http redirects programmatically?
I know more specific questions asked this for ajax and that the answer is no, but I’m wanting to see a broader and newer scope.
If I’m getting redirected to a random url through a http 302 redirect which again redirects to f… Continue reading How to catch http redirects programmatically?
If I set actions for logged in users to be performed through HTTP methods other than GET or POST, then Javascript HTTP requests respecting the Same Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS) is the only way t… Continue reading Is CSRF token validation required for http method other than POST and GET?
If I set actions for logged in users to be performed through HTTP methods other than GET or POST, then Javascript HTTP requests respecting the Same Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS) is the only way t… Continue reading Is CSRF token validation required for http method other than POST and GET?
Web browsers are off course checking that field, but some third party libraries for languages like perl don’t perform it (they check /keyUsage= but not /extendedKeyUsage=).
So for example, I would need a certificate authorit… Continue reading How test if a tool doesn’t check for /extendedKeyUsage=?
Is there a rsa modulus size where security starts to decrease or is a larger rsa keysize always better? (of course I’m considering things like performance penalty)