Collaborate Disseminate
Over a year ago, I have reported a few security vulnerabilities to one of the top bug bounty programs on HackerOne. All of them have been quickly triaged as critical, but no progress was made towards their resolution. I have repeatedly pin… Continue reading What to do if bug bounty program is unresponsive?
By Saad Rajpoot
The Chess.com vulnerability could have been exploited to access any account on the site including the administrator account.
This is a post from HackRead.com Read the original post: Vulnerability in Chess.com allowed access to 50 Millio… Continue reading Vulnerability in Chess.com allowed access to 50 Million user records
I found a clickjacking issue in a site and the site security team said me that i would require unusual user interaction. So I wrote a code above the iframe but I was not successful in achieving it.
The site had two sensitive buttons which … Continue reading Automating Clickjacking Attack
Ethical hacker Alex Birsan developed a way to inject malicious code into open-source developer tools to exploit dependencies in organizations internal applications. Continue reading Supply-Chain Hack Breaches 35 Companies, Including PayPal, Microsoft, Apple
Beware pseudo-geeks bearing ‘gifts’. Continue reading Beware of technical “experts” bombarding you with bug reports
It’s not that unusual for a company to reward you handsomely if you find a vulnerability that could have lost them millions of dollars, but it’s not often you also get the CTO offering to get a tattoo in your honour… Continue reading Thanks for finding a critical bug. Have a $1.5 million bounty, and our CTO will get a tattoo of anything you like
How is the reward amount determined on different bug bounty platforms like Bugcrowd, HackerOne or Synack?
As a bug bounty program owner I can maybe define some rules for the rewards. What are the common, established rules and how do the di… Continue reading What are criteria and rules to determine bug bounty amounts? [closed]
By Waqas
The vulnerability which has now been fixed by TikTok existed in its “Find Friends.”
This is a post from HackRead.com Read the original post: TikTok vulnerability allowed hackers to access users’ phone numbers
Continue reading TikTok vulnerability allowed hackers to access users’ phone numbers
If an application’s code contains even minor and subtle inaccuracies, it can open up the entire database to SQL injection. In this example (see section ‘Delete All Method’), the entire Users table gets deleted with a trivial SQL injection … Continue reading Could bug bounty hunting accidentally cause real damage?
Last year was challenging for all of us, both as companies and as individuals. We had to adapt to new norms, including the shift to remote work and increased dependence on the internet and other digital means. Unfortunately, those new norms are heavil… Continue reading Human and Software Flaws Leave Remote Workers Vulnerable