How a GraphQL Bug Resulted in Authentication Bypass
What Is an Authentication Bypass Vulnerability? An authentication bypass vulnerability is a weakness in a system that fails to protect against unauthenticated access, allowing an…
Category: Mix
Once Again, Docker Addresses API Vulnerability
Summary A significant vulnerability (CVE-2024-41110) was recently discovered in Docker Engine version 18.09.1.Although the issue was identified and fixed in 2019, the patch did not…
Hidden XSS? No User Interaction!
@kinugawamasato가 정말 멋진 페이로드를 가지고 왔습니다. 최근 글 XSS Bypass: alert_?_(45)에서 이야기 드렸듯이 요즘 XSS 벡터에 대한 리서치가 활발해지고 있는데요, 드디어 Hidden XSS에서 사용자 인터렉션을…
Lessons from HackerOne’s First Recharge Week
Our first-ever Recharge Week – July 1–5, 2024—aimed at giving most company employees a simultaneous week off to rest, pursue hobbies, and spend time with…
How to Use Pentesting for HIPAA Security Compliance
HIPAA regulatory standards outline the lawful use, disclosure, and safeguarding of protected health information (PHI). Any organization that collects or handles PHI must comply with…
Simple, Focused, and Effective: Obsidian Daily Note Setup
.bh__table, .bh__table_header, .bh__table_cell { border: 1px solid #C0C0C0; } .bh__table_cell { padding: 5px; background-color: #FFFFFF; } .bh__table_cell p { color: #2D2D2D; font-family: ‘Helvetica’,Arial,sans-serif !important; overflow-wrap:…
Hack My Career: Meet Naz Bozdemir
We talked to Naz Bozdemir, Product Marketing Lead, about her unique path and asked her to share insights into her career. From International Relations to…
Custom Inbox Enhancements: Revolutionizing Vulnerability Management for Enterprises
Introducing Custom Inboxes Custom Inboxes provide our enterprise customers with unparalleled flexibility in report management. Now, organizational administrators can create, remove, and edit up to…
How Can Deliberately Flawed APIs Help In Mastering API Security? –
In our recent webinar, we delved into the concept of creating an API security playground tailored for both developer and security teams. The core idea…
JNDI Injection Remote Code Execution via Path Manipulation in MemoryUserDatabaseFactory
In this blog post, I’m going to describe a relative new vector to achieve remote code execution via a JNDI Injection that I found independently…
Two of Wallarm’s Open-source Tools Have Been Accepted into Black Hat Arsenal 2024 –
We’re gearing up with some seriously cool stuff for Black Hat! But first, a little sneak peek – not just one, but TWO of Wallarm’s…
How HackerOne Organizes a Remote Hack Week
This year’s Hack Week was dedicated to artificial intelligence (AI), and teams worked together to problem-solve and explore new projects, keeping this theme in mind.…