ctf-writeups ↳ https://ift.tt/2pL8ORv ctf-writeups Google CTF Finals 2019 Pwn...

ctf-writeups

↳ https://github.com/netanel01/ctf-writeups

ctf-writeups Google CTF Finals 2019 Pwn Gomium…

from Hack+ https://ift.tt/2WUVvd4
via IFTTT

Developers: It’s super easy to bypass Android’s hidden API restrictions ↳...

Developers: It’s super easy to bypass Android’s hidden API restrictions

↳ https://www.xda-developers.com/android-development-bypass-hidden-api-restrictions/

Flashback to over a year ago, and we’re all excited about seeing what’s to come in the Android P betas. Users are looking forward to new features, and developers are looking forward to some new tools to make their apps better….

from Hack+ https://ift.tt/2WXFjaZ
via IFTTT

Bypassing GitHub’s OAuth flow ↳...

Bypassing GitHub’s OAuth flow

↳ https://blog.teddykatz.com/2019/11/05/github-oauth-bypass.html

For the past few years, security research has been something I’ve done in my spare time. I know there are people that make a living off of bug bounty programs, but I’ve personally just spent a few hours here and there whenever I feel like it….

from Hack+ https://ift.tt/2CDgd8h
via IFTTT

A Deep Dive On The Most Critical API Vulnerability ↳...

A Deep Dive On The Most Critical API Vulnerability

↳ https://medium.com/@inonst/a-deep-dive-on-the-most-critical-api-vulnerability-bola-1342224ec3f2

In this article I dig into the details about Broken Object Level Authorization (BOLA) — the most common and most severe API vulnerability today according to the OWASP API Security Project. Insecure Direct Object Reference (IDOR) and BOLA are the same thing….

from Hack+ https://ift.tt/36JPnce
via IFTTT

Bypassing Access Control in a Program on Hackerone !! ↳...

Bypassing Access Control in a Program on Hackerone !!

↳ https://medium.com/@pig.wig45/bypassing-access-control-in-a-program-on-hackerone-ef213ab34703

This blog is about a vulnerability that I found in a program on hackerone i.e. Wakatime.It is a platform for developers and has an active bug bounty program on hackerone. So, first I started by creating two accounts on their platform using two different email id’s….

from Hack+ https://ift.tt/2Nto5iM
via IFTTT

How I was able to delete Google Gallery Data [IDOR] ↳...

How I was able to delete Google Gallery Data [IDOR]

↳ https://medium.com/@yogeshtantak7788/how-i-was-able-to-delete-google-gallery-data-idor-53d2f303efff

Hi,This is Yogesh Tantak a Security Researcher from India. Today I am writing about a critical bug that I found in Google’s new Product “Gallery”. This bug could allowed a malicious user to delete all collection from Gallery.io or Google gallery app….

from Hack+ https://ift.tt/33xH2pV
via IFTTT

Abusing HTTP hop-by-hop request headers ↳...

Abusing HTTP hop-by-hop request headers

↳ https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers

In this writeup, I will be covering techniques which can be used to influence web systems and applications in unexpected ways, by abusing HTTP/1.1 hop-by-hop headers….

from Hack+ https://ift.tt/32wwvu2
via IFTTT