"Inter-application" vulnerabilities - hunting for bugs in..."
summary
Research shows bugs that span components yield high payoff: using Google dorks, account registration, base64 decoding and simple active scanning uncovers issues like reflected XSS from a desktop app license/forgot-password GET that reveals emails, RFC-quoted email registration causing persistent XSS across subdomains, and email/SMS spoofing via modified Host headers. Tests result in 27 unique vulnerabilities in 11 months with an unusually high 44% acceptance rate and payouts (examples around $1,000); integration points and email flows require real security testing.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:57Speaker background
- 10:52Inter-application vulnerabilities
- 12:59First real-life example
- 19:59Second vulnerability case
- 25:47Email-based attacks
- 31:40Takeaways and advice
- 35:42Research summary
- 36:13Q&A session
related talks
37mStranger Danger: Finding Security Vulnerabilities Before They Find You!
30mHow to hack a web app?
46mLive hacking: Breaking into your Java web app
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
43m Web Application Vulnerability Scanners: An Intro & Discussion
55mBreaking and Fixing Web Application Security
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively