AppSec Wiki

An initiative to provide Application security related resources to Security Researchers by @exploitprotocol

[Web Security Academy @WebSecAcademy]

We've added a huge new topic, on XXE (XML external entity) injection. Lots of new content and 9 new labs!
https://t.co/JlL0rC4cvg

[AppSec Wiki @appsecwiki]

@VickyChawla6 Just corrected it, thanks for notifying me.

[Guled Abdilahi @0xGuled]

@marcusjcarey @jdubm31 @appsecwiki has one of the most comprehensive and high quality appsec resources I have seen. I am using it now to learn AppSec https://t.co/Px4DpvqHUi

[AppSec Wiki @appsecwiki]

Added a DevSecOps section in @appsecwiki with some intial links. Will continue to add more resources as i learn more about it.

Please add links/resources you are aware of. Thanks!

https://t.co/Ljf8IKT86m

[André Baptista @0xacb]

GitHub Desktop RCE (OSX) Bug Bounty writeup:

https://t.co/yodEPrbSeC

Thank you @GitHubSecurity for the bounty!

[Soroush Dalili @irsdl]

Story of my two (but actually three) RCEs in SharePoint in 2018: https://t.co/WRH0oYcc8N - it all began with a simple question in Jan. 2018: "have you worked with ysoserial .net?" what a year! Glad https://t.co/QdC0vrG8Xh is in Top 10 Web Hacking Techniques of 2017 @pwntester

[Sam Curry @samwcyo]

New write up - "Reading ASP secrets for $17,000" - the really fun process of exploiting local file disclosure 🧐
https://t.co/JIzkytum1b

[Aditya Agrawal @exploitprotocol]

For better management of content, i have shifted all content of https://t.co/YpwVUJkocy to @appsecwiki now.

Apart from the existing content, Report/Writeups section is added. (https://t.co/ybrd6OWtJ2)

Planning to release some useful content next month. Stay Tuned 😉

[James Kettle @albinowax]

There's a common misconception that 'X-Frame-Options: allow-from hxxp://example.com/' prevents framing. In fact, this isn't secure because Chrome doesn't support allow-from and never will: https://t.co/89BFnY1Y3p

So you can stop reporting Burp's XFO check as a false positive :)

[Jobert Abma @jobertabma]

Hackers, minor cool insight that I gained some time ago and found a vulnerability with: when you're looking at an asset that may use a microservices architecture, look for IDOR vulnerabilities using path traversal. E.g. https://example/?id=1/../2. See thread. #TogetherWeHitHarder

[Aditya Gujar @fyoorer]

Remote Code Execution with EL injection #bugbounty #RCE https://t.co/eUvA6wDgFA

[AppSec Wiki @appsecwiki]

This is very interesting!

[mandatory.bsky.social @IAmMandatory]

Here are the slides from me and @LittleJoeTables's talk "Getting Buzzed on Buzzwords" (a talk on using cloud tech to vastly improve pen-testing activities): https://t.co/GOsAmsVLUh

CC @_devalias @riposte_sec @bishopfox

[Silent Signal @SilentSignalHU]

A small gift from S2anta: @breenmachine showed how to abuse JasperReports for RCE (https://t.co/eiyP760xKf) - now here's a single .JRXML file to achieve the same thing if no .JAR's are allowed:
https://t.co/kVgan1VpAy

[AppSec Wiki @appsecwiki]

@Adekanmbi001 Sure! Please have a look at https://t.co/7FovxkbovZ

[AppSec Wiki @appsecwiki]

@VickyChawla6 I just pushed a fix for it. Change will reflect in 5-10 minutes. Thanks for letting me know about it . 👍

[AppSec Wiki @appsecwiki]

We just shipped our first newsletter.

You can subscribe to newsletter at https://t.co/eWZ1x3ABkR if you have not already.

Here is the link to this week newsletter: https://t.co/uMoTdqdCri

Thanks!

[Jon Bottarini @jon_bottarini]

My latest #bugbounty writeup: A $2,500 IDOR in New Relic that allowed me to run NRQL queries and retrieve data from any New Relic account. You can read it here: https://t.co/GD6xqODEX0 Let me know what you think! #TogetherWeHitHarder #HackerOne

[AppSec Wiki @appsecwiki]

@VickyChawla6 Glad to know you liked it :)

[AppSec Wiki @appsecwiki]

@WawaSeb @abhibundela @HivarekarPranav @ehsahil @TwiceDi Thanks, will have a look :)

[Ebrahem Hegazy 🇵🇸 @Zigoo0]

An interesting #Google vulnerability that got me 3133.7 reward.

https://t.co/rliKZnP6OE