Grzegorz Goławski

[Grzegorz Goławski @ggolawski]

@bas_van_schaik @JLLeitschuh Thank you! It was a pleasure.

[GitHub Security Lab @GHSecurityLab]

https://t.co/z7WPg3HtJY (CodeQL query to detect XSLT injections) was received under the All For One bounty program and is now merged! Congrats @ggolawski! Want to contribute and be rewarded? See https://t.co/UsVq1OUOew

[Grzegorz Goławski @ggolawski]

I've recently found and reported couple of LDAP injection vulnerabilities:
- CVE-2020-1958 in Apache Druid
- CVE-2020-9495 in Apache Archiva
- CVE-2020-5246 in Traccar
- CVE-2020-5281 in Perun
Here's the writeup about the first one, CVE-2020-1958 in Druid: https://t.co/wc5OiIo3RD

[Bug Bounty Reports Explained @gregxsunday]

Today's video is an explanation of how does the @GHSecurityLab work and what is #CodeQL based on the query written by @ggolawski to find LDAP injection in Java apps that was rewarded $3,000. Enjoy!
#bugbountytip #bugbountytips #bugbounty
https://t.co/FLeGtdWWG7

[Grzegorz Goławski @ggolawski]

My first CVE. High severity LDAP injection in Apache Druid. Writeup soon.

[Open Source Security mailing list @oss_security]

[CVE-2020-1958]: Apache Druid LDAP injection vulnerability: Posted by Jonathan Wei on Apr 01Severity: High Vendor: The Apache Software Foundation Versions Affected: Druid 0.17.0 Description: When LDAP authentication is enabled: - Callers of Druid APIs… https://t.co/wHs0KqZxfX

[GitHub Security Lab @GHSecurityLab]

Join the GitHub Security Lab Slack workspace, to know more about our bounty programs, to learn how to write CodeQL, to give feedback , and to discuss all things security: https://t.co/Y2UuoZEJXU

[Grzegorz Goławski @ggolawski]

@GHSecurityLab Thanks! It's a pleasure to work with you :)

[GitHub Security Lab @GHSecurityLab]

Awesome CodeQL query from @ggolawski that detects many variants of LDAP Injections in Java: Plain Java JNDI, UnboundID, Spring LDAP and Apache LDAP API. We are pleased to award him our maximum bounty reward $3000
https://t.co/rvdMkektz2

[ZaufanaTrzeciaStrona @zaufanatrzeciastrona@infosec @Zaufana3Strona]

Jeśli chcecie posłuchać o podstawach bezpieczeństwa aplikacji WWW, to Grzegorz mówi bardzo składnie i przystępnie. https://t.co/ose8hvCAr6

[Confitura @confiturapl]

2017 - Grzegorz Goławski - Podstawy bezpieczeństwa aplikacji webowych: https://t.co/P2e3A7emr2 via @YouTube