Below you will learn in detail about the discovered vulnerability that allowed me to get about 15000$ in bounty with all secrets from the…

I will be discussing how I was able to leverage an Improper Access Control Vulnerability to a Privilege Escalation Vulnerability on one…

I will be discussing an interesting observation on how policies implemented on Auth Endpoint could backfire and turn into massive DoS…

The bug bounty industry can be considered as one of the most competitive industries. The combination of evolving technologies as well as…

Cross-Site Request Forgery (CSRF) was one of the first vulnerabilities that I learned at the beginning of my Bug Bounty journey. Combined…

Introduction to Bug Bounty along with First Valid Submission

بسم الله الرحمن الرحيم In the name of Allah, the Compassionate, the Merciful

بسم الله الرحمن الرحيم In the name of Allah, the Compassionate, the Merciful

بسم الله الرحمن الرحيم
In the name of Allah, the Compassionate, the Merciful

بسم الله الرحمن الرحيم In the name of Allah, the Compassionate, the Merciful

بسم الله الرحمن الرحيم
In the name of Allah, the Compassionate, the Merciful

Bismillahi-r-Rahmani-r-Rahim
(In the name of Allah, the Compassionate, the Merciful)
Assalamu Alaikum (peace be upon you)

بسم الله الرحمن الرحيم

Assalamu Alaikum

Automating REST Security Part 3: Practical Tests for Real-World APIs If you have read our two previous blogposts, you should now have a goo...

Our previous blog post described the challenges in analyzing REST API implementations. Despite the lack of REST standardization, we learned ...

Although REST has been a dominant choice for API design for the last decade, there is still little dedicated security research on the subjec...

In July 2020, we introduced a novel attack class called Shadow Attacks . In our recent research, we discovered a new variant of the attack w...

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TL...

In this post, Christian Fries shows an approach to unveil security flaws in OpenID Connect Certified implementations with well-known attack...