Cross-Site Request Forgery (CSRF) was one of the first vulnerabilities that I learned at the beginning of my Bug Bounty journey. Combined…

Introduction to Bug Bounty along with First Valid Submission

بسم الله الرحمن الرحيم In the name of Allah, the Compassionate, the Merciful

بسم الله الرحمن الرحيم In the name of Allah, the Compassionate, the Merciful

بسم الله الرحمن الرحيم
In the name of Allah, the Compassionate, the Merciful

بسم الله الرحمن الرحيم In the name of Allah, the Compassionate, the Merciful

بسم الله الرحمن الرحيم
In the name of Allah, the Compassionate, the Merciful

Bismillahi-r-Rahmani-r-Rahim
(In the name of Allah, the Compassionate, the Merciful)
Assalamu Alaikum (peace be upon you)

بسم الله الرحمن الرحيم

Assalamu Alaikum

Automating REST Security Part 3: Practical Tests for Real-World APIs If you have read our two previous blogposts, you should now have a goo...

Our previous blog post described the challenges in analyzing REST API implementations. Despite the lack of REST standardization, we learned ...

Although REST has been a dominant choice for API design for the last decade, there is still little dedicated security research on the subjec...

In July 2020, we introduced a novel attack class called Shadow Attacks . In our recent research, we discovered a new variant of the attack w...

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TL...

In this post, Christian Fries shows an approach to unveil security flaws in OpenID Connect Certified implementations with well-known attack...

This blog post is aimed to express and explain my surprise about Signal being more secure than I thought (due to receipt acknowledgments). ...

As you might have heard, we recently got our paper on padding oracle attacks accepted to the USENIX Security Conference. In this paper, we ...

In the last two years, we changed the TLS-Attacker Project quite a lot but kept silent about most changes we implemented. Since we do not h...

One year ago, we received a contract as a PDF file. It was digitally signed. We looked at the document - ignoring the "certificate is not tr...

We found out that reusing a key pair across different versions and modes of IPsec IKE can lead to cross-protocol authentication bypasses, e...