A malicious actor could steal a first-party access token of the Oculus application which he could use to access the<p>Continue readingAccount takeover of Facebook/Oculus accounts due to First...
A malicious actor could steal a first-party access token of the Oculus application which he could use to access the<p>Continue readingAccount takeover of Facebook/Oculus accounts due to First...
This bug could allow a malicious actor to takeover Facebook/Meta accounts if the user decided to play a Canvas game.<p>Continue readingAccount Takeover in Canvas Apps served in Comet due to f...
Update: Voting is now closed, and the panel vote is in progress. Nominations are now open for the top 10 new web hacking techniques of 2022! Every year, security researchers share their latest f
While we were visiting the University of Maryland, we came across a fleet of electric scooters scattered across the campus and couldn’t resist poking at the scooter’s mobile app. To our surprise, o...
When is copy-paste payloads not self-XSS? When it’s stored XSS. Recently, I reviewed a Zoom’s code to uncover an interesting attack vector.
In this post, we’ll briefly review how service worker hijacking works, then introduce a variant that can be triggered via DOM clobbering thanks to a quirk in document.getElementById(). Understandin...
I've been doing bug bounties for over 10 years now and over time, I have grown fonder of the life changing effects it has had for me. From job prospects, to being able to financially support t...
New tool from Intigriti helps ensure your security program receives the attention it deserves Intigriti has launched Bug Bounty Calculator, a free-to-use tool to help bug bounty program owners make...
The story of how I could steal credentials on Infosec Mastodon with a HTML injection vulnerability, without needing to bypass CSP. Everybody on our Twitter feed seemed to be jumping ship to the inf...