Laxman Muthiyah, an Indian security researcher, earned $30,000 for finding a serious flaw in the Instagram password reset mechanism. If exploited, the flaw would have let an attacker gain control over any Instagram account in 10 minutes with an investment of approximately $150. The flaw…
Misconfiguration Causes a Leak of One Hundred Million Financial Records
According to a statement by Capital One released on July 19, an unauthorized party gained access to the company’s customer data: approximately 106 million individuals in the United States and Canada. Data was stored in Amazon S3 buckets but accessed using Capital One infrastructure. Capital…
Dynamic Program Analysis and Static Code Analysis in Web Security
There are two primary approaches to analyzing the security of web applications: dynamic program analysis (dynamic application security testing – DAST), also known as black-box testing, and static code analysis (static application security testing – SAST), also known as white-box testing. Both approaches have their…
How Regular Expressions and a WAF DoS-ed Cloudflare
Cloudflare is one of the biggest providers of content delivery network services in the world. On July 2, they experienced a nearly complete service outage that affected all of their customers and lasted approximately half an hour. This unprecedented event was not a result of…
Chrome Removes XSS Protection
On July 15, Google announced that the XSS Auditor module that protects Chrome users against Cross-site Scripting attacks is to be abandoned. It was found to be easy to bypass, inefficient, and causing too many false positives. A similar mechanism was previously used by Microsoft…
SQL Injection Compromises Entire Country
On July 16, the world found out that the tax data of millions of Bulgarian citizens have been stolen. The attacker sent half of the data as proof to many Bulgarian and international media sources. The stolen databases are already available for download via underground…
What Is a CSRF Attack
Cross-site Request Forgery (CSRF/XSRF), also sometimes called sea surf or session riding, refers to an attack against authenticated web applications using cookies. The attacker is able to trick the victim into making a request that the victim did not intend to make. Therefore, the attacker…
Does YouTube Ban Hacking Videos?
A wave of dissatisfaction with Google’s YouTube policies has recently spread around the ethical hacking and ethical hacking software community. On July 2, Kody Kinzie who runs the Null Byte channel on YouTube reported that he was denied the right to upload a new security…
What is the High Orbit Ion Cannon
The High Orbit Ion Cannon (HOIC) is an open source network stress testing application available on Sourceforge.net. It is most often used by hacktivists as an attack tool for denial of service (DoS) and distributed denial of service (DDoS) attacks. It is the successor of…