usedleft.blogg.se

1. #SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT HOW TO#
2. #SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT PDF#
3. #SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT MANUAL#
4. #SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT ANDROID#
5. #SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT PLUS#

#SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT MANUAL#

The project consisted of a manual application security assessment against HEY’s web platform and its APIs, mobile (Android, iOS) and desktop (ElectronJS-based) applications. The security audit summary (SAS) for this engagement is now available.

#SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT ANDROID#

The findings include a number of information exposure vulnerabilities, insecure design, and security misconfiguration issues found across the three HEY clients and the main API service, in addition to several medium severity findings affecting the multi-factor authentication mechanism (2FA bypass), the Gopher caching service (Server Side Request Forgery, Stored Cross-Site Scripting) and the Android mobile application (Insecure File Content Provider). We also demonstrate how chaining three vulnerabilities discovered during this engagement would allow an attacker to compromise the user’s workstation when using HEY for Desktop.ĭownload the HEY audit summary deliverable: Doyensec_Basecamp_HEY_PlatformTesting_Q32020_SAS.pdfĭuring our research on ReDoS, Doyensec reported several vulnerabilities: #HOPPER DISASSEMBLER NODEJS ANDROID#

#SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT PLUS#

#SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT PDF#

We will update this list on Regexploit's Github page.ĭownload the presentation PDF file: Villamil-Modern-Web-Security-Assertions.pdf Modern web security is a mix of relatively recent frameworks, methods, languages, and abstractions. The age of injection bugs has come and gone. This age is widely defined by business logic flaws. On a deeper level this age is governed by the security auditor's skill in creating and breaking assertions in the target. Assertions come from any source and they represent statements of security or functionality made by the target. We'll talk about our experience auditing modern web applications over the last three years.

We'll talk about the current state of web application security, how its evolved, and where its going. Our goal is to introduce the age of assertions into the zeitgeist and provide auditors a more refined way of thinking beyond injection bugs.ĭownload the presentation PDF file: Covalence-2020-Carettoni-DemocratizingElectronSecurity.pdf We give examples of assertions (big and small) created and broken during various security audits and the value this brought to the customer. We love Electron.js so much, that we break it.

Since 2017, we have audited dozens of Electron-based applications and witnessed a remarkable commitment to security. Back then, breaking the framework’s security mechanisms wasn’t too difficult. Fast forward to 2020, Electron.js is getting better, secure-by-default settings are slowly becoming the norm, vulnerability disclosure is handled with consolidated practices, and the dev community is gradually learning all common pitfalls. It is better, but there is still a long road ahead. Responsibilities must be equally shared between core contributors and application developers. While the most effective way to bring security capabilities to everyone is to have them built into the framework, it is also important to have a community that considers security as a core value. Closing the web-native desktop gap is not trivial as we have to balance security with usability and framework flexibility. In this talk we want to celebrate the progress made and discuss the technical challenges that both Electron.js maintainers and application developers are facing when building secure desktop applications.

#SCRATCHPAD SALESFORCE 13M SERIES VENTURESSAWERSVENTUREBEAT HOW TO#

We will show common vulnerabilities and misconfigurations, discuss root causes and provide practical tips on how to mitigate existing attacks. If you care about Electron.js security, this talk is for you! #HOPPER DISASSEMBLER NODEJS HOW TO# Since the first commit back in 2016, burp-rest-api has been the default tool for BurpSuite-powered web scanning automation.