 extension that automates the assessment and exploitation of signed web tokens. Supporting various token types, including Django, Flask, and Express, it enables you to edit, sign, verify and attack these tokens. 

The extension features automatic detection and in-line editing of tokens within HTTP requests/responses and WebSocket messages. It includes prebuilt wordlists for default secret keys and salts, plus support for JSON-encoded strings and custom dictionaries. Users can save known keys for future attacks and modify signed tokens in Proxy and Repeater message editors.

Inline editing of tokens within HTTP requests/responses and WebSocket messages.

Includes default secret keys and salts, plus support for custom dictionaries and JSON-encoded strings.

Automates brute force attacks using known keys and different derivation techniques.

Supports multiple bypass attacks, including user claims, and Flask and Express claims.

 Detects and analyses unknown signed tokens using various hashing functions.

SignSaboteur can be installed from the BApp Store. A tab within the Repeater provides easy access to various functionalities, such as "Brute force", "Attack" and "Sign". The plugin settings, such as default implemented wordlists, can be found higher up in Burp Suite itself.

Case Study: Finding Secret Keys for Unknown Signed Web Tokens

Consider a scenario where you are testing an application that uses custom-signed web tokens for authentication. You need to determine the secret key used to sign these tokens to evaluate potential security flaws.

When dealing with unknown signed web tokens, SignSaboteur provides a robust method to identify and exploit potential vulnerabilities.

When you select "Unknown" in the "Enabled signers" menu, the extension looks for patterns that match the size of common hashing functions. Some message payloads might be incorrectly identified by SignSaboteur, and therefore require further manual inspection.

The extension supports various message and key derivation techniques used in brute-force attacks, eliminating the need for manual changes. To find the secret key of an unknown signed token:

Deep Mode: Includes slow hashing functions like Password-Based Key Derivation Function 2 (PBKDF2). Use this mode with caution, and only with small wordlists, as it can be time-consuming.

Includes slow hashing functions like Password-Based Key Derivation Function 2 (PBKDF2). Use this mode with caution, and only with small wordlists, as it can be time-consuming.

Account User Claims, Authenticated Claims, User Access Token Attacks

Some frameworks use account wrappers to store authenticated user information, which may require the use of authenticated claims for exploitation. SignSaboteur supports this by implementing 12 well-known authorisation flags.

The ‘User Access Token’ option generates a JWT OpenID Connect ID token signed with the same key and hashing algorithm without key derivation, simplifying the process of forging valid tokens.

These techniques provide multiple vectors for bypassing authentication and gaining unauthorised access to sensitive resources.

Username and Password Claims, Flask Claims, Express Claims Attacks

Applications often store user details using "username" and "password" JSON attributes. SignSaboteur can generate a placeholder token for an admin user using these attributes.

In Flask applications, client-side stored session information typically includes attributes like "

". The extension can create a session token for the first user, usually the admin.

Similarly, in Express applications the "passport" JSON attribute is used to store user details, and SignSaboteur can generate a placeholder for the admin user, facilitating privilege escalation.

SignSaboteur not only saves time by automatically detecting and editing tokens within HTTP requests and WebSocket messages, but also helps identify vulnerabilities that manual inspections might miss. Moreover, by using the extension’s pre-built wordlists to check for common weak secret keys and configurations, you can ensure a thorough security assessment while minimising the risk of server overload.

https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease

 https://portswigger.net/bappstore/e62afa49e12543edbfa9df498363153c

PimpMyBurp #11 – Master Signed Token Exploits with SignSaboteur

A 36-month countdown to compliance with the EU 

Vendors of products with digital elements (PDEs) now have three years to fulfil all the law’s security requirements – which are focused heavily on eliminating vulnerabilities – if they want to sell their devices or software in the world’s largest trading bloc.

Cyber Resilience Act timeline, scope and penalties

 in the Official Journal of the EU on Wednesday (20 November). This means the act enters into force from 10 December. However, to give regulated organisations more time to prepare, most of the act’s provisions will apply from 11 December 2027.

Depending on the gravity of the offence, violations could result in fines of up to €15 million, €10 million or €5 million, or, respectively, up to 2.5 %, 2% or 1.5% of an entity’s worldwide annual turnover (whichever is higher). Offending products could also be banned from sale within the single market.

PDEs are defined as any software or hardware that connects to networks or other devices. That definition covers the vast majority of modern devices, from smartphones, laptops and tablets to smart TVs, cameras and toys. There are certain exemptions for open-source software, and products covered by existing rules, such as medical, aviation and automobile products.

EU CRA focused on tackling ‘widespread vulnerabilities’

 in 2022 to address “a low level of cybersecurity” in digital products, the European Commission set out to tackle certain deficiencies above all. As well as observing a lack of security information provided to users, it noted “widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them.”

As a result, the European Cyber Resilience Act has a big focus on identifying, disclosing and fixing vulnerabilities.

For instance, products must arrive on the market in a secure-by-default configuration (with certain exceptions) and free from “known exploitable vulnerabilities”. Identifying the presence of known vulnerabilities is facilitated by the mandatory creation of a 

 (SBOM), which must cover a product’s top-level dependencies as a minimum.

Vulnerabilities should be addressed and remediated “without delay”, the CRA instructs.

Bug Bounty backed by the Cyber Resilience Act

The CRA requires that coordinated vulnerability disclosure policies (CVD policies or VDPs) are implemented to facilitate the external reporting of vulnerabilities, both directly to the vendor “and where requested anonymously, via CSIRTs”. There should also be a single point of contact to which vulnerability information can be relayed and where the CVD policy can be found.

Bug Bounty Programs are explicitly referenced as a vehicle for fulfilling CVD obligations. “Given the fact that information about exploitable vulnerabilities in widely used products with digital elements can be sold at high prices on the black market, manufacturers of such products should be able to use programmes, as part of their coordinated vulnerability disclosure policies, to incentivise the reporting of vulnerabilities by ensuring that individuals or entities receive recognition and compensation for their efforts,” reads the act. “This refers to so-called ‘bug bounty programmes’.”

The Cyber Resilience Act 2024 also urges member states to protect vulnerability researchers from legal harms by adopting “guidelines as regards the non-prosecution of information security researchers and an exemption from civil liability for their activities”.

Specific Cyber Resilience Act requirements are detailed for “high-risk AI systems”, including accounting for “AI specific vulnerabilities such as data poisoning or adversarial attacks, as well as, as relevant, risks to fundamental rights”.

Security updates should be distributed promptly, securely and free of charge, and be accompanied by security advisories, according to the CRA. Where applicable, they should be automatic or separate from functionality updates.

Once patches have been issued, manufacturers are obliged to publicly disclose remediated vulnerabilities, providing a description and information about impact, severity and remediation/mitigation. However, disclosure can be delayed to give users more time to apply patches where “manufacturers consider the security risks of publication to outweigh the security benefits”.

Manufacturers are also expected to notify Computer Security Incident Response Teams (CSIRTs) and ENISA, the EU cyber agency, about “severe incidents” and the active exploitation of vulnerabilities. These requirements apply in 21 months, from 11 September 2026.

Recognising the complexity of the threat landscape, lawmakers have designed the CRA to increase cyber-resilience both throughout the supply chain and lifecycle of digital products.

Vendors must handle vulnerabilities for a minimum support period of five years, unless the product’s lifetime expires sooner. Longer support periods are prescribed for typically long-life components like microprocessors, network devices and operating systems.

When support periods end, “manufacturers should consider releasing the source code of such products” to the public domain or “other undertakings which commit to extending the provision of vulnerability handling services”.

Other CRA requirements cover areas such as authentication, encryption, minimising attack surfaces, reducing the impact of cyber-attacks, and the collection of personal data.

Irrespective of their place of manufacture, PDEs must be compliant if they are sold in the EU single market, encompassing 27 member states plus Norway, Iceland and Liechtenstein. Alongside safety, health and environmental protection standards, CRA compliance is now a condition of bearing a CE mark.

The CRA forms a key plank of the EU’s recent drive to upgrade its cybersecurity framework. Other notable pillars are 

 (introduced a common certification framework for ICT products), 

NIS 2 (Network and Information Security) Directive

 (wide-ranging requirements for member states and ‘essential’ or ‘important’ services) and the 

 (ICT security rules for financial services firms).

These regulations all prioritise – in common with cyber laws emerging elsewhere in the world – a risk-based approach to understanding and minimising your attack surface, and proactively finding, fixing and remediating vulnerabilities.

YesWeHack crowdsourced security testing and VDP solutions can help you fulfil your compliance obligations in a scalable and cost-effective fashion. In particular:

 that provides agile security testing adapted to your development model, results-based pricing, in-house triage, seamless integration with your security tools and more secure development practices

 of our Bug Bounty and vulnerability management platform.

Cyber Resilience Act: compliance countdown set to start for EU law focused on eliminating vulnerabilities

Attack surface discovery: mapping your exposed vectors with continuous threat exposure management (CTEM)

Mapping an organization’s attack surface is the fundamental first step towards hardening exposed attack vectors.

From web applications to APIs and cloud infrastructure, 

 involves systematically identifying all your internet-facing assets.

Gaps in your inventory of online assets – the ‘known unknowns’ and//or ‘unknown unknowns’ – can exist due to misconfigurations, shadow IT, complex architectures, rapid digital transformation, siloed acquisition of tech, and inadequate asset management processes.

Automated vulnerability scans, pentesting engagements and, in particular, 

 offer effective risk mitigation for tackling your known risks. By definition, they cannot include unknown assets.

But conducting attack surface discovery in an automated and exhaustive fashion, you can then identify, prioritise and fix vulnerabilities across all possible attack vectors, including previously hidden assets.

Yet if the mantra “you cannot secure what you cannot see” is widely understood, far too many CISOs nevertheless have only a patchy overview of their attack surface. More than two thirds of organisations have admitted to having been compromised via an unknown or poorly managed internet-facing asset (IBM report, 2021).

Without the right attack vector analysis tools, InfoSec teams can struggle to identify – let alone secure – their proliferating online assets.

According to TechTarget, 62% of organizations’ attack surfaces have increased over the past two years as organisations launch new apps and websites, store more data in the cloud, add new third-party integrations, use IoT devices and so on. Frequent software updates also heighten the risk of assets going online, or inadvertently remaining online, without security teams realising.

The merits of CTEM in attack surface discovery

So what’s the best way to perform attack surface mapping?

There are many methods and attack surface discovery tools for ascertaining your potential attack vectors: manual network architecture reviews, user access reviews, network scanners, asset management tools, Cloud Security Posture Management (CSPM) tools, attack surface domain discovery tools and Security Information and Event Management (SIEM) systems to name a few.

When it comes to achieving a unified, comprehensive and real-time overview of your internet-facing assets, an increasingly essential model is Continuous Threat Exposure Management (CTEM).

CTEM is a five-step automated process for continuously monitoring an organisation’s environment for new attack vectors, discovering the attack surface’s exposure to vulnerabilities, and remediating the most critical weaknesses first. Implemented well, this can provide a unified, comprehensive and risk-based approach to security testing.

Given your constantly evolving attack surface and the persistent probing of malicious hackers, this continuous and real-time overview of your cyber risks is preferable to periodic ‘point in time’ snapshots.

With digital transformation, accelerating release schedules and tight security budgets demanding an always-on, cost-effective and scalable approach, tech research firm Gartner cited CTEM as a top strategic technology trend for 2024. It forecasts that, by 2026, organisations implementing a CTEM program now could benefit from a two-thirds reduction in breaches.

 enables five operational phases in accordance with the CTEM model. Mapping your attack surface encompasses the first two steps: SCOPE and DISCOVER.

With YesWeHacks’ ASM, you kickstart the CTEM process by ‘scoping’ your assets: declaring your domain names and IP ranges/addresses and letting our solution inventory subdomains, accessible services and associated technologies.

Then our backend scanners can ‘discover’ related subdomains, other domains hidden from the organisation (due to shadow IT for instance), reachable services and associated technologies. Subsequently, they will continuously detect, and notify you of, any newly-surfaced online assets. A value is assigned to each discovered and classified asset according to its business criticality.

The subsequent CTEM phases, which we will cover in future articles, include PRIORITISING the most pressing suspected vulnerabilities discovered across your exposed vectors, through auto-generated priority scores; VALIDATING or rejecting a finding as exploitable in your environment; and MOBILISING by accessing, editing, sharing, assigning and tracking vulnerability reports from all sources to efficiently fix the most urgent security flaws first. In a follow-up article, we will also explore the potential synergy between Bug Bounty Programs and CTEM – with benefits including optimised testing coverage and cost-effective hardening of your exposed vectors.

How the YesWeHack ASM strengthens your security posture

YesWeHack’s ASM product can provide the missing link in your offensive security strategy by providing:

– mapping internet-facing assets and exposed dependencies

Continuous visibility of your organisation’s 

Automated prioritisation of vulnerabilities 

based on an easy-to-understand algorithm – accounting for severity (using CVSS), in-the-wild exploitability (using EPSS) and the related asset’s criticality value (assigned by the client organisation)

Strategised security testing and remediation to 

tackle the most critical vulnerabilities at scale

The turnkey-deployable ASM integrates seamlessly with the existing YesWeHack platform. Vulnerabilities from various security testing channels, including automated scanning by the ASM, Bug Bounty programs, traditional pentesting and Vulnerability Disclosure Policies (VDPs), are therefore consolidated into the same interface. This provides a one-stop-shop for all vulnerabilities – whatever their source and format.

 with YesWeHack today and discover how a risk-based approach can transform your organisation's security strategy.

Our latest ethical hacker roundup leads with a 

new open source tool for understanding how browsers parse HTML

 and uncovering mutated XSS vulnerabilities. 🛠️ The handiwork of our resident security researcher, 

, Dom-Explorer incorporates popular HTML sanitizers Ammonia, Angular, DomPurify, JsXss and SafeValues, while supported parsers include DomParser, Parse5, srcdocParser and TemplateParser. “By using this tool, you can generate this weird behaviour where if your input is not valid, it will change to something that might indicate the potential for vulnerabilities,” says Bitk. The researcher believes Dom-Explorer can simplify, accelerate and send in fresh directions this niche area of security research. 🔥

A client-side exploit chain across various Google services has impressed the InfoSec world. Leveraging Google Slides’ YouTube embed feature to access a victim’s Google Drive file, path traversal, open redirects across YouTube subdomains and oddities in Google Docs’ sharing UI, the discovery has 

netted security researcher Lyra/’Rebane’ an oddly specific bounty of $4,133.70.

 as an exemplar of how exploits can become “easier the longer you spend targeting a single company”, and evidence of an unusual combination of hacking skills. “Most white-hats specialize a bit, website logic shenanigans like iframes or the hardcore code analysis stuff like the link I posted for example. But not this [person, she] seems to have mastered both,” 

In other hacking tool news, ‘Cfreal’, highly respected for his PHP work, has made another significant contribution to this field with the 

, which helps ethical hackers exploit blind file read primitives in PHP. The researcher says the utility transcends most limitations undermining similar tools. 🚀

Speaking of PHP, the star of our YouTube channel’s latest hunter Q&A, Blaklis, also favours PHP targets. As well as discussing his preferred scopes, the prolific hunter, who sits 21st on our all-time leaderboard, reflects on how hacking video games introduced him to bug hunting, outlines his typical working day, and tells us which non-computing-related career he thinks most closely resembles Bug Bounty (watch the video below). 🐞 Similarly, we’ve also published a new 

, complete with related video, starring HakuPiku, in which he declares a fondness for hacking Android apps and open-source code. 📱

HakuPiku’s penchant for open source means he features on our new 

, which tracks the most successful hunters in terms of valid vulnerabilities reported to our open source programs. Top spots are currently held by calehuri, mdisec and foobar0x7 (visualised on the image below). 🏆 Hunters are further incentivised by the fact that any valid bugs reported to our open source Bug Bounty Programs will score hunters some exclusive merch, as well as the usual financial rewards. 🎁 Applicable scopes for this swag include 

’s seven public programs, which offer max €10,000 rewards: Log4j, Systemd, GNOME, ntpd-rs, OpenPGP.js, Sequoia PGP and CycloneDX Rust Cargo. The swag is also available via three programs managed by Open-Xchange: 

. Incidentally, the bounty grid for PowerDNS, an open-source DNS server, was recently increased to a €8,000 maximum. 💰 🎯

As for the general leaderboard, Rabhi, Xel and pocsir currently head both the overall 

Using AFL++, afl-cov and basic custom harnesses to find a libsoup bug

Back to the research writeups: we're spotlighting research from a hunter who also stars on the aforementioned open source leaderboard. In a new blog post, 'Sigabrt' 

 in which he used AFL++, afl-cov and basic custom harnesses to find a heap overflow bug in libsoup on a YesWeHack public program, namely that of 

'Ading2210', meanwhile, has recounted how he 

 for reporting Chromium vulnerabilities that allowed for a sandbox escape from malicious browser extensions with just “a tiny bit of user interaction”.  The potential consequences were grave: “Instead of merely stealing your passwords and compromising your browser, an attacker could take control of your entire operating system,” he wrote. Eek. One redditor called it “

 I've read since The Cuckoo's Egg”. 💰

Multiple vulnerabilities in a Realtek SD card reader, meanwhile, apparently “enabled non-privileged users to leak the contents of kernel pool and kernel stack, write to arbitrary kernel memory, and, the most interesting, read and write physical memory from user mode via the DMA capability of the device”. 💻  An 

 details Realtek’s fixes for what were seemingly highly serious flaws. “If your laptop is equipped with an SD card reader, it is highly likely to be manufactured by Realtek, making it susceptible to these vulnerabilities as well,” 

Our latest white-box penetration testing guide explores 

how to debug for JavaScript vulnerabilities

. In testing a web application vulnerable to prototype pollution within a Docker container, Brumens’, another of our resident hackers, demonstrates how to debug JavaScript inside Visual Studio Code in order to track payloads throughout the code process and learn how security filters can hide vulnerabilities. Relatedly, we’ve also detailed our 

top 5 hacking tools for white-box pen testing

Exploiting trust: Weaponizing permissive CORS configurations

’, Outpost24’s Thomas Stacey reveals the results of a project initiated to answer the question: “Are we underestimating CORS vulnerabilities?”. 🤔 Possibly, it seems, given the application security auditor uncovered multiple CORS (Cross-Origin Resource Sharing) flaws affecting customers, including critical issues including user sessions. He observes that both the detection and exploitation of permissive CORS can be tricky, the latter “due to modern security controls like the “SameSite” cookie attribute, or even modern application architectures like single-page applications”. Mindful of these challenges, he sets out some tooling and methodology advice for finding vulnerabilities in CORS implementations.

Other recent writeups and InfoSec news of interest include “

 of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software”; Sonar showing how to turn a file write vulnerability in a Node.js application into RCE 

when the target’s file system is mounted as read-only

data breach involving France’s second largest internet service provider (ISP) and telephone operator

, affecting more than 19 million customers and 5.11 million IBAN numbers. 😮

Next up, Dojo news. Trick or treating might be over for another year, but our platform’s new dark mode 🖤 – 

 to coincide with the celebration – is here to stay, while our Halloween-themed monthly CTF challenge – ‘

’ – has concluded (congrats to the winners: Atlas_py, qu35t3190 and Fravoi). 👻 The current active challenge is ‘

’, open for submissions until 12 December. Elsewhere on Dojo, another new training module has dropped: 

. And finally, check out our new feature, Talkie Pwnii, a series of videos from one of our researcher enablement analysts, pwnwithlove aka pwnii! In the first video, below, pwnii shows you two alternative solutions to our latest Dojo challenge, '

', and a few technical tips and tricks. 🚀

Over the weekend, we ran a successful live Bug Bounty in Buenos Aires, Argentina.

 across two days, the live hacking event involved targets from Galicia Bank. This was the final top 3:

💉 First Blood: Damián Gambacorta aka g4mb4

💥 Best Impact: 🎩 Alan L. aka soyelmago

A huge thank you to Galicia Bank for their trust and involvement. We also want to extend our gratitude to Ekoparty and Bug Bounty Argentina for their support in making this event a resounding success. 🙏

Highlights from the Ferrero live Bug Bounty

And here is the final podium for another live Bug Bounty that took place at the end of September, with legendary sweet-packaged food brand Ferrero providing the targets:

Watch highlights from this competition, which was Italy’s 

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

There’s always vulnerabilities,” said Erik Täfvander, head of cybersecurity at ATG: those you know about, those you don’t know about, and those yet to be created.

When it comes to finding them, he told YesWeHack in the interview below, Swedish betting brand 

 to be more productive than pentesting in multiple ways.

In the video and writeup below, Erik also explains how ATG has optimised its approach to crowdsourced security testing, praises YesWeHack’s customer support and triage team, and assures his peers that they “have very little to lose” by road-testing their own program.

Erik Täfvander on ATG's mission and why security is paramount…

ATG is short for Swedish words – AB Trav och Galopp – and we’re a unique betting company. We’re based in Sweden, and we’re owned by the horseracing industry. We try to offer our customers the world’s best betting experience. And it provides about 30,000 daily jobs in Sweden.

Security is important for us. We need to keep our customers’ trust, and one thing is to make sure that if you bet at ATG, your money is safe and your bet is fair.

On what prompted ATG to launch a Bug Bounty Program…

It was good timing actually. We had been looking into it for a bit. It didn’t really tip over at first, but we did struggle with traditional pentesting. We needed something to keep up [with our needs] – to not only [test assets at] a point in time but continuously get reports.

And what kind of tipped the scale was also the business model: that we reward hunters for providing us with valuable information, and we only reward them when we get the information.

On the program’s evolution since launch…

If I’m not mistaken, we launched in 2021. And we started with a private program with a small, limited scope to see if this was something for us. And frankly, in the beginning, I was a little bit bored, because we had for a couple of weeks not a single report. It was that quiet. And then, something happened – we got an instant 20 reports.

After that, we tried to evolve the program to include new scopes, new assets, improve on our reward levels to keep it attractive. And since, I think it’s two years now, we have been running a public program, which has a wildcard scope – so you’re allowed to basically try anything out that is [one of our digital assets].

On the biggest challenge they’ve overcome so far…

Oh… good question. The first challenge we met was: who will help us to patch these bugs? That wasn’t that clear in the beginning, so we kind of developed our own documentation and developed techniques to find out who’s responsible for what line of code, and it’s been running much smoother after that.

On the value of YesWeHack’s customer support and triage service…

I appreciate that you make me feel like a partner more than a client. I really, really, really want to send some kudos to the triage team. They are on the ball 24/7 almost, really rapidly giving us their insights on reports that we receive, and helping us during the process.

I think it gives you great insights into what’s going on, because you use basically the same techniques for malicious hacking, and we learn a lot from that. Also that we pay a reward to someone who is trying to help us.

And you get fast return on investment. If we get serious vulnerabilities reported to us, it’s worth it all day long to reward the hunter for those vulnerabilities.

On the merits of Bug Bounty versus pentesting…

I would say the political answer is it’s 

 pentesting. But with that said, we have had, I would say, 20 really serious reports that we would never get from a traditional pentest. The collective knowledge that we get from a Bug Bounty Program is huge, compared to a pentest where you hire a couple of researchers or consultants to help you.

On keeping hunters engaged after three years and counting…

We’ve done a lot to keep it attractive but that’s a challenge that we need to work on. It was easier in the beginning – when you started to ramp up scopes, you started to ramp up rewards.

But now we’re in a wildcard situation, we can’t add many scopes because they are already there. Now we work with how we interact with hunters – that we are really keen to keep them in the loop, appreciate their work, collaborate and try to be as rapid as we can when we pay out the rewards.

It’s a collective effort because you need colleagues within development, operations and other parts of the business to remediate the bugs reported, because knowing that you have a bug is one thing, but when you actually solve it and patch it, then you have completed the loop.

On whether running a Bug Bounty Program is time-consuming…

From my point of view, there’s not a lot to do. I try to keep my fingers out of the ‘cookie jar’, in terms of looking at the reports! My team manages it beautifully. That’s one [great] thing about this kind of service: the main focus is on remediating vulnerabilities.

Advice for organisations that haven’t yet launched a Bug Bounty Program…

I would suggest trying it out. You actually have very little to lose, because it’s easy to start, easy to quit if you want – but I don’t think you will. You learn about your security posture in a way that you probably didn’t know before.

If you try and you don’t get any reports, I would probably have to buy you a drink or something like that! Because I was afraid in the beginning for us, but now we receive reports continuously. And now, it’s like a self-playing piano in some way.

With the knowledge that we have about ourselves, we know that there’s always vulnerabilities. There’s those that you know of, those that you don’t know of yet, and those that you haven’t deployed yet. So there’s continuous work to be done in terms of keeping your application secure.

 for further details on rules, rewards and scopes.

Want to learn more about the YesWeHack Bug Bounty & Vulnerability Management platform? 

 to schedule a demo with one of our experts.

‘The collective knowledge ATG gets is huge’: cyber chief on Betting brand’s Bug Bounty story

Security teams should note two fresh milestones in the EU’s regulatory framework, begins our latest 

 roundup of OffSec insights (originally published as a LinkedIn newsletter). 

 by the European Commission. With market access to the world’s largest trading bloc contingent on compliance and multimillion-euro fines the potential penalties for violations, CISOs from around the world will certainly be paying attention. 🚨

In light of this, we have published a new guide to the 

security testing and vulnerability management dimensions of NIS 2

, which introduces wide-ranging requirements for member states and ‘essential’ or ‘important’ services. We’re publishing a guide to the CRA, which applies to vendors of products with digital elements (PDEs), soon. 📱 These laws form key planks of the 

EU’s recent drive to upgrade its cybersecurity framework

. The emerging framework, in common with cyber laws emerging elsewhere in the world, has many prescriptions and recommendations for undertaking activities we happen to be experts in: understanding and minimising your attack surface, proactively and continuously finding vulnerabilities, and adopting a risk-based approach to their remediation. 😉

 suggests the ongoing global shortage of cybersecurity skills helps to explain how 

spending growth on security software and services

 is outstripping that of recruitment and staffing. 📈 The article points out that Gartner expects security service spending to increase 15.8% next year, while IDC forecasts a global CAGR of 12.2% between 2023-2028 for managed security services. As CSO senior writer John Leyden writes, “CISOs are turning to managed security services to take advantage of seasoned practitioners that they would struggle to hire and retain internally.”👨🏼‍💻

With security teams growing more slowly than attack surfaces, we believe growing demand for crowdsourced security testing is partly fuelled by the same dynamics. And even if the skills shortage were magically addressed tomorrow, no organisation will ever have the kind of internal OffSec resources they can access when they launch a Bug Bounty Program – namely the diverse skills of tens of thousands of ethical hackers. Relatedly, 

Foundry’s 2024 Security Priorities Study

22% of new vulnerability assessment roles are outsourced

US Cybersecurity and Infrastructure Security Agency (CISA)

 about the performance of its Vulnerability Disclosure Policy (VDP) platform. “Since launching in 2021, the VDP Platform has triaged over 12,000 submissions (over 7,000 in 2023) on behalf of 51 onboarded agency programs, saving agencies a significant amount of time and resources,” the annual report disclosed. “Over 2,400 unique, valid vulnerability disclosures have been identified, of which nearly 2,000 have been remediated by agencies. Since launch, over 3,200 security researchers have participated.” VDPs, as we’re rather fond of reminding our readers, offer 

 and are increasingly a compliance must-have not just nice-to-have. 🛡️

The YesWeHack Blog

PimpMyBurp #11 – Master Signed Token Exploits with SignSaboteur

PimpMyBurp #11 – Master Signed Token Exploits with SignSaboteur

Cyber Resilience Act: compliance countdown set to start for EU law focused on eliminating vulnerabilities

Attack surface discovery: mapping your exposed vectors with continuous threat exposure management (CTEM)

PimpMyBurp #11 – Master Signed Token Exploits with SignSaboteur

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

‘The collective knowledge ATG gets is huge’: cyber chief on Betting brand’s Bug Bounty story

NIS 2 in force, Cyber Resilience Act adopted, CISA hails VDP impact – OffSec roundup for CISOs

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

Dojo challenge #36 - Shell Escape winners and writeup

‘Happy hunters equal happy customers and vice versa’: YesWeHack vulnerability triage chief Adrien Jeanneau on creating a virtuous Bug Bounty circle

Dom-Explorer tool launched to reveal how browsers parse HTML and find mutated XSS vulnerabilities

Dojo challenge #36 - Shell Escape winners and writeup

DON'T WAIT FOR THE THREATS TO STRIKE

Products

Researchers

Resources

Company

Follow us