EU Cyber Resilience Act & Coordinated Vulnerability Disclosure Policy

It’s important when you buy a product that the product doesn’t have known vulnerabilities. That’s not the case today

) and now the Internet of Things. These are the three scopes covered by the European legislative power to “address the cyber threat, but also to become a leader in cyber security” according to 

Ursula von der Leyen, President of the European Commission

Last 15th September, the Vice-President Margaritis Schinas and Commissioner Thierry Breton presented the proposal of the 

 a Regulation to define common European cybersecurity standards for products with digital elements that are placed on the EU internal market. This can be considered as the final element of wider regulatory strategy to protect European citizens and business against cyber-attacks.

The proposed legislation aims to impose new cybersecurity requirements on hardware and software products such as smart toys and fridges and security cameras that are placed on the single market, whether they are produced in the EU or not and throughout their whole lifecycle.

“Insecurity-by-design” as main market failure

The main market bottlenecks addressed by the proposal is the low level of cybersecurity, reflected by “widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them”.

Over the last years, cyber-attacks such as Mirai, WannaCry, NotPetya and SolarWinds have underlined the exploitation of vulnerabilities in digital products attacks. These attacks showed that the successful exploitation of a vulnerability in a single product can paralyse global firms and lead to billions of euros in damages.

While our digital society derives clear benefits from the Internet of Things – for example, lower operating costs, new consumer insights and the possibility of process optimisation – the attack surface of Internet-enabled products continue to increase and as such the 

urgency of vulnerability disclosure management.

For that specific challenge and to improve 

 on security of hardware and software products, the European regulator has proposed a set of requirements for all internet-connected products in the European single market – regardless of whether they were manufactured here or not – and applies to their entire life cycle.

Among them, Art-10.6 of CRA requires manufacturers to “have appropriate policies and procedures

, including coordinated vulnerability disclosure policies […]

, to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources”.

The CVDP as cornerstone of the vulnerability management

, we have been working fiercely to raise awareness of the positive impact of ethical hackers in finding and reporting vulnerabilities and to guarantee a secure and accessible communication channel with well-intentioned security researchers.

Curious about the feedback on the application of our solution from one leading European IoT company?

Therefore, we consider the proposed CRA a significant step towards implementing a harmonised pan-European approach to mandate the use of VDP.

 which creates a framework for EU certification schemes referred to CVDP as an important tool to support Member States’ efforts to enhance cybersecurity; early this year, the recent update of the Network and Infrastructure Security Directive encourages Member States to design CVDP to facilitate the reporting, detection, and remediation of vulnerabilities.

For sure, the European Union is gradually taking up the subject of CVD and facilitating its broader adoption in the Member States. However, some important topics remain to be further examined and harmonised

 at European and global levels (e.g., definition of what constitutes illegitimate access to an information system, universal minimum protection for ethical hackers, complement the amendments of the Cybercrime Directive, information sharing with ENISA and Member States…).

YesWeHack is already actively engaged with European partners and customers to foster the dialogue on such critical topics and to make Europe safer and competitive on the global market. In that scenario, the ethical hackers have and will continue to play a fundamental role to our digital life.

Eager to know more about Vulnerability Disclosure Policy?

Founded in 2015, YesWeHack is a global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting more than 40,000 cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers: a creation and management solution for 

, a Pentest Management Platform, a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Let’s get the IoT landscape less vulnerable for all

, the global Bug Bounty & VDP platform, organised a Live Bug Bounty during the 

, held in Lille, France. This year, it was 

‘s — the giant sports and entertainment retailer — turn, with its Technology team, to participate in these two days of intensive hacking!

Operating in over 70 countries, addressing the needs of 500 million users of its products and services and with a community of over 100 million members, 

 is a major digital player with high visibility and exposure to cyber risks.

Decathlon’s cybersecurity teams deploy numerous resources and tools to ensure the security of the company’s activities in the 70 countries in which it operates. Among the actions carried out by the company’s cybersecurity teams in order to remain at the cutting edge of innovations, 

Decathlon has been in a private Bug Bounty program for a year on the

“Bug Bounty is challenging and engaging for us. When researchers detect a vulnerability, they submit a report. And when this vulnerability is critical, we set a deadline to fix it. This reactivity is essential in our commitment to security. It allows us to maintain the high level of requirements that characterises us at Decathlon, and keeps both the bug hunters, and our teams, motivated

, Information Security Manager at Decathlon.

With their participation in this Live Bug Bounty, Decathlon has gone one step ahead in its efforts to collaborate with ethical hackers.

For corporate security teams, it’s a unique and invaluable opportunity to discuss their findings with researchers, and better understand security bugs. For hackers, it’s an easy way to ask live questions to program managers and YesWeHack’s teams to get more information about the programs and thus go even further in their research. Furthermore, researchers may collaborate with each other to pool their skills and expertise and thus go further in the hunt for new vulnerabilities and exploitation.

“This is the first time that we are embarking on a Live Bug Bounty. It allows us to meet the hunters, to discuss with them, and then, to go further in the search for vulnerabilities.”

During these two days, the Decathlon teams offered exclusive scopes to the researchers attending the event. They wanted to test the robustness of their “OneShop” solution; it is an E-Commerce solution, based on PrestaShop, used by about thirty countries in the world (

Moreover, in order to test the E-Commerce platform from end to end, Decathlon Technology also wished to include its authentication solution called “Login” and its loyalty solution called “Account” in the scope of the test.

Decathlon Technology’s technical teams were on hand to ensure the rapid assessment and remediation of the reports submitted by the hunters. And what speed! The team had an average response time of only 1 hour 06 minutes during the event 👏

The Live Bug Bounty started on Wednesday 08 June at 10:00. A few dozen hunters were present at the booth and were eagerly awaiting the launch of the program. The Live Bug Bounty was also open to participants of the 

, an ethical hacking competition using eSport codes dedicated to students!

The first submission (aka “first blood”) was submitted by 

, only 1 hour after the start of the event! 

 then quickly took the lead, thanks to several IDOR (Insecure Direct Object Reference) discovered on the scope, followed closely by Zax and Effrite.

As the day progressed, the rankings changed with several reports from the hunter 

After 30 hours of Live Bug Bounty, the overnight research efforts of the BZHunt team (

) finally paid off. The hacktivity revealed a RCE (Remote Code Execution) as well as an SQL injection and some other vulnerabilities, reported by Zax. This allowed him to take the lead and keep it until the end of the event.

And here is the podium of the Decathlon Live Bug Bounty:

“I really enjoy participating in live Bug Bounty events, it’s really great to meet the community as well as the program managers! During these 30 hours, it was possible to interact with the Decathlon team, who came in numbers. Being able to talk directly with the Decathlon teams allows us to show our PoCs, to have real-time feedback and therefore to go even further in the impact.

As for my team, BZHunt, we are exhausted but delighted. We pushed on until the last few minutes of the event and managed to grab the lead on the podium, carefully held by Hisxo throughout the event. A big thank you to YesWeHack for this great organisation!”

A successful first experience for Decathlon

“After just over a year in private Bug Bounty program, we wanted to reach a new level by running a Live Bug Bounty. Despite some apprehension due to the fact that we were going to test the robustness of one of our E-Commerce platforms with real conditions on the production environment, the event was a great experience for us and a real success on all fronts:

✅ There were no disruptions to the production (the hunters took into consideration the rules of the program which forbade carrying out tests that could cause possible service interruptions)

✅ The allocated reward budget was respected and we were able to pay all the hunters during the event

✅ Our on-site teams did a remarkable job, notably with the qualification of the 64 reports submitted by the hunters before the end of the event and with an average response time of only 1 hour 06 minutes

✅ Our mobilised teams accepted 27 reports, including 3 critical reports, and the first patches were being built even before the end of the event and are currently being deployed throughout the affected area

✅ The proximity with the hunter community was very much appreciated, as it allowed for smoother interactions and the opportunity to be confronted with new approaches to security

In addition, our communications teams enjoyed co-organising the event in partnership with YesWeHack and the result highlighted both our companies through this action.”

The next Live Bug Bounty organised by YesWeHack will take place at 

 Paris, on June 24th and 25th 2022! Be ready, it’s going to be intense! More info 

.
Fancy a ticket to leHACK? We might have a few left! Send us an email.

Founded in 2015, YesWeHack is a Global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with bug bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers support in creating a 

), a learning platform for ethical hackers called 

Over the past decade, Decathlon has engaged in a strong acceleration of the digital transformation to address new technological challenges and consumption patterns. With more than 3,000 engineers in 67 countries, Decathlon relies on the most innovative technologies, the company works with and develops tools, systems and experiences that help people around the world access the pleasures and benefits of sport. Decathlon, the leading company in the sports market, combines two activities: the creation of innovative sports products and services, and their distribution online and in stores.

With 324 points of sales in France and more than 1,700 worldwide, Decathlon and its 97,000 employees have been working since 1976 to achieve its permanent ambition: to innovate in all areas in order to remain the main partner for the many. With 300 recruitments in 2021 and 420 positions open for 2022, Decathlon Technology continues its development and expands its teams in major metropolitan cities such as Paris, Lille, Nantes and Lyon. Decathlon Technology has more than 1,200 employees based in France and is deploying an ecosystem of 3,000 people around the world (Europe, China, India, Brazil) with tech skills to serve the digitalization of the Decathlon Group. 

Software engineers, product managers, data scientists, machine learning ops engineers…

 These cutting-edge skills and expertise are mobilized across all of Decathlon’s business lines, from design to retail and to the supply chain. These tech and digital skills enable us to address the needs of the 500 million users of Decathlon products and services, as well as the Decathlon community of over 100 million members.

Want to discuss crowdsourced security with our experts?

Back to Decathlon’s Live Bug Bounty

 was a special edition for “LeHack” and consisted in bypassing the simulated WAF in order to execute JavaScript and obtain the secret password.

 You want to create your own DOJO and publish it? Send us a message on 

We are glad to announce the #17 DOJO Challenge winners list.

The best writeups reports were submitted by: 

DrLNO, Hiboukibou, Kubolos231, Sh33my and Spawnzii 

 feeds to be notified of the upcoming challenges.

Read on to find the best write-up as well as the challenge author’s recommendations.

We asked you to produce a qualified write-up report explaining the logic allowing such exploitation. This write-up serves two purposes:

Determine the contestant ability to properly describe a vulnerability and its vectors inside a professionally redacted report. This capacity gives us invaluable hints on your own, unique, talent as a bug hunter.

We received a large number of reports and all of them were detailed, well explained… However, we had to make a selection of the best ones. These challenges allow to see that there are almost as many different solutions… as long as there is creativity 😉

pecial mention for ivarsvids and its 4 different solutions.

Thanks again for all your submissions and thanks for playing with us!

This code runs a JavaScript code inside a script that craft a “secret” variable.

Execute Javascript (XSS) and alert (popup) the value of the original variable secret.

Alert (popup) the value of the original variable secret

We see that we can change the value of the $inject variable. This variable match the value of the src atttribute of the script tag. So we can inject an external js script from it.
We write an external javascript file which contains a code to alert the secret value. We add a function to delay the alert function in order to wait the instanciation of secret value:

Then we escape the pattern :// which is replaced with __NOPE__ with &#47.

The final $inject variable look like: http:&#47;/localhost:8080/<path>/xss.js

First, we see that we can modify the $inject variable. This variable is the value of the src attribute from the script tag.
The src attribute allows to load javascript from another file, even from an external source (for example stored on an external server).
We want the secret variable which is defined after the second script tag as a const variable.
In order to achieve this, we will display it through alert (a javascript function) by exploiting a XSS vulnerability.

We create a new file on our local machine called for example xss.js so we can expose it (with a python server: python -m http.server 8080)
For the test and because it’s simplier, I create a new file, in the same repository called challxss.html which contains the html code of the challenge.
So we can now navigate to http://localhost:8080/<path>/challxss.html with a browser.
The same output as the challenge (coffee gif) is displayed.

Let’s change the src value !
Still in our local file challxss.html, we replace the $inject variable with the path of our xss.js.
The first piece of code I write in xss.js is alert(secret):

But the variable isn’t loaded yet so it is not displayed. (To be sure, we can move the script tag after the div "Coffee_Design" and see what happend. Answer: secret is displayed).
To remedy, I delay the alert function with the setTimeout function.
The modified file look like this now:

And now it works ! (on my machine)
There is still a problem, the pattern :// is replaced by __NOPE__
In order to bypass this, we can replace ‘/’ by the ‘/’ HTML Escape Characters code which is &#47;

Now instead of having http://localhost:8080/<path>/xss.js for the $inject variable, we have http:&#47;/localhost:8080/<path>/xss.js

DOJO CHALLENGE #17 Winners!

Carried out by the French Ministries of the Interior, Justice, Transformation and Public Service and by the State Secretariat for Digital Affairs, the “

” application offers an alternative to photocopies of identity documents, allowing people to send authentic and secure single-use digital identity documents.

In order to guarantee a maximum level of security, the 

’s platform researchers. The Bug Bounty program will last throughout the life of the application, allowing a permanent audit of the code by the community. The objective is to improve the security and the level of trust of the infrastructures used by 

Continuous security check in three phases

 Bug Bounty program will take place in three phases:

A first private phase starting in June 2022 will be held with about thirty ethical hackers selected by YesWeHack and France Identité.

This private phase will be progressively strengthened with the invitation of new researchers to the program.

Lastly, the app will move into a public Bug Bounty phase, where the whole community will be able to test the security of the app.

Always with the aim of ensuring transparency, 

 will gradually open up its code and make it available to as many people as possible, with the same mission of identifying any potential vulnerabilities.

YesWeHack continues to guarantee the security of essential digital assets

YesWeHack is a long-standing partner of government organisations. The platform has notably collaborated with:

 to watch a video describing the partnership between the two organisations.

Direction interministérielle du numérique

, France’s digital transformation agency – Click 

 to see their public Bug Bounty program.

 the French platform for prevention and assistance to victims of cyberattacks – Click 

 project team, for the security of the mobile contact tracing application implemented during the COVID-19 pandemic – Click 

Quebec Ministry of Cyber Security and Digital Affairs

Founded in 2015, YesWeHack is a global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with bug bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

, a learning platform for ethical hackers called 

The French government’s digital identity application under Bug Bounty program on YesWeHack

is launching a virtual reality game, YesWeHackVR, allowing players to get into the role of an ethical hacker of the

Have you ever dreamed of being a hacker? We’re sure you have! Well, you’re in luck because we’ve created a game just for that experience!

🕹️In its ongoing effort to make more accessible the work of ethical hackers and make it understandable to the greatest number of people, YesWeHack is now going one step further by releasing its VR game! YesWeHackVR allows participants to experience all the steps that security researchers go through when working on a Bug Bounty program.

This game was created to make everyone understand what Bug Bounty is, and how the security researchers of our platform work, identify and analyse vulnerabilities! Whether you are a student, a security professional, or even someone outside of the security industry, YesWeHackVR will introduce you the Bug Bounty universe in a playful way!

Sitting in front of your virtual PC, you will discover the Bug Bounty program you have been invited to join! 

🕵️ Once you have understood the rules and identified the scope of the program, you will have to search, analyse, exercise your brain and logic to discover potential vulnerabilities within the perimeter.

🐛 Think you’ve discovered a vulnerability? Now find the right tool to exploit it!

✉️ Once you are sure you have found a qualifying vulnerability within the scope, you will have to write the report and rate the severity of the discovered bug!

💵 Will your vulnerability be eligible for a reward? Which hunter rank will you be? Hold on, you’ll soon find out!

The official launch of the game took place during the 

, the International Cybersecurity Forum, which was held in Lille from 7 to 9 June, with 

YesWeHackVR available to try out on our booth F12

The Showroom on the 13th floor of the Campus Cyber, the new cradle of French cybersecurity, has YesWeHackVR available all year long where demos are arranged with the Campus Cyber team.

And because we absolutely want everyone to have access to it and have fun being an ethical hacker, we decided to publish our game on the 

! Click below to download it directly on the Oculus store 👇️.

We hope you will have fun playing an ethical hacker!

YesWeHackVR, an immersive hacking game

 publishes articles on exploitation techniques, tools and tips to help hunters find vulnerabilities in their reconnaissance process and hunting routine. The goal is to provide ideas and keys to attack and understand the various web technologies hunters may face on their private programs.

The world’s biggest rainforest is what we referred to when we heard the word Amazon. But since 1994 this reference started to change when Amazon as an e-commerce company was launched and took pace in 2006 when AWS (Amazon web services) as a cloud service company was started. With the increasing greed for space and authority, humans started exploiting thick covers of Amazon rain forests and on the other hand, hackers started abusing AWS S3 bucket permissions. Since we are dealing with the technological part here, let’s wear our black hats and take a deep dive into how attackers abuse S3 bucket permissions.

According to Amazon, S3 buckets are containers for objects stored in Amazon S3. You can store any number of objects in a bucket and can have up to 100 buckets in your account. To simplify it a bit, it is a pubic cloud storage resource which is similar to file folders that store objects containing data and its respective metadata. Amazon provides several features with S3 buckets few of which are versioning, Access logging, Object-level API logging, tags and encryption.

The use case for S3 can be a situation where a web application wants to share certain files and has some image dependencies. S3 can come to the rescue where it can hold all such data and provide it to users as requested and required. Also, it can be used to store data/images/profile photos of users and also other dependencies of web applications like JavaScript and CSS.

AWS S3 comes equipped with a range of permissions and access control mechanisms which if in the case overlooked by administrators and improperly implemented can act as a treasure of data for malicious hackers and bounty source for 

Misconfigured AWS S3 buckets that leave unauthorized access are thus abused by attackers to compromise the privacy of the data stored in those buckets breaching the privacy of millions of users around the world. If the case misconfigured S3 Bucket contains EC2 snapshot instances, then attackers might be able to retrieve the snapshot instance and then get security keys for the EC2 instance itself.

There Are various ways to identify S3 buckets few of which are

HTML inspection (S3 Bucket URL hardcoded in HTML of webpage)

Testing and Abusing S3 Bucket permissions

Once you have identified S3 buckets, it is time to test out permission they have and once they are identified, we can start abusing them. But what are the permissions in particular assigned to S3 buckets? Let us have a brief look at them

This permission allows reading the contents/objects of the bucket. At the object level, it allows reading the contents as well as metadata of the object. Testing this permission is really simple. The first way is to try and access it via URL. Use this as a skeleton and modify as according to your needs

This same thing can be done by using the AWS command line as well. Following is the command that can be used to list the contents

No sign request switch that we used in the above command is used to specify not to use any credential to sign the request. A bucket that allows reading its contents will spit out all the contents once requested by any of the above methods. HTML request will show output on the XML page and the command line will give a list of files.

This permission allows to create, overwrite and delete objects in a bucket. Speaking of object-level access, it allows editing of the object itself. As far as testing goes, this permission can only be tested by the AWS command-line interface, unlike reading permission where you had a chance to test it through a web browser. Following is the command that you can use and modify according to your needs

A bucket that allows unrestricted file upload will show a message that the file has been uploaded.

At bucket, level allows to read the bucket’s Access Control List and at the object level allows to read the object’s Access Control List. Read ACL can be tested with the AWS command line using the following command

Once we execute both these commands, they will output a JSON describing the ACL policies for the resource being specified.

This policy at the bucket level allows setting access control list for the bucket. At the object level, allows setting access control list for the objects. To test this, all you need to do is run the following g command :

To test for a single object, following command can be used

For this though, there is no output shown in the form of a message

This term is self explanatory which means it grants full control (

). The same goes for object-level access as well.

Finally is the most destructive one which is any authenticated AWS CLIENT. This permission allows any authenticated AWS client to access the account regardless of what type of account they are using. To test this, simply take any command from above and replace –no-sign-request with –profile [your_profile_name].

Following is an excellent open-source resource where you can test out all the permissions. Assuming that ACL and proper policies are in place, only one or few commands might show successful output. You can always set up your own S3 bucket and test out these commands as an unauthenticated user on your bucket. You can then see the output. Later you can add on policies and Access control measures on your bucket and test again with these commands.

 gives CTF like challenges where the content of each flag is entry to the next challenge so you can test out your skills in securing the cloud with these challenges.

To demonstrate the above commands, we have created an AWS bucket and configured it in a vulnerable fashion. Let us look at the above commands one by one. First, we will show you what the output will look like once we run the above commands and later, we are going to look at the vulnerable policy that we have set on our bucket and also other misconfigured buckets that might have on open public internet.

In this, when we ran command for first time, it showed error because s3 bucket blocked file uploads. Later on, we modified permission hence it allowed file uploads.

You can test out write ACP by creating your own custom Access control Policy and uploading it by running command mentioned previously.

Let us have a look at vulnerable policy we set on our bucket.

The main problem here is with the Action tag which is set to *. It means that to allow all the actions including reading write upload delete etc. This is a quick and convenient way for administrators to assign access control to the bucket but at the cost of convenience comes the security which leaves the bucket vulnerable. To mitigate this, administrators should set each and every permission/Action manually as per requirement and configure the bucket properly such that public access is blocked.

Here are summed up steps you can take to secure an s3 bucket or recommendations you can give after you have found the s3 bucket.

Making Bucket private / Disallow public access

Using assumed IAM roles which has access to the bucket for read/write

Enabling CloudTrail and Server access logging for your bucket.

Abusing S3 Bucket Permissions

Web applications & APIs are often the highly exposed asset of any organization. With the use of modern frameworks, the development process becomes handy and faster. However, often the developers leave some 

unlinked, unreferenced or unintentionally/accidentally open for use. Often, attackers may utilize these to perform attacks such as Cross-Site Scripting (XSS), Open Redirection, Server-Side Request Forgery (SSRF), SQL Injection and others.

In this article, we will be discussing identifying the hidden attack surface by identifying the hidden parameters.

The process of identifying unlinked, unreferenced or simply hidden parameters that are accepted by the application and could allow a user to control the behaviour of the application using these hidden parameters is often known as 

As mentioned, the hidden parameters may allow an attacker to control the behaviour of the application and may result in the execution of successful attack scenarios such as Cross-Site Scripting, Open Redirection, SQL Injection, Local File Inclusion, Command Injection, Server-Side Request Forgery, Server-Side Template Injection and other security vulnerabilities such as an IDOR.

Hence, it is an essential step to perform 

as part of your Recon process for building an attack surface that is inclusive of the Hidden Attack Surface through these parameters. This often helps bug bounty hunters and security professionals to find unconventional and high reward paying bugs.

Since the purpose and motivation behind identifying the 

is now clear, let’s look for different tools & methodology to perform parameter discovery.

Tools for performing Parameter Discovery:

Arjun is a python based command-line tool that helps in the detection of the parameters present in the application. By default, the tool utilizes a custom wordlist to check for the parameters but this can be modified by the user to set their own parameters.

Detailed information and installation instructions can be found on the official repository of the Arjun tool:

Run the following command: arjun -u https://demo.testfire.net

Observe the parameters returned by the tool.

Note: By default, the tool uses GET request method but you can define other methods such as POST by using -m flag. Ex: python3 arjun.py -u https://target.com/test -m POST

ParamSpider is a python based command-line tool that helps in the identification of the parameters. It has the ability to find parameters from web archives, subdomains and other sources as well. This is one of the most effective tools to identify the parameters.

Detailed information and installation instructions can be found on the official repository of the ParamSpider tool:

 https://github.com/devanshbatham/ParamSpider

Finding Hidden Parameters with ParamSpider

Run the following command: python3 paramspider.py -d <target_domain> –level high

Param-Miner is a Burp Suite Extension that is handy and useful to find hidden and unlinked parameters that are specifically useful while looking for the Web Cache Poisoning related vulnerabilities.

Detailed information about the extension can be found here:

 https://github.com/PortSwigger/param-miner

The YesWeHack Blog

Let’s get the IoT landscape less vulnerable for all

Back to Decathlon’s Live Bug Bounty

DOJO CHALLENGE #17 Winners!

Let’s get the IoT landscape less vulnerable for all

The French government’s digital identity application under Bug Bounty program on YesWeHack

YesWeHackVR, an immersive hacking game

Abusing S3 Bucket Permissions

The French government’s digital identity application under Bug Bounty program on YesWeHack

Parameter Discovery: A quick guide to start

The first live Bug Bounty for European scale-ups and unicorns

Getting started with smart contract in Bug Bounty

Parameter Discovery: A quick guide to start

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us