 was to find a way to retrieve a FLAG with some JavaScript, which was hidden inside an anonymous function.

This DOJO was also special because it was created by one of our DOJO masters, aka Ivarsvids. Thanks to him for this great challenge!

 You want to create your own DOJO and publish it? Send us a message on 

We are glad to announce the #12 DOJO Challenge winners list.

The best writeups reports were submitted by: 

 feeds to be notified of the upcoming challenges.

Read on to find the best write-up as well as the challenge author’s recommendations.

If only it were possible to use the password field to get the FLAG.

We asked you to produce a qualified write-up report explaining the logic allowing such exploitation. This write-up serves two purposes:

Determine the contestant ability to properly describe a vulnerability and its vectors inside a professionally redacted report. This capacity gives us invaluable hints on your own, unique, talent as a bug hunter.

‘s report was detailed, informative, and good at explaining the logic to understand how each 

 works together and they can be used to finally retrieve the FLAG.

‘s were also very nice, we’re sorry can’t publish them all because that’s where you clearly witness the outstanding creativity of our community.

This dojo presents the challenge of leaking a flag that is randomly generated in a JavaScript EventTarget.

Looking at the JavaScript code there are a few things to notice. Lets start with the element we can control/manipulate to understand the application:

The input field $password is injected as a parameter of the validate-function.

Since there are no character limitations, we can easily escape the validate function and inject our own code:

Setting $password: to ");alert(1);(" results in validate("");alert(1);(""); and pops an alert box upon execution. This is the easy part, the hard part is leaking the flag.

The flag is located in the custom EventTarget class Secret. A random value is assigned to it when a new object is created.

Furthermore a event listener is registered, which listens for events of type “validate”.

The second parameter of addEventListener is a function, which takes the Event source object and checks for a attribute detail. Depending on its value a different message is displayed. The Event itself is sent in a different class function called validate:

The class SecretEvent is nothing else but a CustomEvent, as we can see in the following code block: const SecretEvent = CustomEvent;

In order to get the flag we clearly have to pollute a prototype. There are two likely candidates in the two custom classes Secret and SecretEvent. Apparently the challenge would be too easy if we could pollute Secret‘s parent class EventTarget, since the challenge’s author included the following line EventTarget = null, which makes it impossible to pollute the class. Therefore the most likely candidate is SecretEvent.

Lets first take a quick look, how the SecretEvent object looks like at runtime. We can do so by changing the line result.innerHTML = 'Wrong password!'; to console.log(e); and run the whole script in a JavaScript console. When executing the validate function, we can now inspect how the object e looks like:

As we can see, both the flag and the detail attribute are present in the Event-object, which makes the CustomEvent class the obvious choice to pollute.

Now lets do the actual polluting. We need to find a candidate function, which will be executed by the event listener, which we can overwrite with our own function. The only one I could spot was the getter-function for the detail attribute, which is called here: if (e.detail === this.flag){. Therefore it should be possible to pollute that getter with the following code:

Note that the chose function style here is crucial (which I only found out thanks to the hint on twitter). If we use an arrow function instead (()=>alert(this.target.flag)) it would not work since this refers to the global window object instead of the CustomEvent object. Therefore it would not be possible to leak the flag.

Putting all together, the POC consists of the following steps:


pollute the prototype and overwrite the detail-getter with

call the validate function again with validate("


As a result an alert box should pop containing the flag:

DOJO CHALLENGE #12 Winners!

 publishes articles on exploitation techniques, tools and tips to help hunters find vulnerabilities in their reconnaissance process and hunting routine. The goal is to provide ideas and keys to attack and understand the various web technologies hunters may face on their private programs.

Digitalization has increased to a great extent in the last couple of years, along with the technology evolution. In the past years, JavaScript frameworks such as Angular, React, Electron, Node, Vue, etc., were a trendy option for organizations and developers. However, a regular security assessment against such technologies and frameworks allows security researchers to discover various security vulnerabilities that may lead to a direct or indirect impact on the Confidentiality, Integrity and Availability of the applications built using these frameworks.

In this article, we will talk about performing a Security Assessment on Electron-based applications and, more specifically, looking at the “Electron Specific Vulnerabilities” and some common ways to exploit them.

According to the official documents of Electron.js, Electron is a framework for building desktop applications using JavaScript, HTML, and CSS. By embedding 

 into its binary, Electron allows you to maintain one JavaScript codebase and create cross-platform apps that work on Windows, macOS, and Linux — no native development experience required.

A detailed guide for understanding and exploring the Electron framework can be found here: 

A list of applications that are built using Electron can be found here: 

Introduction to Electron Application Penetration Testing

As mentioned in the introduction, the electron is a framework for building a cross-platform desktop application. The basic idea behind this is to embed a Chromium binary that powers the electron-based applications to run similar to the web applications.

When it comes to performing penetration testing, most of the checks that are found on the “Web & APIs” such as Missing Access Controls, Broken Authentication, “XXE & SSRF”, etc. and “Thick Client” such as “DLL Hijacking”, “Hardcoded Information”, “Insecure Logging” would still be present.

For assessing the Electron Application that calls the API endpoints, similar test cases to the API Pentesting can be performed. A quick reference about Web & API security issues can be found at: 

https://owasp.org/www-project-api-security/

In this article, we will be specifically looking at the 

While working on Electron-based applications, reading its base code and navigating to the storage directory can reveal interesting information and security loopholes. This process is fairly simple, one can follow the below steps to find the installation directory:

Right-click on the application > Properties > Open File Location

This will open the installation directory, often you can find some logs and configuration files there that may reveal sensitive information.

Now, in the installation directory, navigate to the 

, this is of our interest for further inspection and analysis.

, an ASAR file is an archive used to package source code for an application using Electron, an open-source library used to build cross-platform programs. It is saved in a format similar to 

 archives where files contained in the archive, such as 

 files, are concatenated together without using compression.

In a nutshell, the .asar file format is similar to an archive that is used by the electron to package the various code files together. Since, the electron is a javascript framework and heavily relies upon it, decompressing the 

file enables one to perform code analysis in order to find security flaws.

The process of decompiling and recompiling the .asar file is fairly simple. First of all, it is required to have the node and npm installed to get things working.

Run the following command to install the asar npm package:

Run the following command for decompression:

Run the following command for repackaging:

Reading the source code may often allow an attacker to identify some interesting and sensitive piece of information such as credentials, API Keys, secrets, tokens and others.

There are multiple ways to identify the hardcoded information, however, a tester can use the below method to identify the sensitive information:

Open the terminal and navigate to the directory having decompressed asar file.

Use Grep or preferred tool for performing regex pattern based extraction.

A list of sensitive keywords can be found 

Additionally, the gf patterns can also be used for identify sensitive information and vulnerable patterns.

Electron’s official website itself provides a great set of security best practices and, if followed properly, help mitigate common security issues that one may encounter during the testing. Some of the security best practices to follow while developing Electron applications are:

The application should use secure communication, data transfer and other activities. It is recommended to use HTTPS, FTPS, WSS, etc., over HTTP, FTP or WS.


An attacker might be able to eavesdrop on the communication over an insecure channel and perform a Man-in-the-Middle attack to steal sensitive information.

Disable nodeIntegration for Untrusted Sources/Remote Content: 

The application should not have nodeIntegration enabled in any renderer function such as BrowserWindows, BrowserView, etc that may load remote content. Ensure that the nodeIntegration is disabled by setting its value to “false”.


An attacker might be able to utilize the nodeIntegration to perform attacks such as arbitrary JavaScript execution leading to cross-site scripting, local file read or even code execution in certain scenarios.

Electron provides a feature to run code in preload scripts and in Electron APIs in a dedicated JavaScript context. Along with disabled nodeIntegration, it is also recommended to use Context Isolation.


An attacker might be able to utilize the insecure preload scripts in absence of Context Isolation to bypass the nodeIntegration or Sandbox to perform further impactful attacks.

Disabling webSecurity will disable the same-origin policy and set allowRunningInsecureContent property to true. In other words, it allows the execution of insecure code from different domains. Ensure that the webSecurity is enabled.


An attacker might be able to perform multiple attacks as the protection layer, i.e. WebSecurity is disabled.

Content-Security-Policy (CSP) acts as a defence-in-depth mechanism against some attacks such as Cross-Site Scripting. Implementing a CSP can help to prevent cross-site scripting attacks. Although it is not a permanent solution, a strong CSP can prevent this type of attack from happening unless bypassed.


An attacker might be able to perform attacks such as Cross-Site-Scripting and impact the application & its users in the absence of CSP.

The electron doesn’t allow websites over HTTPS to load & execute content from insecure sources. However, if the property allowRunningInsecureContent is set to true , the protection is disabled.


An attacker might be able to load and execute content from insecure sources if the allowRunningInsecureContent is set to true.

 might require the pages and scripts to be loaded in <webview> tag to open new windows. The allowpopups attribute enables them to create new 

 using the window.open() method. <webview> tags are otherwise not allowed to create new windows.


An attacker might be able to abuse this behaviour for performing attacks such as UI Redressing.

A WebView created in a renderer process that does not have Node.js integration enabled will not be able to enable integration itself. However, a WebView will always create an independent renderer process with its own webPreferences. It is a good idea to control the creation of new 

 tags from the main process and to verify that their webPreferences do not disable security features.


Since <webview> live in the DOM, an attacker might be able to create them by a script running on the website even if Node.js integration is otherwise disabled.

Disable openExternal with Untrusted Content: 

Shell’s openExternal() allows opening a given external protocol URI with the desktop’s native utilities. For instance, on macOS, this function is similar to the ‘open’ terminal command utility and will open the specific application based on the URI and filetype association


An attacker might be able to utilize the misconfigured openExternal to compromise the user’s host.

It is recommended to use the latest version of the Electron in order to ensure that any previous/known vulnerabilities are not impacting the application.


An attacker would be able to enumerate known vulnerabilities and use the public exploits/write exploits in order to impact the application.

Hacking Electron Apps with Electronegativity

Electronegativity is a tool to identify misconfigurations and security anti-patterns in 

-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as described in the 

“Electron Security Checklist — A Guide for Developers and Auditors”

Software developers and security auditors can use this tool to detect and mitigate potential weaknesses and implementation bugs when developing applications using Electron. A good understanding of Electron (in)security is still required when using Electronegativity, as some of the potential issues detected by the tool require manual investigation.

https://github.com/doyensec/electronegativity

a. Navigate to the Electron Application’s Installation Directory which contains the asar file.

b. Open the terminal and run the following command:

c. Observe that the tool returned with the misconfiguration and vulnerabilities.

https://www.blackhat.com/docs/us-17/thursday/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf

https://www.electronjs.org/docs/tutorial/security

https://docs.google.com/presentation/d/1wQM4fhjCJ9r3DQ-c98XJFkrd83odM94FaJPqstTR68c/edit#slide=id.p

https://www.youtube.com/watch?v=Qirdy1TP1Rw

The use of cross-platform applications is increasing and thus the popularity of electron for building the cross-platform desktop application. It is one of the less travelled roads in bug bounty and still has a lot of potentials when it comes to finding impressive security issues. We hope this blog post will help you understand electron security best practices and vulnerabilities in a better way.

Pentesting Electron Applications

, Europe’s leading Bug Bounty and Vulnerability Disclosure Policy (VDP) platform, today announced that it has raised €16 million in Series B funding. 

 are the two new backers, with Series A investors 

, renewing their confidence in YesWeHack.

The platform, which connects ethical hackers with organisations to test and improve their security, has achieved a record growth of 450% since 

its first round of funding just two years ago.

 YesWeHack has expanded significantly in Europe and Asia-Pacific and now has a community of over 25,000 researchers and customers in more than 40 countries, with more than half of its revenue generated internationally.

 has established itself as a global leader in the bug bounty market in less than five years, providing its clients with high-quality support and unique data sovereignty guarantees.

YesWeHack will use the new round of funding to meet three goals. Firstly, the platform will continue enabling all organisations, from start-ups to large enterprises and governments worldwide, to raise their cybersecurity strategy and address the challenges of digital transformation against a backdrop of exponential growth in threats.

“Covid-19 has considerably accelerated the modernisation of our clients’ IT systems and increased their attack surface,” says 

. “Security teams realise that traditional approaches are no longer sufficient. That’s why at YesWeHack, we offer an agile and scalable solution that meets these challenges.”

Secondly, part of the investment will support the R&D effort to complement and deepen the value delivered to YesWeHack’s customers, enabling them to realise the platform’s full potential. In addition to developing additional features and services, the focus will remain on the quality of service and customised support, ensuring rapid adoption and maximum return on investment for customers.

Finally, this new round of funding will help YesWeHack increase its international presence and expand globally. The company will accelerate recruitment in France and internationally, with no less than 100 new positions created over the next 18 months.

Such global presence meets the growing market demand for the crowdsourced security model and establishes YesWeHack as the only credible alternative to US platforms.

“We are grateful for the confidence shown by our existing investors Normandie Participations and CNP Assurances as well as our new partners. Our decision to get backing from Banque des Territoires and Eiffel Investment Group is motivated by their strong European roots. With this new investment, we are contributing to the growth of the cybersecurity sector, and bug bounty provides a disruptive approach in times of high demand. We are also demonstrating that European solutions are on par with their counterparts,” said 

is firmly committed to cybersecurity as it has become a significant concern for local authorities and public players. We will continue to support French companies in this sector and help them excel at a global level. We are delighted to participate in YesWeHack’s latest fundraising round and support their development,” said 

, investment director of Banque des Territoires.

 is a Global Bug Bounty & VDP Platform.
YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers: support in creating a 

 (VDP), a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Want to discuss crowdsourced security with our experts?

YesWeHack raises €16 million to accelerate its international expansion

Over the past decade, most businesses across the globe have been on a transformation spree across all operational areas. Meanwhile, a McKinsey 

 highlights that COVID-19 has sped up digital transformation and technologies by several years–and many of the changes could be here for the long haul. However, this has significantly increased reliance on third parties, specifically cloud providers, APIs, IoT, and the unchecked expansion of shadow IT, resulting in multiple data breaches. IT security complexity remains a challenge for organisations as they try to balance existing and new technology deployments and the ever-evolving and malicious threat landscape. Current tools or solutions to manage third-party risk are still not considered adequate.

Even though boards are beginning to understand that cyberattacks are business risks and not just IT risks, most business leaders across various functions – from finance to procurement and operations – cannot prepare teams and protect the organisation’s information, processes, and procedures. Security leaders now have the opportunity to deliver value in “hard dollars” (direct & indirect savings) and create better accountability through transparency.

Bug bounty programs can help to seamlessly highlight security gaps within applications and infrastructure, which helps drive continuous improvement. Besides, since every interaction is tracked, stored and monitored through the platform, bug bounty programs increase traceability and hence transparency. This helps to improve accountability between the business, IT and security teams to create a robust organisation. Doing so will build trust, help identify vulnerable areas, develop the right response plans, and keep cybercriminals at bay.

Here are three ways bug bounty programs bring business and cybersecurity leaders together to build transparency and improve accountability within the organisation.

Improve Collaboration Between Teams to Enhance Security

Most forward-looking organisations have adopted an agile methodology to build, test, and release software faster and more reliably. However, there is constant friction between development and security teams. Security mandates are deemed to be unnecessarily intrusive and a cause of delayed application development and deployment. DevSecOps is in the early stages of mainstream adoption as per Gartner’s Hype Cycle for 

. Just as the development team thinks that 

DevOps isn’t any single person’s job – it’s everyone’s job

; CISOs are trying hard to create a culture of building applications designed to be secure.

Sometimes, developers don’t often have the time, tools, skills or motivation to write impeccably secure code. Bug bounty programs provide a “fact-based” financial implication of inherent security flaws within the process. This makes it possible to hold development teams and service providers accountable for creating or delivering insecure products, thus addressing inherent security gaps within the business units and helps to drive continuous improvement. On the positive side, it’s a way of recognising progress.

, a French online music streaming service, adopted bug bounty to protect artists from any fraud relating to the platform. Romain Lods, Head of Engineering at Deezer, recommends tools such as bug bounty to minimise the dependency on legacy systems, which are more complex to secure afterwards. “As a general rule, it’s better to know your security flaws when you start a project, rather than wait until there are too many to deal with, after you’ve made (bad) choices of architectures. We see an increased awareness of security. Bug bounty reports helped us trigger some major security projects. Our cybersecurity vision and posture have evolved, and bug bounty is one of the drivers of this change,” advises Romain.

The days businesses choose, install and run software without any due diligence are numbered since third-party software and open-source components are prime targets for cybercriminals. Most IT departments and procurement teams spend a considerable amount of time, budget and resources to run a meaningful vendor software testing program. Many organisations don’t think twice before blacklisting providers who create too many bugs and are expensive or risky due to security concerns. On the other hand, vendors can help their customers meet this requirement and accelerate the process through their own bug bounty programs. They can highlight the safety of their products, eliminate security concerns and, in fact, drive faster sales closures.

Europe’s leading publisher of cybersecurity solutions

 decided to move to continuous monitoring to improve the security of their applications and reassure their customers. “We are often asked searching questions about our security guarantees. However, the conversation completely changes when we talk to clients about our bug bounty program with 

. The fact that experts are continuously testing our applications reassured them immediately. In my opinion, every company that develops software should implement bug bounty programs. It’s a necessary step if you want to deliver both a secure and scalable software solution,” highlighted a security expert from the company.

Most organisations struggle to understand how much they spend on security audits and if the security spend translates to a reduction in the attack surface or the organisation’s risk exposure. The bug bounty model is platform driven and results-oriented, providing the necessary data to create a transparent process. Organisations can measure the impact of their security spend since they pay only for valid reports according to their security requirements and the actual severity of each bug, and everything is tracked on the platform. This helps to understand the performance of the security audit and creates a shared understanding of related costs when communicated with the business stakeholders. For instance, an Information System Security Expert of a 

 shared that two pentests missed an eighteen-month-old critical flaw which was identified within just an hour after launching the bug bounty program with YesWeHack.

“I’ve been pentesting critical sites for years and getting empty or nearly empty reports in return. We were paying because it was our policy, and we needed to meet our compliance requirements, but it brought us nothing, or almost nothing more, in terms of security. With YesWeHack’s bug bounty program, we gave the Operational Security team direct access to our program. This way, our colleagues can see the vulnerabilities as soon as they’re validated. Also, our developers can interact directly with the hunters,” he added.

Apart from building transparency and improving accountability within the organisation, several other benefits include reducing security costs and freeing valuable resources across the organisation. To understand how you can maximise the return on investment (ROI) of bug bounty programs, download the eBook on “

Five Reasons Why Bug Bounty Improves the Return on Security Investments

A 2020 Cyber Readiness Report highlighted that companies lost $1.8 billion to cybercrime in 2019. Failures and abuses of security, privacy, and trust are rising as businesses worldwide accelerate digital transformation. Access to security experts who can work with you closely and identify threats quickly is the need of the hour. Here are 

the benefits of bug bounty programs that give your business the much-needed security reality check.

To find out more, contact one of our Bug Bounty experts:

More Resources on Stretching Your Security Budget With Bug Bounty Programs

As digital innovations make the world a faster, better, and much more efficient place to work and live, the focus is shifting towards security threats and how best to handle them. A secure and hardened IT environment helps gain customers’ trust in the long run. To understand how to maximise the return on investment (ROI) of bug bounty programs, 

“Five Reasons Bug Bounty Improves the Return on Security Investments“

three ways bug bounty programs can give your business the much-needed security reality check

The global pandemic has accelerated digital transformation, exposing organisations’ #vulnerabilities that threaten their existence. The complexity of security threats has increased rapidly over the years, making bug bounty programs a must to achieve greater security.

 Here are three ways to stretch your security budget further with bug bounty programs.

The traditional castle-and-moat approach to #cybersecurity cannot keep up with an ever-expanding attack surface and sophisticated cyberattacks. In the face of limited security budgets, understand how bug bounty programs can remove inefficiencies, reduce overhead costs, and free up resources to be deployed productively across other projects. 

Here are three ways to reduce overhead costs and resources with bug bounty programs.

As businesses become digitally mature, they will have to deal with the alarming increase in cyber threats. This forces conversations on data ownership, privacy, security, transparency, and trust. 

Find out how bug bounty drives agility and improves profits for digital businesses.

 is a Global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers: support in creating a 

, a learning platform for ethical hackers called 

Benefits of Bug Bounty Programs to Build Transparency and Improve Accountability

As the pace of digital change accelerates, you don’t want barriers in the way of your transformation strategy. Any delays need to be addressed at the speed of business to sustain a competitive advantage.

Fixing software bugs with code changes or system patches remains a critical security task that needs to be conducted rapidly and reliably, even though it takes significant time. Moreover, many organisations also lack DevSecOps expertise. This is especially the case with legacy applications. For example, it can be disastrous when a legacy application uses a web interface, a popular database back-end or a component whose source code is unavailable or difficult to modify.

It can take days, weeks, or months to find the root cause of the problem, issue a fix, test it, and launch it into production. During this time, sensitive data is exposed to potential attacks without protection.

Your goal must be the integration of frictionless security. Imagine instead a scenario whereby you can issue a fix in hours. The threat to your web application is closed almost immediately, so that development and infrastructure teams have enough time to fix vulnerabilities properly.

Virtual patching is achieved by a dedicated rule or a set of rules deployed in a web application firewall (WAF) that diminishes a software vulnerability without changing the underlying codebase. A WAF filters, monitors, and blocks HTTP traffic to and from the web service. By inspecting traffic, it can prevent attacks exploiting a web application’s known vulnerabilities. Virtual patching is ideal when an urgent fix is required: this type of remediation implements a security policy enforcement layer, enabling your operations team to keep a system running until a complete fix passes design, development, testing, and approval.

to deliver agile and effective virtual patching. Seamless integration between the Rohde & Schwarz WAF and the YesWeHack platform enables you to discover and protect against high-impact vulnerabilities quickly and efficiently, dramatically reducing your risk exposure. Where in the past it may have taken you days, weeks, or even months to remediate a vulnerability – now you can do it in hours.

The highly scalable solution can be deployed on-premises, in public clouds and hybrid / multi-cloud environments.

Once a YesWeHack ethical hacker identifies a vulnerability, the report is evaluated, and you can request and receive a virtual patch at the click of a button. The process couldn’t be simpler:

1️⃣ You request a patch for the vulnerability directly from your vulnerability report interface, adding information and insight as necessary.

2️⃣ The request is acknowledged and examined. You can review the status of the virtual patch throughout the process.

3️⃣ When a fix is available, the bug bounty program manager integrates it and provides it for testing to the hunter who identified the initial vulnerability.

4️⃣ The hunter confirms the bug cannot be reproduced or bypassed. If it passes the test, you can immediately push forward with the DevSecOps pipeline.

5️⃣ Whatever the type of patch you deploy, all actions are logged. That sort of changelog is precious in highly compliant environments. No more tedious Excel sheets!

This innovative YesWeHack and Rohde & Schwarz cybersecurity integration enable rapid, virtual patching of application vulnerabilities. The WAF rapidly blocks the exploitation of a vulnerability, reducing the time-sensitive data is exposed to potential attacks to hours, not days.

It makes sense on every level. You receive a patch in a fraction of the time and cost of traditional methodologies. Patch requests, tests, and acceptance are tracked as they happen. You have complete visibility throughout the process. And, of course, your application portfolio remains secure and free of vulnerabilities.

Rohde & Schwarz Cybersecurity is a leading IT security company that protects digital information and business processes of companies and public institutions worldwide against cyberattacks. The IT security expert offers innovative data security solutions for cloud environments, advanced security for websites, web applications and web services, as well as network encryption and endpoint security. The trusted security solutions are developed using the security-by-design approach and proactively prevent cyberattacks. For more information, visit www.rohde-schwarz.com/cybersecurity.

 is a Global Bug Bounty & VDP Platform.
YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.
YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

Virtual Patching of Vulnerabilities at the Pace of Business

Intruder is one of the first tool that any Burp Suite user interacts with. Behind its appearing simplicity, large-scale efficient usage isn’t straightforward and requires some preparation. When is the Pitchfork mode useful? How can we identify interesting security flaws with 

? Intruder is more than a simple brute-force tool, and that’s what we’ll see in this blog post.

This article is a guest blog post written by Nicolas Grégoire aka 

In this article, I will discuss Burp Suite’s Intruder, which is one of the most commonly tool of the suite, alongside 

. Why discussing such a common tool? Because I think that using it at peak efficiency is quite uncommon, and that plenty of subtle bugs were missed for this very reason. I also think that users should be able, despite large volumes of results, to 1) verify that a scan run correctly 2) identify uncommon responses. From my experience, the best way to identify such anomalous responses is to map all responses to “known states”, using built-in features like 

Here’s the TL;DR version: ensuring that an attack run as expected, as well as analyzing responses for small differences, should be considered as core tasks and planned accordingly.

Before processing responses, we first have to emit some traffic. The most common way to initialize an Intruder tab is to use the contextual menu (action “

”) or the corresponding keyboard shortcut (by default “

”). It is interesting to note that this action will send more than the request, as the base unit in Burp Suite is the exchange (a request + a response). That’s easy to verify: send a message to Intruder and go to “

”. The new window clearly shows the response associated to the request visible in the “

”, you may want to remove, modify or add some payload markers (i.e. the “

” signs). Some users are lucky enough to have the corresponding character on their keyboard (I do, thanks to the French AZERTY layout). The remaining majority probably want to configure the “

” under the cursor or surround the selected text with it. For users of the Pro version willing to execute an automatic audit while customizing the targeted injection points, that’s possible from Intruder, using the “

” contextual menu. Very useful for minimizing the scope (and therefore the duration) of scans!

I will not review all the attack types (which are “

” is mostly a stripped-down version of “

”. The latter is useful in a bunch of common scenarios, and can be used to automatically manage anti-CSRF tokens, when mixed with the “

” payload type. That’s described in details in the following blog post, using DWVA as the test-bed so that 

Regarding payload types, there’s no point in reviewing all of them: the official documentation is quite good. Here’s however a few little-known ones that I commonly use:

” (for example its SHA256 hash). Also doable with 

“There’s more than one way to do it”

, which are extremely useful on opaque blobs of data, like binary or encrypted values. I used it to identify a Perl deserialization vulnerability, as described 

In the following screenshot (extracted from the link above), we can see that responses are processed using two filters: a “

 column). These filters massively lower the cost (in terms of time and cognitive efforts) of analyzing the results, and I strongly recommend using this strategy as much as possible! It’s generic, easy to setup and may allow you to:

The YesWeHack Blog

DOJO CHALLENGE #12 Winners!

Pentesting Electron Applications

YesWeHack raises €16 million to accelerate its international expansion

DOJO CHALLENGE #12 Winners!

Benefits of Bug Bounty Programs to Build Transparency and Improve Accountability

Virtual Patching of Vulnerabilities at the Pace of Business

PimpMyBurp #5 – Intruder: Use the tool to its full advantage

Benefits of Bug Bounty Programs to Build Transparency and Improve Accountability

DOJO CHALLENGE #11 Winners!

Bug Bounty on Android : setup your Genymotion environment for APK analysis

Blind XSS : setup your self-hosted XSS Hunter with the PwnMachine

DOJO CHALLENGE #11 Winners!

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us