, Europe’s leading Bug Bounty and Vulnerability Disclosure Policy (VDP) platform, today announced that it has raised €16 million in Series B funding. 

 are the two new backers, with Series A investors 

, renewing their confidence in YesWeHack.

The platform, which connects ethical hackers with organisations to test and improve their security, has achieved a record growth of 450% since 

its first round of funding just two years ago.

 YesWeHack has expanded significantly in Europe and Asia-Pacific and now has a community of over 25,000 researchers and customers in more than 40 countries, with more than half of its revenue generated internationally.

 has established itself as a global leader in the bug bounty market in less than five years, providing its clients with high-quality support and unique data sovereignty guarantees.

YesWeHack will use the new round of funding to meet three goals. Firstly, the platform will continue enabling all organisations, from start-ups to large enterprises and governments worldwide, to raise their cybersecurity strategy and address the challenges of digital transformation against a backdrop of exponential growth in threats.

“Covid-19 has considerably accelerated the modernisation of our clients’ IT systems and increased their attack surface,” says 

. “Security teams realise that traditional approaches are no longer sufficient. That’s why at YesWeHack, we offer an agile and scalable solution that meets these challenges.”

Secondly, part of the investment will support the R&D effort to complement and deepen the value delivered to YesWeHack’s customers, enabling them to realise the platform’s full potential. In addition to developing additional features and services, the focus will remain on the quality of service and customised support, ensuring rapid adoption and maximum return on investment for customers.

Finally, this new round of funding will help YesWeHack increase its international presence and expand globally. The company will accelerate recruitment in France and internationally, with no less than 100 new positions created over the next 18 months.

Such global presence meets the growing market demand for the crowdsourced security model and establishes YesWeHack as the only credible alternative to US platforms.

“We are grateful for the confidence shown by our existing investors Normandie Participations and CNP Assurances as well as our new partners. Our decision to get backing from Banque des Territoires and Eiffel Investment Group is motivated by their strong European roots. With this new investment, we are contributing to the growth of the cybersecurity sector, and bug bounty provides a disruptive approach in times of high demand. We are also demonstrating that European solutions are on par with their counterparts,” said 

is firmly committed to cybersecurity as it has become a significant concern for local authorities and public players. We will continue to support French companies in this sector and help them excel at a global level. We are delighted to participate in YesWeHack’s latest fundraising round and support their development,” said 

, investment director of Banque des Territoires.

 is a Global Bug Bounty & VDP Platform.
YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers: support in creating a 

 (VDP), a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Want to discuss crowdsourced security with our experts?

YesWeHack raises €16 million to accelerate its international expansion

Over the past decade, most businesses across the globe have been on a transformation spree across all operational areas. Meanwhile, a McKinsey 

 highlights that COVID-19 has sped up digital transformation and technologies by several years–and many of the changes could be here for the long haul. However, this has significantly increased reliance on third parties, specifically cloud providers, APIs, IoT, and the unchecked expansion of shadow IT, resulting in multiple data breaches. IT security complexity remains a challenge for organisations as they try to balance existing and new technology deployments and the ever-evolving and malicious threat landscape. Current tools or solutions to manage third-party risk are still not considered adequate.

Even though boards are beginning to understand that cyberattacks are business risks and not just IT risks, most business leaders across various functions – from finance to procurement and operations – cannot prepare teams and protect the organisation’s information, processes, and procedures. Security leaders now have the opportunity to deliver value in “hard dollars” (direct & indirect savings) and create better accountability through transparency.

Bug bounty programs can help to seamlessly highlight security gaps within applications and infrastructure, which helps drive continuous improvement. Besides, since every interaction is tracked, stored and monitored through the platform, bug bounty programs increase traceability and hence transparency. This helps to improve accountability between the business, IT and security teams to create a robust organisation. Doing so will build trust, help identify vulnerable areas, develop the right response plans, and keep cybercriminals at bay.

Here are three ways bug bounty programs bring business and cybersecurity leaders together to build transparency and improve accountability within the organisation.

Improve Collaboration Between Teams to Enhance Security

Most forward-looking organisations have adopted an agile methodology to build, test, and release software faster and more reliably. However, there is constant friction between development and security teams. Security mandates are deemed to be unnecessarily intrusive and a cause of delayed application development and deployment. DevSecOps is in the early stages of mainstream adoption as per Gartner’s Hype Cycle for 

. Just as the development team thinks that 

DevOps isn’t any single person’s job – it’s everyone’s job

; CISOs are trying hard to create a culture of building applications designed to be secure.

Sometimes, developers don’t often have the time, tools, skills or motivation to write impeccably secure code. Bug bounty programs provide a “fact-based” financial implication of inherent security flaws within the process. This makes it possible to hold development teams and service providers accountable for creating or delivering insecure products, thus addressing inherent security gaps within the business units and helps to drive continuous improvement. On the positive side, it’s a way of recognising progress.

, a French online music streaming service, adopted bug bounty to protect artists from any fraud relating to the platform. Romain Lods, Head of Engineering at Deezer, recommends tools such as bug bounty to minimise the dependency on legacy systems, which are more complex to secure afterwards. “As a general rule, it’s better to know your security flaws when you start a project, rather than wait until there are too many to deal with, after you’ve made (bad) choices of architectures. We see an increased awareness of security. Bug bounty reports helped us trigger some major security projects. Our cybersecurity vision and posture have evolved, and bug bounty is one of the drivers of this change,” advises Romain.

The days businesses choose, install and run software without any due diligence are numbered since third-party software and open-source components are prime targets for cybercriminals. Most IT departments and procurement teams spend a considerable amount of time, budget and resources to run a meaningful vendor software testing program. Many organisations don’t think twice before blacklisting providers who create too many bugs and are expensive or risky due to security concerns. On the other hand, vendors can help their customers meet this requirement and accelerate the process through their own bug bounty programs. They can highlight the safety of their products, eliminate security concerns and, in fact, drive faster sales closures.

Europe’s leading publisher of cybersecurity solutions

 decided to move to continuous monitoring to improve the security of their applications and reassure their customers. “We are often asked searching questions about our security guarantees. However, the conversation completely changes when we talk to clients about our bug bounty program with 

. The fact that experts are continuously testing our applications reassured them immediately. In my opinion, every company that develops software should implement bug bounty programs. It’s a necessary step if you want to deliver both a secure and scalable software solution,” highlighted a security expert from the company.

Most organisations struggle to understand how much they spend on security audits and if the security spend translates to a reduction in the attack surface or the organisation’s risk exposure. The bug bounty model is platform driven and results-oriented, providing the necessary data to create a transparent process. Organisations can measure the impact of their security spend since they pay only for valid reports according to their security requirements and the actual severity of each bug, and everything is tracked on the platform. This helps to understand the performance of the security audit and creates a shared understanding of related costs when communicated with the business stakeholders. For instance, an Information System Security Expert of a 

 shared that two pentests missed an eighteen-month-old critical flaw which was identified within just an hour after launching the bug bounty program with YesWeHack.

“I’ve been pentesting critical sites for years and getting empty or nearly empty reports in return. We were paying because it was our policy, and we needed to meet our compliance requirements, but it brought us nothing, or almost nothing more, in terms of security. With YesWeHack’s bug bounty program, we gave the Operational Security team direct access to our program. This way, our colleagues can see the vulnerabilities as soon as they’re validated. Also, our developers can interact directly with the hunters,” he added.

Apart from building transparency and improving accountability within the organisation, several other benefits include reducing security costs and freeing valuable resources across the organisation. To understand how you can maximise the return on investment (ROI) of bug bounty programs, download the eBook on “

Five Reasons Why Bug Bounty Improves the Return on Security Investments

A 2020 Cyber Readiness Report highlighted that companies lost $1.8 billion to cybercrime in 2019. Failures and abuses of security, privacy, and trust are rising as businesses worldwide accelerate digital transformation. Access to security experts who can work with you closely and identify threats quickly is the need of the hour. Here are 

the benefits of bug bounty programs that give your business the much-needed security reality check.

To find out more, contact one of our Bug Bounty experts:

More Resources on Stretching Your Security Budget With Bug Bounty Programs

As digital innovations make the world a faster, better, and much more efficient place to work and live, the focus is shifting towards security threats and how best to handle them. A secure and hardened IT environment helps gain customers’ trust in the long run. To understand how to maximise the return on investment (ROI) of bug bounty programs, 

“Five Reasons Bug Bounty Improves the Return on Security Investments“

three ways bug bounty programs can give your business the much-needed security reality check

The global pandemic has accelerated digital transformation, exposing organisations’ #vulnerabilities that threaten their existence. The complexity of security threats has increased rapidly over the years, making bug bounty programs a must to achieve greater security.

 Here are three ways to stretch your security budget further with bug bounty programs.

The traditional castle-and-moat approach to #cybersecurity cannot keep up with an ever-expanding attack surface and sophisticated cyberattacks. In the face of limited security budgets, understand how bug bounty programs can remove inefficiencies, reduce overhead costs, and free up resources to be deployed productively across other projects. 

Here are three ways to reduce overhead costs and resources with bug bounty programs.

As businesses become digitally mature, they will have to deal with the alarming increase in cyber threats. This forces conversations on data ownership, privacy, security, transparency, and trust. 

Find out how bug bounty drives agility and improves profits for digital businesses.

 is a Global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers: support in creating a 

, a learning platform for ethical hackers called 

Benefits of Bug Bounty Programs to Build Transparency and Improve Accountability

As the pace of digital change accelerates, you don’t want barriers in the way of your transformation strategy. Any delays need to be addressed at the speed of business to sustain a competitive advantage.

Fixing software bugs with code changes or system patches remains a critical security task that needs to be conducted rapidly and reliably, even though it takes significant time. Moreover, many organisations also lack DevSecOps expertise. This is especially the case with legacy applications. For example, it can be disastrous when a legacy application uses a web interface, a popular database back-end or a component whose source code is unavailable or difficult to modify.

It can take days, weeks, or months to find the root cause of the problem, issue a fix, test it, and launch it into production. During this time, sensitive data is exposed to potential attacks without protection.

Your goal must be the integration of frictionless security. Imagine instead a scenario whereby you can issue a fix in hours. The threat to your web application is closed almost immediately, so that development and infrastructure teams have enough time to fix vulnerabilities properly.

Virtual patching is achieved by a dedicated rule or a set of rules deployed in a web application firewall (WAF) that diminishes a software vulnerability without changing the underlying codebase. A WAF filters, monitors, and blocks HTTP traffic to and from the web service. By inspecting traffic, it can prevent attacks exploiting a web application’s known vulnerabilities. Virtual patching is ideal when an urgent fix is required: this type of remediation implements a security policy enforcement layer, enabling your operations team to keep a system running until a complete fix passes design, development, testing, and approval.

to deliver agile and effective virtual patching. Seamless integration between the Rohde & Schwarz WAF and the YesWeHack platform enables you to discover and protect against high-impact vulnerabilities quickly and efficiently, dramatically reducing your risk exposure. Where in the past it may have taken you days, weeks, or even months to remediate a vulnerability – now you can do it in hours.

The highly scalable solution can be deployed on-premises, in public clouds and hybrid / multi-cloud environments.

Once a YesWeHack ethical hacker identifies a vulnerability, the report is evaluated, and you can request and receive a virtual patch at the click of a button. The process couldn’t be simpler:

1️⃣ You request a patch for the vulnerability directly from your vulnerability report interface, adding information and insight as necessary.

2️⃣ The request is acknowledged and examined. You can review the status of the virtual patch throughout the process.

3️⃣ When a fix is available, the bug bounty program manager integrates it and provides it for testing to the hunter who identified the initial vulnerability.

4️⃣ The hunter confirms the bug cannot be reproduced or bypassed. If it passes the test, you can immediately push forward with the DevSecOps pipeline.

5️⃣ Whatever the type of patch you deploy, all actions are logged. That sort of changelog is precious in highly compliant environments. No more tedious Excel sheets!

This innovative YesWeHack and Rohde & Schwarz cybersecurity integration enable rapid, virtual patching of application vulnerabilities. The WAF rapidly blocks the exploitation of a vulnerability, reducing the time-sensitive data is exposed to potential attacks to hours, not days.

It makes sense on every level. You receive a patch in a fraction of the time and cost of traditional methodologies. Patch requests, tests, and acceptance are tracked as they happen. You have complete visibility throughout the process. And, of course, your application portfolio remains secure and free of vulnerabilities.

Rohde & Schwarz Cybersecurity is a leading IT security company that protects digital information and business processes of companies and public institutions worldwide against cyberattacks. The IT security expert offers innovative data security solutions for cloud environments, advanced security for websites, web applications and web services, as well as network encryption and endpoint security. The trusted security solutions are developed using the security-by-design approach and proactively prevent cyberattacks. For more information, visit www.rohde-schwarz.com/cybersecurity.

 is a Global Bug Bounty & VDP Platform.
YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.
YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

Virtual Patching of Vulnerabilities at the Pace of Business

Intruder is one of the first tool that any Burp Suite user interacts with. Behind its appearing simplicity, large-scale efficient usage isn’t straightforward and requires some preparation. When is the Pitchfork mode useful? How can we identify interesting security flaws with 

? Intruder is more than a simple brute-force tool, and that’s what we’ll see in this blog post.

This article is a guest blog post written by Nicolas Grégoire aka 

In this article, I will discuss Burp Suite’s Intruder, which is one of the most commonly tool of the suite, alongside 

. Why discussing such a common tool? Because I think that using it at peak efficiency is quite uncommon, and that plenty of subtle bugs were missed for this very reason. I also think that users should be able, despite large volumes of results, to 1) verify that a scan run correctly 2) identify uncommon responses. From my experience, the best way to identify such anomalous responses is to map all responses to “known states”, using built-in features like 

Here’s the TL;DR version: ensuring that an attack run as expected, as well as analyzing responses for small differences, should be considered as core tasks and planned accordingly.

Before processing responses, we first have to emit some traffic. The most common way to initialize an Intruder tab is to use the contextual menu (action “

”) or the corresponding keyboard shortcut (by default “

”). It is interesting to note that this action will send more than the request, as the base unit in Burp Suite is the exchange (a request + a response). That’s easy to verify: send a message to Intruder and go to “

”. The new window clearly shows the response associated to the request visible in the “

”, you may want to remove, modify or add some payload markers (i.e. the “

” signs). Some users are lucky enough to have the corresponding character on their keyboard (I do, thanks to the French AZERTY layout). The remaining majority probably want to configure the “

” under the cursor or surround the selected text with it. For users of the Pro version willing to execute an automatic audit while customizing the targeted injection points, that’s possible from Intruder, using the “

” contextual menu. Very useful for minimizing the scope (and therefore the duration) of scans!

I will not review all the attack types (which are “

” is mostly a stripped-down version of “

”. The latter is useful in a bunch of common scenarios, and can be used to automatically manage anti-CSRF tokens, when mixed with the “

” payload type. That’s described in details in the following blog post, using DWVA as the test-bed so that 

Regarding payload types, there’s no point in reviewing all of them: the official documentation is quite good. Here’s however a few little-known ones that I commonly use:

” (for example its SHA256 hash). Also doable with 

“There’s more than one way to do it”

, which are extremely useful on opaque blobs of data, like binary or encrypted values. I used it to identify a Perl deserialization vulnerability, as described 

In the following screenshot (extracted from the link above), we can see that responses are processed using two filters: a “

 column). These filters massively lower the cost (in terms of time and cognitive efforts) of analyzing the results, and I strongly recommend using this strategy as much as possible! It’s generic, easy to setup and may allow you to:

detect possible errors in your setup, for example related to session handling rules ;

detect unexpected outcomes, like an active session being killed by a WAF ;

classify responses in buckets, the smallest one being usually the most interesting one.

Beware, it is important not to focus exclusively on what I’d describe as the 

 (a vulnerability, a CTF flag, etc.). Monitoring the 

 (i.e. verifying that the automation setup works perfectly well) may indeed be even more critical. What is the point of sending hundreds or thousands requests if you misunderstood how the target’s anti-CSRF protection works? What about identifying bugs in your macros, like a typo on a cookie name? Or, even harder, detecting a subtle race condition that will kick in only 1% of the time… Luckily, this kind of monitoring doesn’t involve exclusive extensions or secret tricks, only three stock features listed in the “

”. The latter is the most limited one: it’s useful nearly exclusively for content injection situations (i.e. XSS) and is prone to false-positives on short strings. But I use the two remaining ones a lot!

” will generate a boolean field and should be used when looking for a specific string, like “

” will generate a text field and can be useful when targeting a specific DOM element, for example 

“<div id=”error-message”>…</div>”

. In both cases, complex regular expressions (using the 

 syntax) can also be used. The goal is to tag all responses, by associating them to known states. That’s, in my opinion, one of the only ways to process large amounts of responses without missing subtle clues. Some people may prefer to use Intruder’s display filter, but I don’t recommend it, as it doesn’t allow multiple parallel criteria.

You will quickly notice that repeatedly removing default “

” criteria is not only boring, but also time-consuming. One solution is to customize the initial settings of Intruder attacks, by setting “

” editor shows the base response sent to Intruder, it can be used to quickly pick strings to copy to “

Once you get used to this strategy, you may want to go even deeper. 

https://twitter.com/CoreyD97/status/1394703934435037184

Conclusion, and few words about Turbo Intruder

I hope you enjoyed this opinionated view of efficient usage of Burp Suite’s Intruder! Keep in mind that you may bump into other problems when doing large-scale scans: having a GUI is limiting (

how to easily run scans from a high-bandwith VPS?), 

) and moderately complex processing (like recursive brute-force) isn’t available. The next step would of course be the addition of 

If you are new to this extension, I strongly advise starting by reading 

 wrote some interesting Turbo Intruder scripts too, I recommend exploring his 

PimpMyBurp #5 – Intruder: Use the tool to its full advantage

 was to find a way to bypass all of MongoDB’s security filters to recover the administrator’s password.

We are glad to announce the #11 DOJO Challenge winners list.

The best writeups reports were submitted by: 

 feeds to be notified of the upcoming challenges.

Read on to find the best write-up as well as the challenge author’s recommendations.

You have just discovered a tool to read user information. Unfortunately for you, several filters have been set up to prevent the extraction of admin information. Can you find a way to disclose the password of the user “admin”?

We asked you to produce a qualified write-up report explaining the logic allowing such exploitation. This write-up serves two purposes:

Determine the contestant ability to properly describe a vulnerability and its vectors inside a professionally redacted report. This capacity gives us invaluable hints on your own, unique, talent as a bug hunter.

‘sreport was detailed, informative, and good at explaining the logic to bypass the different security filters.

‘s were also very nice, we’re sorry can’t publish them all because that’s where you clearly witness the outstanding creativity of our community.

The challenge consists of a mongo request which takes two parameters as input.

$user : the name of the user
$eq : a parameter that corresponds to a mongo logical operator equals

The goal is to retrieve the password of the account name called “admin”

try to bypass the condition on the info.role field by injecting a mongo operator

 field we can try to replace it with another mongo operator like 

 and change the condition on the role.
Unfortunately a lot of operators are filtered and in particular 

You have to look at the unfiltered Mongo operators that could be injected.
the $exists operator looks interesting. It tests whether a field is present or not in a document.

The problem then is to replace the USER string with a boolean (True) which does not seem possible.
But many languages considers a none empty string as True
Does it work with mongo?

I don’t have a document back but no error so it works (we can check it with the playground).

For the $user field, we cannot proceed in the same way but this field is vulnerable to manipulation on strings

We are able to add fields in the mongo query.

Note: each field is interpreted as AND conditions in the query.

We should try to make a OR condition but this is not possible in our case given the mongo syntax and anyway 

The parameter of method find() is a “dictionary” which will then be transformed into a bson object (binary json)

This is interesting because there can only be unique keys and so if i inject the same key twice one will be overwritten.

dict('user':'foo','user':'bar') -> {'user':'bar'}

Add more filters as quote,$exists,$in,snin…
Use input type validation
Remove $eq as parameter

DOJO CHALLENGE #11 Winners!

Having a dedicated Android test environment can be useful when a company needs to test a mobile application on its scope. The first possibility is to use a physical device, but this can present certain constraints and is not always easy to setup. The second possibility is to setup a virtual environment, and this is what we will see in this article.

This article is a guest blog post written by 

This is the most popular, fast and simple to install emulator based on 

, containing a wide range of virtual devices in order for the users to test the Android applications in the desktops. It is available for Windows, MacOS and Linux operating systems.

So, in order to install the devices, first we need to 

 and after completing the verification process simply download the 

 of Genymotion according to your operating system.

Make sure the VirtualBox is installed and configured in the system. If not, then follow up this 

After downloading the installer, follow the steps given in this 

Now to access the dashboard, simply login with the credentials defined in the account creation process and make sure to only select “Personal Use” radio button if you want to use this for free of cost.

In Figure no. 3, I have already installed two Samsung devices, but you can install any available device by pressing the plus icon in the top right corner.

For the demonstration purpose, I will install the Samsung Galaxy S10 (API — 29) with 4 processors and 4GB RAM.

After downloading, simply launch the virtual device from the dashboard.

In order to install the Google apps like Play Store, Gmail etc. in Genymotion, you must need to install the Open GApps package which can be found in the toolbar like shown in the below image.

Just click the button and accept the warning message. After installation reboot the device. So, you can easily download the target APK (Android Package) files directly from the Google Play store and start pen-testing.

This translator comes into rescue if an application which you are trying to install is containing the native ARM code and Genymotion throws the following error:

An error occurred while deploying the file. This probably means that the app contains ARM native code and your Genymotion device cannot run ARM instructions. You should either build your native code to x86 or install an ARM translation tool in your device.

Hence, to avoid this error download a suitable translator from this 

 and drag & drop into emulated virtual device.

To setup the Burp proxy listener to receive the incoming HTTP requests from the emulated device, add a new listener with an available port and an IP address which belongs to the VirtualBox host-only network like shown in the image:

This proxy setup would now allow you to intercept the HTTP requests coming from the WebView but not from the Android applications and the reason is 

If you don’t know about this technique already then let me tell you in quick that this is basically an extra protection from the developers which enforce the application to validate the server side certificates against a list of trustful certificates at the runtime which got embedded or pinned in the client side during the development process. This enforcement ensures to protect against man-in-the-middle attacks. That’s why to bypass this functionality we need to use tools like 

This tool will hook the code snippets in the runtime to manipulate the application’s logic and bypass the certificate pinning.

 version of the Frida server for android, but make sure it would be for x86 because Genymotion’s virtual devices have a 32-bit architecture only:

3. Decompress, rename and transfer the file into emulated device using adb:

4. Change its permission to execute the script:

To run the Frida server and hook the script automatically, I have written a custom script in the Bash which you can download from 

After saving the script, let’s run the Twitter Lite application and bypass the certificate pinning using Frida like shown in the image:

 Make sure ‘adb’ tool is in bin directory.

Now you can successfully intercept the HTTP requests coming from the applications in the Burp Suite.

Mobile Security Framework aka MobSF is a great tool to analyze the APK both statically and dynamically. To install this tool, follow up the 

 the tool and by default this will start listening on port 8000.

To initialize the scan all you need is the name of the package and hit Enter or the actual file on the host computer (which you can easily drag & drop in the dashboard)

But, make sure the name of the APK should be correct e.g “com.quora.android” and for this you can use adb tool with the following command:

For the second option, to pull the APK from the emulated device to your host computer I have automated the process in my script as well for the convenience.

After providing the desired APK, MobSF will analyze the complete source code and present you a well defined report with all of the necessary and juicy information.

One of the key features of this tool is runtime tests and bypassing SSL pinning means you don’t have to configure the proxy details in the WiFi settings, run the Frida server etc.

Well, now you must be wondering if MobSF has built-in features to cope up all of these extra work then what is the need of explaining them above?

because MobSF captures the HTTP traffic which you can send to a proxy like Burp Suite after selecting the request(s) from the dashboard which in my opinion is not very handy in manual testing. So, only for this reason I like to run Frida server separately in order to capture requests in the Burp Suite at runtime.

But, you should definitely try out this feature and for that click the “

” button from the top menu bar and then start the analysis:

” to view all of the captured HTTP requests.

Now from here, select any request(s) you want to redirect to the proxy in this case Burp Suite and click the button named “Send to Fuzzer”. By default, this will use “http://127.0.0.1:8080” but, you can change the port number with the available ports.

This is just a basic setup for beginners and if you guys find this helpful then feel free to ping me on 

 especially if you have some doubts still left in your mind. Happy Hunting!

Bug Bounty on Android : setup your Genymotion environment for APK analysis

Blind XSS is a common vulnerability and can have a significant impact if it reaches internal environments (e.g. backend, internal support tickets…). There are many online services that can perform blind XSS, but for some reason you may prefer to configure your own environment rather than use a online service. 

 is the most popular tool and a specific new version have been published recently, called “

The YesWeHack Blog

YesWeHack raises €16 million to accelerate its international expansion

Benefits of Bug Bounty Programs to Build Transparency and Improve Accountability

Virtual Patching of Vulnerabilities at the Pace of Business

YesWeHack raises €16 million to accelerate its international expansion

PimpMyBurp #5 – Intruder: Use the tool to its full advantage

DOJO CHALLENGE #11 Winners!

Bug Bounty on Android : setup your Genymotion environment for APK analysis

PimpMyBurp #5 – Intruder: Use the tool to its full advantage

Blind XSS : setup your self-hosted XSS Hunter with the PwnMachine

File Upload Attacks (Part 2)

YESWEHACK PROPHILE ON ZAX

Blind XSS : setup your self-hosted XSS Hunter with the PwnMachine

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us