Halloween 🎃, Oktoberfest 🍺, and World Smile Day 😊 are not the only notable events happening next month… Our latest roundup of offensive security insights for CISOs, security teams and security-conscious devs begins with a reminder that 17 October is another date to mark in your calendar if you have a security role in an organisation providing critical services within the EU.

That’s the deadline by which member states must transpose the Network and Information Security (NIS) 2 Directive into national law. We’ve compiled 

10 need-to-know facts for organisations that might be affected

, which is designed to achieve “a high common level of security of network and information systems across the Union” more effectively than its 2016 predecessor, NIS 1. Or for a more in-depth explainer of NIS 2 and the implications for your SecOps strategy 

In this roundup (originally published as a LinkedIn newsletter called 

) we’d also like to flag the (fairly) recent publication of 

Gartner’s latest Hype Cycle for Security Operations

assess the maturity and value of a given security innovation

, whether it’s cyber AI assistants or pentesting-as-a-service, and their capability to adopt it. 🛠️ 

The Hype Cycle (to which no technology is seemingly immune) is visualised on two axes – mapping rising, falling then stabilising expectations of a given technology over time as reality outruns hype. The cycle always runs through five phases: innovation trigger, peak of inflated expectations, trough of disillusionment, slope of enlightenment, and plateau of productivity. It’s an interesting and valuable read from an independent, data-driven and respected market research firm. 📈

, widely considered to be one of the most talented and effective ethical hackers in the world. 👇 Nagli was speaking during his participation at our 

 recently shared his thoughts on the impressive 

 podcast, with Fredrick Lee joining co-hosts David Spark and Andy Ellis for the latest, beautifully-named episode, ‘

I Said I Was Technically a CISO, Not a Technical CISO

’ (they have form for great titles, with the previous instalment called ‘

Everyone Has a Zero-Trust Plan Until They Get Punched in the Face

Among other CISO-focused content we’ve browsed this week, notable highlights include a

interview with Sailaja Kotra-Turner, CISO and director of global infrastructure at

 (owner of Jack Daniel’s whiskey 🥃), and a piece exploring 

, for which journalist Sam Birchall spoke to a CISO and cyber firm CEO. 🤝

The continuing rise in the volume of new vulnerabilities is unsurprising, we admit – but we’ll flag it anyway! A 

 reveals that the number of new CVEs rose 43% year-on-year between H1 2023 and H1 2024, continuing the inexorable surge that began in 2017. The report also investigates trends in state-sponsored activity, new threat actor groups and why 

 are being targeted at an accelerated rate. 🧐

 on another all-too-common “clash of interpretations surrounding who reported a flaw, when it was discovered, how severe it is, and whether the resulting patch is adequate”, when it comes to coordinated vulnerability disclosure. This particular episode pertains to a ‘spoofing’ flaw fixed as a “defence-in-depth” issue in Trident, 

’s proprietary browser engine for Internet Explorer, which Trend Micro’s Zero Day Initiative (ZDI) team claims was an RCE that warranted a higher CVSS. 🔒

Other new content in our wheelhouse that might be worth a peek is a 

Inside the ‘three billion people’ data breach

Troy Hunt, founder of data breach notification site 

 and Microsoft regional director, has documented 

’, his blog post centres on National Public Data, “a data aggregator most people had never heard of where a 'threat actor' has published various partial sets of data with no clear way to attribute it back to the source. And they're already the subject of a class action”. The vendor is apparently claiming that 

 1.3 million people were affected, although Hunt discovered 134 million unique email addresses in the related data dump – which would amount to around 100 emails per individual if both of these numbers are accurate, 

We’re super-excited to break new ground next month when we run Italy’s 

 in Rome on 28 September. The identity of the organisation involved will, as usual, be kept under wraps until the event is about to begin. Learn about the 

Just in case you happen to be in the countries in question at the time, YesWeHack will also be showcasing our vulnerability management solutions at 

, (Nuremburg, Germany; 22-24 October). 📅🌍

Read this monthly roundup even sooner by subscribing to 

 – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, 

 – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

This article explains how to perform white-box penetration testing on a Python web application running in a Docker container. In this white-box pentest, we will go through how to debug Python in VS Code in order to track our payloads throughout the process, and understand how security filters can hide vulnerabilities in plain sight.

Improve future black-box testing with code analysis

Visual Studio Code aka VS Code (or your preferred IDE)

, you can install the Python debugger extension from the extension tab on the left-hand side. Simply search for "

Our project will use the following file structure:

Certain files are extra-important and must be added or modified. The files below contain the final file content:

This is the vulnerable Python web application that we will run in a dockerised environment.

In our supervisord.conf file the only thing we need to modify is the 

python -m debugpy --listen 0.0.0.0:5678 --wait-for-client /app/6-ssti-classic.py

 to make sure our debugger listener starts once our Docker container boots up.

This will be the configuration used to tell Visual Studio Code how to connect to the Python Debugger running in a Docker container.

As well as building the Docker image, the Dockerfile installs and activates our Python debugger inside the Docker container.

To this file we will add a network called debug-net. We will then add a static IPv4 address to our Python web application: 172.20.0.111. Finally, we will open Python's debugger port: 5678.

This setup allows us to more effectively connect and communicate with the Python debugger running in the Docker container.

To validate that our setup is working properly, we need to start our Docker container, connect to Python Debugger, set up breakpoints in Visual Studio Code and, finally, perform a request to the web application to see if the debugger stops at these breakpoints.

Usually, you want to start this command in the background (using the argument 

), but if you’re unfamiliar with Docker, I recommend running the command as it appears above so that you can see the logs. Once the Docker container has finished the build process and starts, we notice this message from our Python debugger:

This message shows that our Docker started successfully and that Python’s debugger is now listening for a connection and primed to start debugging Python.

Now let's set up some breakpoints inside the Python web application code located in Visual Studio Code!

We can set up breakpoints by clicking on the red dot that appears when you hover over the line number.

Inside VS Code, go to the debugger section on the left-side panel (shortcut: 

). Once inside the debug section, press the green arrow icon located at the top (

With the debugger in Visual Studio Code up and running and connected to Python's debugger, you should now see in the terminal that the Python web application is running.

Now our debugger is connected, it's time to perform a HTTP request to trigger the Visual Studio Code breakpoints. We can use the command line interface (CLI) tool cURL to send a GET request to our web application:

If everything goes as expected, you should not get a response back directly. Instead you should have some code highlighted inside VS Code that proves the debugger is working and that it stopped at the first breakpoint:

Now we know our setup and debugger are working as expected, it's time for the bug hunt.

As you may have already noticed, our web application is vulnerable to a server-side template injection (SSTI) vulnerability. Let’s try an SSTI payload: 

Next we analyse the request we sent containing our payload in the 

 GET parameter. In Visual Studio Code, we can see a breakpoint hit:

We then click the blue, triangular arrow at the top (the first arrow from left to right):

Take a close look at the debug side panel to the left: our payload, which was included in the GET parameter 

 Python variable. But you might also notice that the payload has been HTML-escaped – so in theory, if the web application is vulnerable to a SSTI, we should get an error.

Let's move to our next breakpoint to see what final input is given to the template engine:

, is HTML-escaped by the Python function 

And as predicted, we got a 500 server error in our HTTP response!

To confirm that the vulnerability now exists, we can use the payload 

 and see how Python reacts this time using VS Code's debugger:

Looking at our debugger result, we can see that everything looks good!

 appearing in the HTTP response from our vulnerable web application!

Now that we understand how our payload is being escaped and inserted, we can adapt the payload to exploit the web application and achieve a remote code execution (RCE)!

Because our payload is HTML-escaped before it is inserted into the template string, we cannot take advantage of quotes. And without being able to write the command as a pure string, it will be more challenging to provide a system command. Luckily, we have a solution: Read ‘

Limitations are just an illusion: Advanced server-side template exploitation with RCE everywhere

’ to learn how to achieve RCE without using quotation marks in your payload.

, which converts a hex decimal value to its string character and use this to generate a string. As an example, we can generate the 

Then we can use this string as our argument in Python's 

 function, which will execute our system command and give us RCE:

This results in a successful remote code execution on our web application!

Below are three common Python weaknesses associated with the Python programming language.

: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Although prototype pollution vulnerabilities mainly affect the JavaScript programming language, Python can contain flaws that fall into this category, namely 

: Improper Neutralisation of Special Elements Used in a Template Engine

While this vulnerability is not specifically related to Python, it is important to note that most Python template engines are very powerful. Since they typically provide the ability to run pure Python code within the template engine, there’s a particularly significant risk of high-impact vulnerabilities.

Any programming language can be vulnerable to this CWE. With Python, absolute path traversal can arise when developers use 

 insecurely. This function is often used when joining paths and filenames, but many developers don’t realise that if 

 contains a filename with a front-slash prefix such as 

, it may have unexpected and unwanted results.

As we hoped, our SSTI payload generated a HTTP response containing a 500 server error. By using the debugger, we discovered that the payload failed not because of an error in the payload itself, but because the server HTML-escaped the payload, rendering it invalid.

As a takeaway for future black-box testing, it’s worth testing out multiple payloads with various tweaks when trying to detect the same vulnerability. Deploying a wide variety of payloads is a great way of detecting possible changes from the back-end server and to avoid false negatives.

Debugging your target’s source code helps you to track executed code triggered by the client (attacker). The process we’ve detailed can optimise your testing flow and surface behaviours that help you identify how user input is being handled.

If the server HTML encodes your SSTI payload and makes it invalid in the execution process, it is important to understand how this will affect your future exploitation of the vulnerability. To this end, practising debugging and code analysis on vulnerable targets will teach you how different filters are used and how various programming languages implement protection mechanisms.

White-box penetration testing: Debugging for Python vulnerabilities

Generous bounties, technically stimulating scopes and the feel-good factor of helping to secure critical infrastructure that underpins a free and open internet – sound appealing, bug hunters?

You can enjoy these benefits by hunting on the seven (so far) public Bug Bounty Programs operated by the Sovereign Tech Fund (STF), which invests in open digital infrastructure to ensure a resilient and sustainable open source ecosystem.

Your hacking skills, together with support from the STF, are particularly invaluable to these volunteer-run open source projects, given their vital role infrastructurally or for critical dependencies. Just consider the downstream impact of the 

 to see the importance of effective vulnerability management in this realm.

Java logging framework, is now among the STF’s Bug Bounty Programs, alongside 

All seven programs are currently offering rewards up to 

 for critical vulnerabilities. High-severity flaws command bounties up to €5,000, while for medium severity it’s €3,000 and low-severity issues earn €500 rewards.

The generous bounties – among the highest on YesWeHack – reflect the unusual and challenging nature of many of the targets. Scroll down and check out these programs to see if the scopes align with your hacking expertise.

Tara Tarakiyee, a technologist at the STF, comments: 

“Our societies increasingly rely on open source software as critical infrastructure, and it takes a lot of effort to keep that infrastructure safe. Which is why STF is committed to fostering the community of security researchers looking to use their skills to secure the open source ecosystem in the public interest through programs like the 

Open-source Bug Bounty Programs from the Sovereign Tech Fund

These seven public Bug Bounty Programs are currently active. With the Sovereign Tech Fund having numerous active investments – also including Drupal, PHP, Fortran, GNU libmicrohttpd and Python Package Index – and on the lookout for more, the organisation may well be a source of new hunting opportunities in the not-too-distant future.

The site of arguably the most significant vulnerability of all time – Log4Shell – owing to its severity and the ubiquity of this Java logging framework. 

 comprises an API, its implementation, and components to facilitate deployment for various use cases.

Qualifying vulnerabilities (at the time of writing): 

log injections, log event loss, memory safety, remote code execution, deadlocks, DoS.

 for up-to-date scopes, qualifying/non-qualifying vulnerabilities and other rules.

A suite of basic building blocks for a Linux system. Among other features, 

 provides aggressive parallelisation capabilities, socket and D-Bus activation for starting services, on-demand starting of daemons, tracking of processes using Linux control groups, maintenance of mount and automount points, and implementation of transactional, dependency-based service control logic.

UEFI SecureBoot bypasses, remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, sandboxing bypass, login prompt/password check bypass, disk encryption keys leaks, misuse of cryptographic primitives, leaking user logs to other unprivileged users, and signed dm-verity compromise.

Fully featured desktop environment and application platform for Linux. Used with the likes of Ubuntu, Fedora, RHEL and Tails and in security-critical contexts by activists, journalists, corporations and governments, among other users. The 

 Bug Bounty Program began with two critical scopes, GLib and libsoup, but there is enormous scope for growth with the GNOME desktop consisting of hundreds of modules.

Memory safety issues, denial of service, undefined behavior leading to a security vulnerability, race conditions, missing validation of untrusted inputs, privilege escalation, cryptographic problems, exfiltration of confidential material, and supply chain issues.

 is an open-source implementation of the Network Time Protocol written in Rust, with support for the Network Time Security protocol and a focus on exposing minimal attack surface.

Qualifying vulnerabilities (at the time of writing):

 Remote code execution; remote denial of service (excluding protocol limitations); privilege escalation; misuse of cryptographic primitives; and arbitrary clock modifications, using only NTS sources, controlling at most a minority of the NTS sources.

 is a JavaScript library implementing the OpenPGP standard for message encryption and signing. OpenPGP is typically used for end-to-end encrypted email, signing of git commits and software releases, and encrypted file storage, among a variety of other applications.

 Where OpenPGP.js: incorrectly encrypts a message, causing (part of) it to be decryptable by an attacker; uses an insecure algorithm (by default) to encrypt a message, causing (part of) it to be decryptable by an attacker; incorrectly decrypts or signs the message, causing (part of) the private key to be extractable by an attacker; returns unauthenticated data (by default), potentially causing EFAIL-style vulnerabilities; incorrectly verifies an invalid signature; fails to parse a compliant OpenPGP public key, possibly causing the application or user to send the message in cleartext instead.

 provides secure communication and authentication in the OpenPGP arena. “We are committed to protecting the privacy and security of our users with a particular emphasis on the most vulnerable people in our society: activists, journalists, lawyers and their clients,” reads the program introduction.

Memory safety issues, denial of service, undefined behaviour leading to a security vulnerability, injection attacks into human-readable and machine-readable output, authentication bypasses, creation of cryptographic artifacts using high-level interfaces that break or undermine the properties of cryptographic algorithms, invalid reasoning about OpenPGP certificates, exfiltration of confidential material, diversion of packet streams with respect to another major OpenPGP implementation, improper use of cryptographic primitives, and improper handling of secret key material.

 is a project to read, write and generate CycloneDX SBOMs. It comprises cyclonedx-bom, a Rust library for reading and writing CycloneDX SBOMs from/to Rust structs, and cargo-cyclonedx, a Rust application that leverages cyclonedx-bom to generate CycloneDX SBOMs for Cargo-based Rust projects.

 Remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, memory safety issues, sandbox or security boundary bypass, arbitrary file read/write operations, code injection vulnerabilities, insecure deserialization, cryptographic implementation flaws, integrity check bypass, dependency resolution vulnerabilities, exposure of sensitive information in logs, compromise of signed SBOMs (e.g., signature verification failures), manipulation of SBOM content leading to incorrect or incomplete data, misconfiguration vulnerabilities, and insecure handling of command-line arguments and environment variables.

 invests in open digital infrastructure projects in order to strengthen open source security, resilience and technological diversity. Founded in 2022, the fund is financed – to the tune of €17 million for 2024 – by the German Federal Ministry for Economic Affairs and Climate Action.

 in 2023 to help time-poor open source maintainers prevent and patch vulnerabilities through technical debt reduction, secure code audits and Bug Bounty Programs managed by YesWeHack. 

, meanwhile, saw an initial three successful applicants – developers, contributors or maintainers – given €300,000 to spend on creating or improving developer tooling, production security mechanisms and project documentation for their Free and Open Source Software (FOSS) components over a four- or eight-month period. The Sovereign Tech Fund is also piloting a 

 under which overworked and hitherto unpaid maintainers of critical open source components will be paid for their work.

These are important initiatives when you consider how, according to 

, 96% of codebases contain open source, applications have 526 open source components on average, and 84% of codebases contain at least one open source vulnerability.

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

object relational mapper (ORM) leak vulnerabilities

 by Elttam kicks off our latest roundup of InfoSec news and hacking writeups.

ORM leak flaws apparently occur when ORMs fail to validate user inputs, potentially resulting in the exposure of sensitive data. 💻 

 of Elttam’s research – described as “super-interesting” with “tons of potential for further research” 

 – focuses on the Django ORM and relational filtering attacks. 

, “a beautiful example of abusing framework features to make timing attacks that work in the wild”. 🔥

, meaning moderators have deemed the research truly novel in the realm of web security. 🚀

The same applies to Doyensec research that discovered that cross-site request forgery (CSRF) remains a viable vector in today’s applications despite browsers having been considerably hardened against CSRF (notably through 

). 🧐 The vulnerability research firm successfully 

client side path-traversal “to resuscitate CSRF

 for the joy of all pentesters” and unearth vulnerabilities in major web messaging applications, 

wrote Doyensec researcher Maxence Schmitt

. The research is documented more extensively in a whitepaper and has spawned a 

 “that provides advanced capabilities and automation for finding and exploiting Client-Side Path Traversal”. 👌

Other groundbreaking research to satisfy the exacting criteria of r/websecurityresearch recently includes: 

extending browser extension messaging chains with native messaging to achieve ‘universal code execution’

; Doyensec’s Viktor Chuchurski on how inadequate concurrency control in databases can 

“that is often overlooked by pentesters”, 

Assetnote co-founder and CTO Shubham Shah, meanwhile, 

 to be “one of the most critical exploit chains in the history of @assetnote”, no less. 😮 The researcher in question praised ServiceNow’s security team as being “excellent to work with” in securing the more than 40,000 potentially affected instances.

 writeup from 15-year old (!!!) researcher 

, specifically leading ‘from PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge RCE’; PortSwigger’s Zakhar Fedotkin showing “

abuses widget annotations to create render discrepancies

, and share the code so you can generate your own”; Sonar’s Stefan Schiller on the value of

 when serving HTML documents to reduce the risk of XXS bugs; and ‘

how we discovered the AWS Organization ID for any AWS Account

’ from the CTO and co-founder of Tracebit. 😎

Over in LLM world, a former Apple engineer has 

 “an almost complete lack of bug reporting infrastructure from the LLM providers” after documenting his efforts to report a delirium-inducing prompt that he dubbed “LLM kryptonite”. 🦸 In a 

, Mark Pesce had recounted how he had induced “every chatbot I could access” bar Anthropic’s Claude 3 Sonnet into descending into a “

, LLM vendors came under fire for apparently declining to acknowledge issues while surreptitiously deploying “behind-the-scenes patches”. 😲

As well as hosting a live Bug Bounty with L’Oreal 💄 (see the highlights video below or 

), YesWeHack had a booth at leHACK in Paris last month and can relay some interesting insights from the conference track at France’s biggest hacker con.

 and thinker on InfoSec, cyber warfare and internet privacy, was reassuring on the topic of 

resisting manipulation by AI and malign online actors

If humans seem increasingly helpless to resist their minds being 'hacked' by ever-more sophisticated algorithms, then who better to show how to fight back than the human hackers? 

Schwartau said a cybersecurity mindset could inoculate us against the algorithmic manipulations that keep us scrolling, clicking and feeling negative emotions – anger, disgust – that most effectively drive social media ‘stickiness’. 

“Apply cybersecurity to it and there is hope,” he said. The speaker urged humanity to “take a pause” and engage in slow, deliberate and conscious 

. 🧠 He also recommended resources for building resilience against misinformation and disinformation, such as the 

. Schwartau also lamented how while the UK and EU have numerous studies or initiatives on countering misinformation, the US has none – the most recent, the Stanford Internet Observatory, had closed down. 😯

, a lock-picker extraordinaire, offered some fascinating insights into the vulnerabilities of physical locks. 🔒 

How many of the lessons he drew apply to digital security? “Always look for simple solutions to what look like complex problems” when vuln hunting for instance. “Clever does not mean secure,” is another. The author of a 

 bemoaned a “lack of imagination by design engineers and red teams”. 🧐

Tobias played several videos of himself and others 

defeating high security locks within minutes or even seconds

defeating a Kryptonite bike lock with a ballpoint pen

. Tobias has also featured on an NBC Today segment on lock-picking in 2009, as you can see below. 👇 

 warned that only a ‘response in kind’ could adequately tackle the threat of 

machine learning supercharging malware development and distribution

. The former assistant professor of computer science at the US Air Force Academy noted that VirusTotal reports a daily submission of two million malware samples, around one million of which are unique – a challenge traditional detection mechanisms are hopelessly ill-equipped to address. 

Sonywa demoed a research project that used machine learning “to provide enhanced classification of an entire 200+ gigabyte-malware family corpus consisting of 80K+ unique malware samples and 70+ unique malware families.” 👏

prevalence, usefulness and drawbacks of neuro-divergence in InfoSec

. In ‘a praise to laziness (or why hackers are awesome people)’, 

 said laziness had motivated inventions as significant as washing machines, balance bikes and neural networks. The pen tester-turned-hacker, who has ADHD, admitted being too ready to abandon promising projects when he reached seeming dead ends, but said his low tolerance for boredom has driven him to create tools to automate the most tedious tasks. 🧐

We also have some new hacking resources to announce… Our newest addition to our Dojo platform, for instance, is the second of four new WAF bypassmodules, this time focused on 

Our latest technical guide, meanwhile, centres on 

white-box penetration testing with Xdebug

, specifically explaining how to: configure a PHP web application within a docker environment; set up Xdebug; detect PHP vulnerabilities using this PHP debugger; and create custom payloads to deploy in black-box engagements.

Kudos also to the winners of our latest monthly CTF challenge, 

, which involved exploiting an XXE vulnerability.

 of our Bug Bounty leaderboard. 👏 Check out our video interview with Xel from last year. 👇 As for the 

The YesWeHack Blog

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

White-box penetration testing: Debugging for Python vulnerabilities

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Dojo challenge #34 winners!

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities

L'Oréal lauds live Bug Bounty success at LeHack 2024

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

Don't wait for threats to strike

Produits

Chercheurs

Ressources

A propos

Suivez-nous