3 ms·

Airbnb Audit Results

50 points by remx 10y ago

robjan 10y ago
Site is wobbling; Google cache version: https://webcache.googleusercontent.com/search?q=cache:l3pDsjc5p6gJ:https://buer.haus/2017/03/08/airbnb-when-bypassing-json-encoding-xss-filter-waf-csp-and-auditor-turns-into-eight-vulnerabilities/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:l3pDsj...
- firloop 10y ago
  archive.is version too http://archive.is/CY0Nf http://archive.is/CY0Nf
zelias 10y ago
Anyone know of a good intro-to-web-app-security-best-practices resource? I don't have the resources to hire a security person and don't have the time to begin learning it all from scratch. I'm generally aware of what attack vectors look like (e.g. XSS, SQL injection, etc.) but am generally unfamiliar with solid low-cost, low-overhead ways of dealing with these problems. I don't have the time or the money (at-present) to set up a WAF -- but I know how important security can be. Where do I go to learn more?
- gyanchawdhary 10y ago
  https://www.codebashing.com/sql_demo https://www.codebashing.com/sql_demo
- nommm-nommm 10y ago
  https://www.owasp.org/ https://www.owasp.org/
- adamwi 10y ago
  https://detectify.com/ https://detectify.com/ Automatically scans for vulnerabilities (including owasp top 10 mentioned in the previous comments). Not a knowledge resources as you were looking for but solve the same problem with less work for you =)
tptacek 10y ago
This appears to be a bad headline: it's not the result of an audit on Airbnb, but instead a list of findings as part of a bug bounty. Further: while this is good work, clever findings, and an excellent writeup, it's a series of attacks on a single endpoint; sort of the XSS equivalent of a bug chain for a browser vulnerability. You could quibble over "8 vulnerabilities", since they all add up to the same vulnerability in the same piece of code. The best headline would be the article's own, or, failing that: Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor at Airbnb
- dsacco 10y ago
  Strongly agree. The headline appears to me to be borderline deceptive. It strongly implies Airbnb commissioned a formal assessment, not that the authors participated in a bug bounty. Also agreed re: vulnerability numbers. As a rule I typically report multiple vulnerabilities in one endpoint that require chaining or which are all exploited using the same failure as one coherent finding.

50 points by remx 10y ago

Site is wobbling; Google cache version: https://webcache.googleusercontent.com/search?q=cache:l3pDsjc5p6gJ:https://buer.haus/2017/03/08/airbnb-when-bypassing-json-encoding-xss-filter-waf-csp-and-auditor-turns-into-eight-vulnerabilities/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:l3pDsj...

firloop 10y ago
archive.is version too http://archive.is/CY0Nf http://archive.is/CY0Nf

zelias 10y ago

Anyone know of a good intro-to-web-app-security-best-practices resource? I don't have the resources to hire a security person and don't have the time to begin learning it all from scratch. I'm generally aware of what attack vectors look like (e.g. XSS, SQL injection, etc.) but am generally unfamiliar with solid low-cost, low-overhead ways of dealing with these problems. I don't have the time or the money (at-present) to set up a WAF -- but I know how important security can be. Where do I go to learn more?

gyanchawdhary 10y ago
https://www.codebashing.com/sql_demo https://www.codebashing.com/sql_demo
nommm-nommm 10y ago
https://www.owasp.org/ https://www.owasp.org/
adamwi 10y ago
https://detectify.com/ https://detectify.com/ Automatically scans for vulnerabilities (including owasp top 10 mentioned in the previous comments). Not a knowledge resources as you were looking for but solve the same problem with less work for you =)

tptacek 10y ago

This appears to be a bad headline: it's not the result of an audit on Airbnb, but instead a list of findings as part of a bug bounty. Further: while this is good work, clever findings, and an excellent writeup, it's a series of attacks on a single endpoint; sort of the XSS equivalent of a bug chain for a browser vulnerability. You could quibble over "8 vulnerabilities", since they all add up to the same vulnerability in the same piece of code. The best headline would be the article's own, or, failing that: Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor at Airbnb

dsacco 10y ago
Strongly agree. The headline appears to me to be borderline deceptive. It strongly implies Airbnb commissioned a formal assessment, not that the authors participated in a bug bounty. Also agreed re: vulnerability numbers. As a rule I typically report multiple vulnerabilities in one endpoint that require chaining or which are all exploited using the same failure as one coherent finding.