4 ms·

Hey HN! I really enjoy this type of App Security, anyone know any blogs devoted to this? Or any other places to learn more tricks like this?

james-imitative 7y ago
Unenumerated
- Thorrez 7y ago
  Are you saying there's a blog named Unenumerated that has stuff like this? I can't find it.
Thorrez 7y ago
You might check out writeups for CTF challenges in the web category. Also check out the Youtube channel LiveOverflow. A lot of the stuff is binary exploitation, but some is web. https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
EdOverflow 7y ago
Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ https://blog.orange.tw/ - https://ngailong.wordpress.com/ https://ngailong.wordpress.com/ - https://whitton.io/ https://whitton.io/ - https://sakurity.com/blog https://sakurity.com/blog - https://homakov.blogspot.com/ https://homakov.blogspot.com/ - https://buer.haus/ https://buer.haus/ - https://philippeharewood.com/ https://philippeharewood.com/ - https://portswigger.net/research https://portswigger.net/research - https://gerbenjavado.com/ https://gerbenjavado.com/ - https://medium.com/@intideceukelaire https://medium.com/@intideceukelaire - https://samcurry.net/ https://samcurry.net/ - https://stephensclafani.com/ https://stephensclafani.com/ - https://www.josipfranjkovic.com/ https://www.josipfranjkovic.com/ - https://www.arneswinnen.net/ https://www.arneswinnen.net/ - https://blog.assetnote.io/ https://blog.assetnote.io/ - https://medium.com/@alex.birsan https://medium.com/@alex.birsan - https://cablej.io/ https://cablej.io/ - https://jonbottarini.com/ https://jonbottarini.com/ - https://www.corben.io/ https://www.corben.io/ There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference https://github.com/ngalongc/bug-bounty-reference. Shameless plug: I write about web application security at https://edoverflow.com/ https://edoverflow.com/.
- wrboyce 7y ago
  You may want to edit your comment so the links are not inside a code block (and thus clickable). Thanks.
  - EdOverflow 7y ago
    Updated accordingly. :)

james-imitative 7y ago

Unenumerated

Thorrez 7y ago
Are you saying there's a blog named Unenumerated that has stuff like this? I can't find it.

Thorrez 7y ago

You might check out writeups for CTF challenges in the web category. Also check out the Youtube channel LiveOverflow. A lot of the stuff is binary exploitation, but some is web. https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w

EdOverflow 7y ago

Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ https://blog.orange.tw/ - https://ngailong.wordpress.com/ https://ngailong.wordpress.com/ - https://whitton.io/ https://whitton.io/ - https://sakurity.com/blog https://sakurity.com/blog - https://homakov.blogspot.com/ https://homakov.blogspot.com/ - https://buer.haus/ https://buer.haus/ - https://philippeharewood.com/ https://philippeharewood.com/ - https://portswigger.net/research https://portswigger.net/research - https://gerbenjavado.com/ https://gerbenjavado.com/ - https://medium.com/@intideceukelaire https://medium.com/@intideceukelaire - https://samcurry.net/ https://samcurry.net/ - https://stephensclafani.com/ https://stephensclafani.com/ - https://www.josipfranjkovic.com/ https://www.josipfranjkovic.com/ - https://www.arneswinnen.net/ https://www.arneswinnen.net/ - https://blog.assetnote.io/ https://blog.assetnote.io/ - https://medium.com/@alex.birsan https://medium.com/@alex.birsan - https://cablej.io/ https://cablej.io/ - https://jonbottarini.com/ https://jonbottarini.com/ - https://www.corben.io/ https://www.corben.io/ There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference https://github.com/ngalongc/bug-bounty-reference. Shameless plug: I write about web application security at https://edoverflow.com/ https://edoverflow.com/.

wrboyce 7y ago
You may want to edit your comment so the links are not inside a code block (and thus clickable). Thanks.
- EdOverflow 7y ago
  Updated accordingly. :)