Viewing profile — innoying

If you own a GitHub organization and are looking for what changes/controls you can apply to reduce the risk/impact of PAT token exfiltration (and subsequent abuse) like what occurr…

The newer global node IDs (which can be forced via the 'X-Github-Next-Global-ID' header [1]) have a prefix indicating the "type" of object delimited by an underscore, then a base64…

CodeQL is based on an existing product from a company called Semmle which GitHub acquired in late 2019 [1] They have been part of GitHub for barely a year so it's not too surprisin…

If anyone is interested in even more data than Artem released, I did a similar experiment based off Artem's work except with a couple hundred domains and with TLS certificates for …

Why does this comment appear on every bug bounty HN thread? Straight from the horse's mouth [0]: The black market is very unlikely to be a place you could sell a bug in a specific …

Technically they did employ some DNS validation. You had to setup a MX record to point to SendGrid before you could add the domain to your account. The problem was in order to send…

I do not believe the author circulated this report to multiple companies, however once it was made public a number of other reporters in the community did and continued to iterate …

I believe they did retroactively search for accounts. Source: I had a number of accounts banned when testing different iterations of this bug.

But that's not what happened here at all. Bitbucket has responded explaining why this (self-inflicted) bug exists (a security decision in an underlying framework) and deferred to t…

I think you're misunderstanding the attack scenario here: > Anyway, if the browser is connecting via port 80, the MITM can just use a transparent http->https proxy to rewrite the r…

Hi "FBSecuritySux", I'm not a member of the Facebook security team, but I work in the industry and your comment frustrates me. I can understand criticizing companies for poor secur…

It's been private (invite-only) for about 2 years, they went public today.

It's not an "easy fix", there could be (and probably are) thousands of different endpoints that can be redirected to after login, whitelisting all of those just doesn't make sense.…

I totally agree. I don't even see how the impact is even more than the open-redirects which already exist. You could do this exact same exploit against tons of providers (Facebook,…

Or like any compiled language they can just grab a binary: https://github.com/github/hub/releases

Plausible deniability.

Somewhat related, but I made a small site to help the average internet "user" understand what net neutrality is and why it's important: http://net-neutrality.io/ I'm not quite sure…