11–20 of 150 posts
interesting read - anyone have pointers to other app pentesting walk throughs like this?
There are sone public pentests out there. For example https://www.opentech.fund/impact/security-safety-audits/
If you want to read some really hard core security vuln hunting, see https://googleprojectzero.blogspot.com/
Earlier quoted context omitted.
Wow you weren't kidding. These are vulns that would have been embarrassing a decade ago.
I think the timeline is the more damaging part too. Not only was their design woefully inadequate, they don't seem to care.
Earlier quoted context omitted.
Wow you weren't kidding. These are vulns that would have been embarrassing a decade ago.
I think the timeline is the more damaging part too. Not only was their design woefully inadequate, they don't seem to care.
Earlier quoted context omitted.
I think the timeline is the more damaging part too. Not only was their design woefully inadequate, they don't seem to care.
The problem is they probably don’t have full time developers. They probably built the app once years ago via a dev shop and then never updated it again. The talent moved on and updating it is expensive now.
It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community…
It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community…
You shouldn't be touching the server-side code if you find this hard to keep straight.
However, I also try to make it a habit to not blame people for not knowing something. This presents as a structural problem in that company: they needed to hire people who do know how to secure server code and put them into a position to do so. Blame the company and those who decided to save every last penny in personnel cost.
It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community…
You shouldn't be touching the server-side code if you find this hard to keep straight.