Re:Airbnb Audit Results
by zelias on Thursday March 09, 2017 @12:20PM
(#13830792)
Anyone know of a good intro-to-web-app-security-best-practices resource? I don't have the resources to hire a security person and don't have the time to begin learning it all from scratch. I'm generally aware of what attack vectors look like (e.g. XSS, SQL injection, etc.) but am generally unfamiliar with solid low-cost, low-overhead ways of dealing with these problems. I don't have the time or the money (at-present) to set up a WAF -- but I know how important security can be. Where do I go to learn more?
Re:Airbnb Audit Results
by adamwi on Friday March 10, 2017 @12:58AM
(#13836704)
https://detectify.com/ Automatically scans for vulnerabilities (including owasp top 10 mentioned in the previous comments). Not a knowledge resources as you were looking for but solve the same problem with less work for you =)
Re:Airbnb Audit Results
by tptacek on Thursday March 09, 2017 @01:07PM
(#13831354)
This appears to be a bad headline: it's not the result of an audit on Airbnb, but instead a list of findings as part of a bug bounty.
Further: while this is good work, clever findings, and an excellent writeup, it's a series of attacks on a single endpoint; sort of the XSS equivalent of a bug chain for a browser vulnerability. You could quibble over "8 vulnerabilities", since they all add up to the same vulnerability in the same piece of code.
The best headline would be the article's own, or, failing that:
Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor at Airbnb
Re:Airbnb Audit Results
by dsacco on Thursday March 09, 2017 @02:24PM
(#13832370)
Strongly agree. The headline appears to me to be borderline deceptive. It strongly implies Airbnb commissioned a formal assessment, not that the authors participated in a bug bounty.
Also agreed re: vulnerability numbers. As a rule I typically report multiple vulnerabilities in one endpoint that require chaining or which are all exploited using the same failure as one coherent finding.
Further: while this is good work, clever findings, and an excellent writeup, it's a series of attacks on a single endpoint; sort of the XSS equivalent of a bug chain for a browser vulnerability. You could quibble over "8 vulnerabilities", since they all add up to the same vulnerability in the same piece of code.
The best headline would be the article's own, or, failing that:
Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor at Airbnb
Also agreed re: vulnerability numbers. As a rule I typically report multiple vulnerabilities in one endpoint that require chaining or which are all exploited using the same failure as one coherent finding.