detectify
Slack bot token leakage exposing business critical information
Chrome Extensions – AKA Total Absence of Privacy
Using Google Cloud to Bypass NoScript
Stealing files from web servers by exploiting a popular PDF generator
Hijacking of abandoned subdomains part 2
Hostile subdomain takeover using Heroku/GitHub/Desk + more
Re:Complete free quick test for #shellshock + how it works
on Thursday September 25, 2014 @10:46AM (#8367439)
We got a bit more traffic than we expected from shellshock. E.g, we're under very heavy load, but please, try again! We scaled up!
Re:CVE-2014-6271: Remote code execution through bash
on Thursday September 25, 2014 @08:23AM (#8366750)
We just released a complete quick-test for #shellshock here: https://shellshock.detectify.com/. It's free to use and here's the information about how the scanner works: goo.gl/8vp6eo
Please feedback here: https://news.ycombinator.com/item?id=8366643
Re:Complete free quick test for #shellshock + how it works
on Thursday September 25, 2014 @08:09AM (#8366713)
Here is a description of what the scan does: goo.gl/8vp6eo
Complete free quick test for #shellshock + how it works
Re:CVE-2014-6271: Remote code execution through bash
on Wednesday September 24, 2014 @06:05PM (#8364442)
We have added the CVE to our scanning routines and the update is now online on www.detectify.com. Test your environment for unpatched servers. In times like these it's OK to go for our free plan.
Re:CVE-2014-6271: Remote code execution through bash
on Wednesday September 24, 2014 @05:38PM (#8364291)
We just updated our scanner and included this CVE. You can run Detectify to see if your setup is vulnerable. We offer a recurring service that runs continuously and alerts you if you are exposed to new emerging vulnerabilities. This removes some of the complexity of always being on top of security alerts.
How the celebrity hack could have been done
The lesser known pitfalls of allowing file uploads on your website
Re:How we got read access on Google’s production servers
on Friday April 11, 2014 @11:08AM (#7573288)
Sorry to hear that you are disappointed. Few results can be a good thing though, it might just mean that your site has very few issues! Feel free to mail us again and thanks for the feedback :)
Re:How we got read access on Google’s production servers
on Friday April 11, 2014 @10:59AM (#7573231)
Hi! In fact, that's exactly what we do at Detectify. Just check out https://detectify.com!
How we got read access on Google’s production servers
http://blog.detectify.com/post/82370846588/how-we-got-read-access-on-googles-production-servers
tl;dr: How we got $10.000. We were able to upload an XML file to Google. The XML parser was vulnerable to XXE. We got full read access to their production servers, including the /etc/passwd.
The Web Should Come With a Safety Warning
Is this the ultimate SQL injection payload?
Re:Show HN: A Url Permanence Service
on Sunday December 02, 2012 @10:35AM (#4861454)
Tried the service and got two errors first,
I cannot add a URL that does not have "http" I cannot type a URL that has "https"
Would be nice to be able to add https adresses and add them in any form.
Also an idea, make it as a web browser plugin so I can change the url in the brower and add it to my link library. Then it's even better. I don't like detours.
Question, what happen if I prul.ly a Url once then the content changes and I want to save the new content as well (Different content, same url)?
Anyway, I really like the concept, keep going!
Annelie @detectify
XSS where you least expect it
Ask HN: Review our startup, detectify.com
Today there is a lot of excitement at the office as we just launched early access at the Slush conference. We have been in private beta for about 4 months and this is one of the bigger releases so far during product development. We have changed the registration, improved our encryption, added a few new attack vectors to crawl for and a lot more. Therefore we would love to have your feedback...
Ask HN: Do you dare to show your PHP easter egg?
When vulnerability disclosure fails
How we built a simple arcade game using SVG
Universal XSS (UXSS) in Opera
Re:SQL injection in one minute
on Wednesday September 26, 2012 @04:30PM (#4577860)
Thanks dguido for the kind words and happy to hear you found the Zerg Rush article. It's all true!
Email us at [email protected] if you would like to get beta access to detectify.com
Reflected XSS browser test!
Test your browser against Reflected XSS
SQL injection in one minute
http://blog.detectify.com/post/31942728649/sql-injection-in-1-min
A short 101 tutorial on how SQL-injections work