Today at 1651 UTC, we opened an internal incident entitled "Facebook DNS lookup returning SERVFAIL" because we were worried that something was wrong with our DNS resolver 1.1.1.1. But as we were about to post on our public status page we realized something…

Hello everyone, I’m Fares. Today, I’ll share the story of how I successfully identified a reflected XSS vulnerability within a public bug…

Server-side prototype pollution is hard to detect black-box without causing a DoS. In this post, we introduce a range of safe detection techniques, which we've also implemented in an open source Burp

Good day everyone! I hope all of you are doing well.

In this article, I will talk about how administrators of resources in the Tor Network, i.e. the Darkweb, are identified.

Web application firewalls bypasses collection and testing tools. How to test, evaluate, compare, and bypass web application and API security solutions like WAF, NGWAF, RASP, and WAAP.

This how I was able to bypass SSRF protection after too many failed attempts using DNS rebinding, if you don't know what is DNS rebinding, don't worry, I will briefly explain it and then we will go through the python exploit that I wrote to pull off the attack…

The Sonar Research team discovered critical code vulnerabilities in Proton Mail, Skiff and Tutanota. This post covers the technical details of the XSS vulnerability in Proton Mail.

Thirty days of focused bug hunting and the $9,240 it produced.

What is Host Header Injection?

We took a look at the security of the most popular code editor, Visual Studio Code! This blog post covers vulnerabilities our researchers discovered in third-party extensions.

In this article, we discuss JWT, its common attacks, and its mitigation.

Salt Security describes an OAuth implementation issue Salt Labs researchers found in Booking.com, a company with $16 billion in annual revenue.

SSRF vulnerabilities aren't a new threat vector but they're often misunderstood. Here are details about what it is and where it can be found.