New Security Communication Drill: The Bug Bounty Researcher's Perspective

Join us tomorrow for an interactive security communication drill that flips the script on traditional security exercises. Instead of focusing on the vendor side, we'll put participants in the shoes of security researchers navigating the challenges of vulnerability disclosure.

This hands-on scenario will challenge you to:

Navigate security assessments with limited visibility into internal architectures

Build credibility when you have less system context than internal teams

Communicate effectively through multi-layered teams (triage vendors vs. security engineers)

Balance respect for internal expertise while confidently advocating for your findings

Manage disclosure expectations under tight time constraints

Push for security improvements without full visibility into compensating controls

Whether you're a security researcher, bug bounty program manager, or security engineer, this drill offers valuable insights into improving communications in the vulnerability disclosure process from both sides.

Date: Wednesday, April 23
Time: 12pm ET
Location: Discernible Drills Slack

Subscribe to Join: DiscernibleInc.com/drills

[Перевод] Превышение привилегий через манипуляцию с атрибутами аккаунта

Сегодня мы увидим, как параметры могут привести к большим финансовым потерям для компании. Давайте начнем с аккаунтом обычного пользователя на сайте, который представляет собой платформу электронной коммерции, где происходит покупка и продажа товаров. Допустим, сайт называется Example.com . Когда вы переходите в раздел покупки товаров и добавляете несколько позиций в корзину, вы видете примерно следующее...

https://habr.com/ru/articles/902898/

Uncover a stealthy XSS vulnerability that can execute in any user's authenticated session, learn how an attacker could craft a sophisticated ACSRF attack, and discover valuable insights on application-wide exploitation #infosec #BugBounty #Cybersecurity

https://melotover.medium.com/escalating-impact-full-account-takeover-in-microsoft-via-xss-in-login-flow-f160fa79b008?source=rss------bugbounty-5