#PRITUNL GRAVITATIONAL PDF#
#PRITUNL GRAVITATIONAL MANUAL#
#PRITUNL GRAVITATIONAL ANDROID#

We give examples of assertions (big and small) created and broken during various security audits and the value this brought to the customer. We'll talk about the current state of web application security, how its evolved, and where its going. We'll talk about our experience auditing modern web applications over the last three years. Assertions come from any source and they represent statements of security or functionality made by the target. On a deeper level this age is governed by the security auditor's skill in creating and breaking assertions in the target. This age is widely defined by business logic flaws. The age of injection bugs has come and gone. Modern web security is a mix of relatively recent frameworks, methods, languages, and abstractions.

#PRITUNL GRAVITATIONAL PDF#

We will update this list on Regexploit's Github page.ĭownload the presentation PDF file: Villamil-Modern-Web-Security-Assertions.pdf

Plus many more unpublished bugs in a handful of pypi, npm, ruby and nuget packages.

SimpleCrawler (archived) (HTML parsing).

bpo-38804: cpython’s okiejar (Set-Cookie header parsing).

CVE-2021-27293: RestSharp (JSON deserialisation in a.

CVE-2021-27292: ua-parser-js (User-Agent header parsing).

CVE-2021-27291: pygments lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting).

CVE-2021-21240: httplib2 (WWW-Authenticate header parsing).

CVE-2020-8492: cpython’s urllib.request (WWW-Authenticate header parsing).

CVE-2020-5243: uap-core affecting uap-python, uap-ruby, etc.

We also demonstrate how chaining three vulnerabilities discovered during this engagement would allow an attacker to compromise the user’s workstation when using HEY for Desktop.ĭownload the HEY audit summary deliverable: Doyensec_Basecamp_HEY_PlatformTesting_Q32020_SAS.pdfĭuring our research on ReDoS, Doyensec reported several vulnerabilities:

#PRITUNL GRAVITATIONAL ANDROID#

The findings include a number of information exposure vulnerabilities, insecure design, and security misconfiguration issues found across the three HEY clients and the main API service, in addition to several medium severity findings affecting the multi-factor authentication mechanism (2FA bypass), the Gopher caching service (Server Side Request Forgery, Stored Cross-Site Scripting) and the Android mobile application (Insecure File Content Provider). The security audit summary (SAS) for this engagement is now available.

#PRITUNL GRAVITATIONAL MANUAL#

The project consisted of a manual application security assessment against HEY’s web platform and its APIs, mobile (Android, iOS) and desktop (ElectronJS-based) applications. Basecamp engaged us to perform a broad application review of HEY.

Pritunl gravitational