Intigriti 0326 CTF Challenge: Chaining DOM clobbering and CSP bypasses for XSS
At Intigriti, we host monthly web-based Capture The Flag (CTF) challenges as a way to engage with the security researcher community. This month's challenge, brought forward by Kulindu, presented us with a Secure Search Portal that, on the surface, appeared to be well protected. A strict Content Security Policy and...
Vulnerability disclosure for AI safeguards. How open should programs be and what incentives are necessary?
What you will learn How vulnerability disclosure applies specifically to AI safeguards and systems. The pros and cons of making AI disclosure programs more open/restricted. The kinds of incentives that motivate researchers. Which disclosure program structures can help organizations improve their AI security. In a...
Exploiting broken access control vulnerabilities
Broken access control vulnerabilities have consistently remained at the top of the OWASP Top 10, and for a good reason. As web applications continue to grow in complexity, with the introduction of role-based access controls, multi-tenant support, and granular permission models, the likelihood of access control...
Hacking with permission: the rules that make it ethical
Ethical hacking, often via Bug Bounty Programs or VDPs, operates within defined frameworks. These include a community Code of Conduct (CoC), setting program Rules of Engagement (RoE), and clarifying platform Terms of Service (ToS). Companies that invest in proactive security need to understand what these terms mean...
Intigriti collaborates with PortSwigger to support ethical hacking excellence
Intigriti and PortSwigger collaborate to reward hard-working hackers Best known as the creator of Burp Suite, the industry-standard toolkit for manual web application security testing, PortSwigger is a UK-based cybersecurity company on a mission to help the world secure the web. Today, their tools are trusted by...