Thursday, May 4
May the 4thhhhhhhh be with you. Happy Star Wars day!
TOP STORY
Phishing works (unfortunately). And there was a very recent and surprisingly convincing Google Docs phishing scam spreading across the interwebs in the last few days. You can read a little more about Phishing with Client Application Name Spoofing, but in the meantime, delete any email that’s from “hhhhhhhhhhhh[at]company[dot]com” or anything from Eugene Pupov.
HACKTIVITY
Markdown based stored XSS (IE only) [5 upvotes] - no bounty for this report to GitLab by @a0xnirudh. GitLab’s amazing team handled the bug very quickly and even posts the link to the merge request with the fix. Awesome!
Null pointer dereferences in mrb_get_args [4 upvotes] - $800 bounty for this report to Shopify by @ssarong. A null pointer dereference in MRuby was found and fixed.
$21,000 for 3 bugs - Chaining bugs to get RCE, LFD and SQLi. The man is legend. The man is @shubs.
You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity.
OTHER ARTICLES WE’RE READING
ExploitBox CVE-2016-10033. Simple but effective. But wait, there’s more.
There’s malware in your burrito.
HBR wants you to stop using free public wifi. So do we.
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
Get this email forwarded to you? Click here to subscribe to the Zero Daily
"Aren't you a little short for a stormtrooper?"
Princess Leia in A New Hope
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty solutions encompass vulnerability assessment, crowdsourced security testing and responsible disclosure management. Discover more about our hacker powered security testing solutions or Contact Us today.