February 2021 Summaries

XML is a format used to send and receive information, and External Entity Injection (XXE) occurs when XML is provided as user input and processed on the server in a way that parses external entities, allowing attackers to exploit vulnerabilities such as reading arbitrary local files, achieving Server-Side Request Forgery (SSRF), Denial of Service (DoS), and Remote Code Execution (RCE). XXE can be exploited through various methods including parsing Microsoft Office files, RSS feed parsers, SAML Authentication, HTML parsing, and functionality that parses sitemap.xml or SVG files. Exploitation methods include arbitrary file read on Windows, remote code execution, server-side request forgery via XXE, and the Billion Laughs Attack, which causes a denial of service by exhausting the system's resources with an exponentially growing string of "lol"s. XXE exploitation requires understanding XML entities and how they can be used to inject malicious payloads into applications that parse XML user input.

Penetration testing is the process of simulating cyber attacks on an organization's systems and networks to identify vulnerabilities, protect against malicious hackers, and ensure compliance with security standards. It involves various types of tests, including network security testing, cloud security testing, web application testing, IoT security testing, social engineering testing, API pen tests, and more. Penetration testing is a crucial cybersecurity best practice that helps organizations protect their assets, customer data, reduce cyber risk, satisfy stakeholders and compliance requirements, and preserve their image and reputation. The frequency of penetration testing depends on the type of test, with internal testing being the most frequent, followed by crowdsourced testing, and traditional penetration testing being the least frequent. Crowdsourced testing has gained popularity due to its rapid setup and deployment, real-time results, SDLC integration, and flexible API. It is also more cost-effective than traditional penetration testing services, offering higher-quality results and a faster path to compliance.

The text discusses common bug classes found through a platform's vulnerability reporting system, with the goal of guiding hunting efforts and focusing on the most common bugs. The top 10 bug classes include Remote Code Execution, Open Redirect, Cross-Site Request Forgery (CSRF), Authentication Bypass, Sensitive Information Passed to HTTP by Default, Privilege Escalation, Broken Access Control (including IDOR), Subdomain Takeover, Cross-Site Scripting, and Sensitive data exposure. These bug classes are often exploited due to common pitfalls such as validating URLs, using insecure authentication flows, passing sensitive information in cleartext, or failing to implement proper access controls. The text provides resources for learning more about these bugs and how to exploit them, including GitHub repositories, blogs, and videos.

Penetration testing is a critical process that involves simulating hacking attacks on an organization's systems, networks, and applications to identify vulnerabilities and weaknesses. It helps protect against unauthorized access by malicious actors, reduces cyber risk, and satisfies stakeholder requirements. The benefits of penetration testing include analysis of IT infrastructure, protection from financial damage, protection of client data and partnerships, protection of company image and reputation, and compliance with regulations and security certification. To get started with penetration testing, organizations should gather information about their systems, scan for vulnerabilities, exploit weaknesses, generate reports, and translate data into action steps for increased security. It is essential to hire reputable pen testers who are thorough and methodical and have strong communication skills. Organizations can also consider crowdsourced penetration testing, which has been shown to identify on average 7X more high-priority vulnerabilities than traditional penetration tests.

With a career in Information Security, advancing can be daunting without guidance and support. The Bugcrowd Scholar Program is being offered by Bugcrowd to help build careers, gain real-world skills, and prepare for in-demand certifications through courses, labs, and practice tests. To apply for the scholarship, sign up for a researcher account and fill out an application form, with the deadline running from February 1-28. In addition to the scholarship program, participants will be entered into a swag giveaway and can participate in social media challenges throughout the month of February for more chances to win prizes.