January 2020 Summaries

In 2020, the web security landscape is expected to evolve with the rise of crowdsourced security, greater attention to CI/CD automation vulnerabilities, and the expansion of cloud-powered web apps as a new security perimeter. Crowdsourced security is becoming increasingly popular, with companies leveraging ethical hackers and bug bounty programs to stay ahead of threats, and the market is projected to grow significantly by 2024. Attackers are shifting focus from traditional vulnerabilities like SQL injections to exploiting automation processes and misconfigurations in CI/CD tools, particularly in cloud environments. The shared responsibility model in cloud services means users must be vigilant about access controls and configurations, as improper setups can expose sensitive data. The integration of security into the software development lifecycle, known as DevSecOps, is gaining traction, with tech leaders like Netflix and Slack emphasizing its importance. This approach advocates for incorporating security practices early in development to keep pace with the rapid discovery of vulnerabilities, underscoring the need for a multifaceted strategy that includes threat-modeling, automated security, and asset monitoring.

Akhil George, known as streaak, is a student and ethical hacker who shares insights from his bug bounty hunting experience, particularly focusing on reconnaissance techniques. In his guest blog, streaak outlines his methodology for expanding the attack surface of targets, which includes subdomain reconnaissance, passive endpoint gathering, subdomain takeovers, and directory brute-forcing. He uses various tools like Subfinder, Amass, and Massdns to identify subdomains and potential vulnerabilities, and he emphasizes the importance of managing data effectively throughout the process. Streaak also highlights the risks of sensitive data exposure, such as Slack webhook and Firebase API tokens, and explains how these can be leveraged if improperly secured. His approach combines automated tools and custom scripts to enhance efficiency, although he notes the limitations and challenges he encountered, such as avoiding cloud service bans during brute-forcing and managing large datasets.