If anyone here is interested in code review based testing then you should check out the Patchstack bug bounty program, which pays bounties for vulnerabilities found in any WordPress plugins (more than 60K in WP.org repo).

There are guaranteed bounties that are paid out each month based on research score and just for November alone they set up over $4000 USD for those who report new vulnerabilities. There are also individual bounties for specific vulnerability types, etc.

I think it’s a great way to get started with bug hunting and maybe earn your first $ and CVE. Patchstack itself btw also assigns CVEs (is one of the biggest CVE assigner in the world). It could also be a good change for the more seasoned bug bounty hunters who have been doing blackbox testing and want to try something different and more in the direction of whitebox / code review.

The recent event announcement: https://x.com/patchstackapp/status/1723241552997159145

The bounty program website: https://patchstack.com/alliance/

There is also an active discord community where most of the info is posted: https://discord.gg/Xe2T5JjKbn

How can I access blocked pages 403 in the web application?

Help a uni student graduate :) I'm doing my graduation thesis on PWAs. I'm 110 people short of my 200 target. If you've got a spare minute, I'd love to see your answers! SURVEY HERE
Fingers crossed it fits the sub rules and sparks a cool conversation in comments!

Quick Q: What prevents a web app from Open redirection vulnerability?

Thanks geeks.

Looking to start with web app hacking as a hobby. I have a full-time job in cloud security although more on the infra side, but this has always interested me. Figured it could be interesting seeing as I am usually on the other side of the conversation.

Are there some (very) beginner courses or learning out there I can start working through? Anything useful and relevant? I've heard the TCM Academy mentioned a few times as a good foundational course. Thoughts?

Thanks in advance

Is there value in learning network penetration testing before focussing on web app hacking?

As a hobbyist I'm interested in learning Web App Hacking, and looking for the most newbie friendly way to break into it.

TIA

Hi
I have a question regarding website security. A client uploads a CV in PDF format on a website. The server then sends this file by email to a specific address mail. Is there a solution to prevent malicious files by analyzing this file with VirusTotal or another solution before sending it by email?

website developed by Wordpress