Synack Red Team’s Post

Presenting a comprehensive guide around the security of web applications, measures which teams shall implement to protect their digital assets effectively. https://lnkd.in/gzYB6q9Y #cybersecurity #webdevelopment #dataprotection #techtips

In a world where digital threats are everywhere, safeguarding your apps and data has never been more crucial. Say hello to BubbleSecure, your new security ally! 🛡️ https://lnkd.in/gCvS-svT #Cybersecurity #BubbleSecure #ProtectYourData #DigitalSafety #AppSecurity

🔓 Revealing the Truth: 23 MFA Solution #Hacks Exposed! 😱🔒 Understand how attackers exploit these weaknesses and get tips to strengthen your MFA setup. Stay ahead in safeguarding your digital assets #MFA #CyberSecurity #StaySecure  Read the full article:

"Web application security is a necessity in today's digital landscape. Remember, in the realm of cybersecurity, vigilance and proactive measures are your best allies in safeguarding your web application and maintaining the trust of your digital customers." Check out this article to understand why its important to have your web applications secured. #threatmodeling #securebydesign #cybersecurity #databreach #ciso #security #applicationsecurity #infosec #iriusrisk #webapplicationsecurity https://lnkd.in/gvvNaNuk

🔓 23 #MFA Solution Hacks Revealed! 😱🔒 Discover how attackers exploit these gaps and gain insights to fortify your #MultiFactorAuthentication implementation. Stay one step ahead in protecting your digital assets. LINK:https://bit.ly/3NYJSwS  #CyberSecurity #StaySecure #blog

Passkeys - like passwords, but faster, easier, and more secure. Read this blog to learn the basics of #passkeys and how to use them: https://btwrdn.com/3PcoNAw #passkey #passwordmanager #passwordsecurity #cybersecurity

Yubico released a security alert related with FIDO authenticator. This vulnerability is listed as CVE-2024-31498 and has a Common Vulnerability Scoring System rating of 7.7 which means this is a high-risk issue rather than a critical one. Read the article https://lnkd.in/gT43ZT5W #InfoSec #InfoSecOps #securityassessment #cybersecurity #authentication #technicaldomain #mfa #SecurityConsultant

𝑴𝒖𝒍𝒕𝒊-𝒇𝒂𝒄𝒕𝒐𝒓 𝒂𝒖𝒕𝒉𝒆𝒏𝒕𝒊𝒄𝒂𝒕𝒊𝒐𝒏 (𝑴𝑭𝑨) 𝒊𝒔 𝒂 𝒄𝒓𝒖𝒄𝒊𝒂𝒍 𝒔𝒆𝒄𝒖𝒓𝒊𝒕𝒚 𝒎𝒆𝒂𝒔𝒖𝒓𝒆 𝒕𝒉𝒂𝒕 𝒄𝒐𝒎𝒃𝒊𝒏𝒆𝒔 𝒎𝒖𝒍𝒕𝒊𝒑𝒍𝒆 𝒇𝒂𝒄𝒕𝒐𝒓𝒔 𝒕𝒐 𝒗𝒆𝒓𝒊𝒇𝒚 𝒂 𝒖𝒔𝒆𝒓’𝒔 𝒊𝒅𝒆𝒏𝒕𝒊𝒕𝒚. 𝑾𝒉𝒊𝒍𝒆 𝑴𝑭𝑨 𝒔𝒊𝒈𝒏𝒊𝒇𝒊𝒄𝒂𝒏𝒕𝒍𝒚 𝒆𝒏𝒉𝒂𝒏𝒄𝒆𝒔 𝒔𝒆𝒄𝒖𝒓𝒊𝒕𝒚, 𝒊𝒕’𝒔 𝒆𝒔𝒔𝒆𝒏𝒕𝒊𝒂𝒍 𝒕𝒐 𝒖𝒏𝒅𝒆𝒓𝒔𝒕𝒂𝒏𝒅 𝒑𝒐𝒕𝒆𝒏𝒕𝒊𝒂𝒍 𝒗𝒖𝒍𝒏𝒆𝒓𝒂𝒃𝒊𝒍𝒊𝒕𝒊𝒆𝒔 𝒂𝒏𝒅 𝒉𝒐𝒘 𝒕𝒉𝒆𝒚 𝒄𝒂𝒏 𝒊𝒎𝒑𝒂𝒄𝒕 𝒊𝒕𝒔 𝒆𝒇𝒇𝒆𝒄𝒕𝒊𝒗𝒆𝒏𝒆𝒔𝒔. 𝑳𝒆𝒕’𝒔 𝒆𝒙𝒑𝒍𝒐𝒓𝒆 𝒔𝒐𝒎𝒆 𝒄𝒐𝒎𝒎𝒐𝒏 𝒗𝒖𝒍𝒏𝒆𝒓𝒂𝒃𝒊𝒍𝒊𝒕𝒊𝒆𝒔 𝒓𝒆𝒍𝒂𝒕𝒆𝒅 𝒕𝒐 𝒎𝒖𝒍𝒕𝒊-𝒇𝒂𝒄𝒕𝒐𝒓 𝒂𝒖𝒕𝒉𝒆𝒏𝒕𝒊𝒄𝒂𝒕𝒊𝒐𝒏: 𝑳𝒂𝒃: 2𝑭𝑨 𝑺𝒊𝒎𝒑𝒍𝒆 𝑩𝒚𝒑𝒂𝒔𝒔 After you submit your login username and password, it redirects to the 2FA verification page. However, the key point here is that when you are on the 2FA page, your account is actually logged in with a session key. Some code doesn’t check if it’s necessary for the next page. By simply changing the request header from /login2 to /my-account, it’s possible to bypass the 2FA. 𝑳𝒂𝒃: 2𝑭𝑨 𝑩𝒓𝒐𝒌𝒆𝒏 𝑳𝒐𝒈𝒊𝒄 You can log in via a different account that you know, and at the 2FA step, you can alter the request header by putting the victim’s username in it. Then, you can brute-force the OTP (0000-9999) using Burp Suite, but only if poor coding doesn’t have a rate-limiting policy. 𝑳𝒂𝒃: 2𝑭𝑨 𝑩𝒚𝒑𝒂𝒔𝒔 𝑼𝒔𝒊𝒏𝒈 𝒂 𝑩𝒓𝒖𝒕𝒆-𝑭𝒐𝒓𝒄𝒆 𝑨𝒕𝒕𝒂𝒄𝒌 If the 2FA page has a policy of pushing the user back to the login page after every failed OTP attempt, even if we have the username and password, it’s difficult to brute-force the OTP. The user is thrown back to the login page. In this scenario, we can use a macro with the following request sequence: GET /login -> POST /login -> GET /login2. Then, we can try OTPs from a number list at every cycle in Burp Suite’s Intruder. https://lnkd.in/dX2ZTVev #portswigger #authentication #websecurity #cybersecurity #webappsecurity #vapt

Our new Email-based Two-Step Verification (TSV) is here! 💪 Read more: https://lnkd.in/ek2eARnj 🔗 𝗦𝗮𝗳𝗲𝗴𝘂𝗮𝗿𝗱𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗱𝗮𝘁𝗮 just got easier and more efficient. 🔒 Introducing our Email-based TSV, a game-changer in 𝗮𝗰𝗰𝗼𝘂𝗻𝘁 𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻. 🤩 Here's why it's a must-have: 🔑 𝗦𝗶𝗺𝗽𝗹𝗲 & 𝗲𝗳𝗳𝗲𝗰𝘁𝗶𝘃𝗲: No need for additional apps or complicated setups. 📧 𝗖𝗼𝗻𝘃𝗲𝗻𝗶𝗲𝗻𝘁: Receive verification codes straight to your inbox whenever you log in. 🛡️ 𝗔𝗱𝗱𝗲𝗱 𝗹𝗮𝘆𝗲𝗿 𝗼𝗳 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆: Ensure unauthorised access is thwarted with every login attempt. Upgrade your 𝗮𝗰𝗰𝗼𝘂𝗻𝘁 𝘀𝗮𝗳𝗲𝘁𝘆 today! ✅ Stay ahead of evolving threats with Email-based TSV. 🔐 #WebSecurity #TwoStepVerification #TSV #CyberSecurity #OnlineSafety #DataProtection #DigitalPrivacy #IdentityVerification #EuroDNS #EuroDNSNews

Amidst ubiquitous digital threats, protecting your apps and data is now more essential than ever. Meet BubbleSecure, your trusted security companion. https://lnkd.in/g69N8Nke #Cybersecurity #BubbleSecure #ProtectYourData #DigitalSafety #appsecurity