What is Detectify?

Writeups

What’s happening in Security? Detectify Labs is the home to novel security writeups from trusted security researchers active in the community. Contributors include Frans Rosén, Mathias Karlsson, Fredrik N. Almroth, and more.

Stored XSS-ing Millions Of Sites Through HTML Comment Box

Popular tags XSS Detectify Crowdsource Frans Rosén bug bounty Detectify
Cookie fixation CSP Mathias Karlsson

CSP flaws: cookie fixation

January 12, 2017
AddThis Mathias Karlsson postmessage

postMessage XSS on a million sites

December 15, 2016
Get research and tips from Detectify security experts and the Crowdsource hacker community Subscribe to the Detectify Monthly Round-up
Mathias Karlsson postmessage

The pitfalls of postMessage

December 8, 2016
bug bounty Fastly Frans Rosén Heroku Mathias Karlsson

Combining host header injection and lax host parsing serving malicious data

October 24, 2016
Frans Rosén Hostile Subdomain takeover SSL

The story of EV-SSL, AWS and trailing dot domains

October 5, 2016
Frans Rosén Slack XSS

Using Chrome’s web-custom-data UTI to inject a stored XSS in Slack

September 1, 2016
Cross Site Scripting Lastpass Mathias Karlsson XSS

How I made LastPass give me all your passwords

July 27, 2016
binary exploitation Fusion challenges return-oriented programming

Fusion Challenges – level02 Write-up

May 4, 2016
Slack Slackbots token

Slack bot token leakage exposing business critical information

April 28, 2016
What is Detectify? Subscribe to newsletter Sign up for a free trial »
A security service for developers.