Blog Detectify

Most-linked posts?

1. How we got read access on Google’s production servers
   3 people · 3 mentions · first linked 2014-04-11
2. /post/82370846588/how-we-got-read-access-on-googles-production
   3 people · 3 mentions · first linked 2014-11-30
3. Zerg Rush: How to influence Google
   2 people · 2 mentions · first linked 2012-05-02

What Hacker News says?

1. halflings · 2014-04-11Recommends

   I hope it doesn't get unnoticed that the guys who discovered this vulnerability created a really great product, Detectify : https://detectify.com/ They also discovered vulnerabilities in many big websites (dropbox, facebook, mega, ...). Their blog also has many great write-ups : http://blog.detectify.com/

   Comment linking /

   on “How we got read access on Google’s production servers”
2. detectify · 2014-04-11

   Submitted How we got read access on Google’s production servers as a story · 1156 points

   HN discussion
3. sathackr · 2018-10-13

   There is a saying "If someone can make it, someone can break it" This applies to physical security also. There are way too many attack vectors for you to plug every possible hole. 20 years ago do you think anyone was considering that you could determine the contents of memory otherwise inaccessible your process just by reading the memory accessible to you in certain manners (Rowhammer, [1]) Or that a device taped un…

   Comment linking /2016/04/06/owasp-top-10-injection/

   on “A mysterious grey-hat is patching people's outdated MikroTik routers”
4. sshroot · 2021-02-25

   Submitted Common Nginx misconfigurations that leave your web server open to attack as a story · 409 points

   HN discussion
5. NelsonMinar · 2014-11-30

   "Some people" is a pretty big category with some good company. Google in April 2014, for instance. Or PostgreSQL in 2012. http://blog.detectify.com/post/82370846588/how-we-got-read-a... http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3489

   Comment linking /post/82370846588/how-we-got-read-access-on-googles-production

   on “Nobody expects CDATA sections in XML”
6. fransr · 2012-12-30

   Submitted How I got a $3,500 USD Facebook Bug Bounty as a story · 145 points

   HN discussion
7. jug · 2015-03-26Recommends

   Google also did this when they had the Google Toolbar remote exploit vulnerability reported and the guy asked about the reward, a good read on its own: http://blog.detectify.com/post/82370846588/how-we-got-read-a...

   Comment linking /post/82370846588/how-we-got-read-access-on-googles-production

   on “Google sends reporter a GIF instead of a 'no comment'”
8. BogdanCalin · 2014-05-20

   Submitted The pitfalls of allowing file uploads on your website as a story · 100 points

   HN discussion
9. halflings · 2015-03-26

   Reminds me of the GIF Detectify got from Google after getting into their production servers because of a vulnerability in the "Google Toolbar" portal [1] : https://s3-eu-west-1.amazonaws.com/blog.images/google/niceme... [1] http://blog.detectify.com/post/82370846588/how-we-got-read-a...

   Comment linking /post/82370846588/how-we-got-read-access-on-googles-production

   on “Google sends reporter a GIF instead of a 'no comment'”
10. fanf2 · 2024-05-28

    Submitted Common Nginx misconfigurations that leave your web server open to attack (2020) as a story · 14 points

    HN discussion
11. mantrax5 · 2014-05-06

    I see, so XML has few tradeoffs other than complexity. So I'm sure given your insistent questions, XML has a native representations for: - A ring buffer. - A decimal type. - A complex number. No, it doesn't. It's all up to the contract. And there's nothing in XML that makes it more convenient to describe a complicated contract, than JSON (or any other format). So XML made a tradeoff of complexity, and gained nothing…

    Comment linking /post/82370846588/how-we-got-read-access-on-googles-production-servers

    on “Fat JSON”
12. detectify · 2014-10-21

    Submitted Hostile subdomain takeover using Heroku/GitHub/Desk + more as a story · 13 points

    HN discussion
13. mc10 · 2021-02-15

    This looks pretty neat! I had a few questions: - Is there any way to add `perf` profiling? - Could allocation graphs be added, similar to what pprof offers (e.g. the one midway through this article https://blog.detectify.com/2019/09/05/how-we-tracked-down-a-... )? I've found these to be very helpful in practice since flame graphs make it harder to see what lower-level functions are being called a lot.

    Comment linking /2019/09/05/how-we-tracked-down-a-memory-leak-in-one-of-our-go-microservices/

    on “Launch HN: Pyroscope (YC W21) – Continuous profiling software”
14. detectify · 2012-09-22

    Submitted SQL injection in one minute as a story · 10 points

    HN discussion
15. remosi · 2014-04-13

    It runs in process tho, so it would have had the exact same result with heartbleed. Its keys need to be readable to that user, so exploits like http://blog.detectify.com/post/82370846588/how-we-got-read-a... would also still leak your private keys. So no net win here unfortunately. opencryptoki has a softhsm too, but again, it appears to run in process. Same problems.

    Comment linking /post/82370846588/how-we-got-read-access-on-googles-production-servers

    on “Webservers shouldn't have direct access to keys”
16. Nallachi · 2021-11-12

    Submitted SSL certificates could be leaking company secrets as a story · 4 points

    HN discussion
17. dguido · 2012-09-22

    How many times do people need to talk about SQL injection before people writing web apps get it? This isn't news and this isn't hard to completely avoid. Just do it and stop being amazed every time someone puts a tick mark in an URL parameter (or any parameter for that matter). EDIT: I looked around this detectify website and found this gem: http://blog.detectify.com/post/22258359654/zerg-rush-how-to-... "326 exploi…

    Comment linking /post/22258359654/zerg-rush-how-to-influence-google

    on “SQL injection in one minute”
18. fransr · 2013-02-14

    Submitted How I got the Bug Bounty for Mega.co.nz XSS as a story · 4 points

    HN discussion
19. soundsop · 2014-10-22

    Submitted Hostile Subdomain Takeover Using Heroku/GitHub/Desk + More as a story · 3 points

    HN discussion
20. fransr · 2013-09-20

    Submitted Another iOS7 Lock Screen bypass with Control Center turned off as a story · 3 points

    HN discussion
21. detectify · 2012-11-03

    Submitted How we built a simple arcade game using SVG as a story · 3 points

    HN discussion
22. brlewis · 2020-06-16

    Submitted Do not dismiss the small vulnerabilities (2018) as a story · 2 points

    HN discussion
23. soundsop · 2015-09-21

    Submitted Security is everyone’s business as a story · 2 points

    HN discussion
24. detectify · 2014-05-20

    Submitted The lesser known pitfalls of allowing file uploads on your website as a story · 2 points

    HN discussion
25. detectify · 2012-12-02

    Submitted XSS where you least expect it as a story · 2 points

    HN discussion
26. detectify · 2012-11-16

    Submitted Ask HN: Do you dare to show your PHP easter egg? as a story · 2 points

    HN discussion
27. annelie · 2012-11-07

    Submitted How to: Exploit an XSS as a story · 2 points

    HN discussion
28. detectify · 2012-10-05

    Submitted Universal XSS (UXSS) in Opera as a story · 2 points

    HN discussion
29. annelie · 2012-09-26

    Submitted The basics of Cross-site Scripting (XSS) as a story · 2 points

    HN discussion
30. Faskototo · 2022-12-26

    Submitted Hacker School Reboot – insights from leading API hackers [video] as a story · 1 points

    HN discussion

Search all of HN for blog.detectify.com

Linked by the same people?

• BBruce Schneierschneier.com