Research Notes

Popular pages

• Assetnote

  Application security issues found by Assetnote

• Cloudflare Pages, part 1: The fellowship of the secret – Assetnote

  Introduction Before we get into this lengthy post, we’d like to thank both Cloudflare and HackerOne for working with us on these vulnerabilities. The process of reporting, remediating and validating t...

• Contextual Content Discovery: You've forgotten about the API endpoints – Assetnote

  Presented at BSides Canberra 2021, slides available: PDF & Keynote (with videos). As a team, we’re passionate about content discovery as it has historically led to the discovery of vulnerabilities. Ty...

• Cloudflare Pages, part 2: The two privescs – Assetnote

  Introduction Following on from our 1st story, we’ll be continuing the epic tale of our research into Cloudflare pages in this second installment. If you haven’t read part 1, you can read it here. We p...

• Exploiting Static Site Generators: When Static Is Not Actually Static – Assetnote

  const { response, cacheKey, responseEtag } = await loadSourceImage({ cacheDir, url: id, requestEtag, modifiers, isLocal, requestHeaders }) The loadSourceImage...

• Hacking on Bug Bounties for Four Years – Assetnote

  Intro & Motivations I value transparency a lot, especially when it comes to the bug bounty space. Bug bounty hunters all around the world are submitting a range of reports where the issues found span ...