Airbnb Audit Results

https://buer.haus/2017/03/08/airbnb-when-bypassing-json-encoding-xss-filter-waf-csp-and-auditor-turns-into-eight-vulnerabilities/

by remx • 9 years ago

50 8 9 years ago

buer.haus

robjan• 9 years ago

Site is wobbling; Google cache version: https://webcache.googleusercontent.com/search?q=cache:l3pDsj...

firloop• 9 years ago

archive.is version too http://archive.is/CY0Nf

zelias• 9 years ago

Anyone know of a good intro-to-web-app-security-best-practices resource? I don't have the resources to hire a security person and don't have the time to begin learning it all from scratch. I'm generally aware of what attack vectors look like (e.g. XSS, SQL injection, etc.) but am generally unfamiliar with solid low-cost, low-overhead ways of dealing with these problems. I don't have the time or the money (at-present) to set up a WAF -- but I know how important security can be. Where do I go to learn more?

gyanchawdhary• 9 years ago

https://www.codebashing.com/sql_demo

nommm-nommm• 9 years ago

https://www.owasp.org/

adamwi• 9 years ago

https://detectify.com/ Automatically scans for vulnerabilities (including owasp top 10 mentioned in the previous comments). Not a knowledge resources as you were looking for but solve the same problem with less work for you =)

tptacek• 9 years ago

This appears to be a bad headline: it's not the result of an audit on Airbnb, but instead a list of findings as part of a bug bounty.

Further: while this is good work, clever findings, and an excellent writeup, it's a series of attacks on a single endpoint; sort of the XSS equivalent of a bug chain for a browser vulnerability. You could quibble over "8 vulnerabilities", since they all add up to the same vulnerability in the same piece of code.

The best headline would be the article's own, or, failing that:

Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor at Airbnb

dsacco• 9 years ago

Strongly agree. The headline appears to me to be borderline deceptive. It strongly implies Airbnb commissioned a formal assessment, not that the authors participated in a bug bounty.

Also agreed re: vulnerability numbers. As a rule I typically report multiple vulnerabilities in one endpoint that require chaining or which are all exploited using the same failure as one coherent finding.

Airbnb Audit Results

Related Stories