Assetnote Blog
blog.assetnote.io · Company blog · on HN since 2019
Assetnote's security research team writes about bug bounty findings, SSRF chains, and vulnerabilities in cloud and web platforms.
What HN saysHN commenters list it among favorite web application security blogs; it is also linked in bug bounty discussions.
16HN people shared it
2linked it in comments
32stories submitted
361story points
3 years agolast shared
2019people per year2026
Most-shared posts
- 1A Glossary of Blind SSRF Chains3 people · 5 points · first shared 2021 · discussion on HN
- 2Hacking on Bug Bounties for Four Years2 people · 89 points · first shared 2020 · 10 comments on HN
- 3Exploiting Static Site Generators: When Static Is Not Static2 people · 23 points · first shared 2022 · discussion on HN
- 4Discovering a zero day and getting code execution on Mozilla's AWS Network2 people · 5 points · first shared 2019 · discussion on HN
- 5Gaining access to Uber's user data through AMPScript evaluation2 people · 4 points · first shared 2019 · discussion on HN
- 6Eliminating Dangling Elastic IP Takeovers with Ghostbuster2 people · 3 points · first shared 2022 · discussion on HN
- 7Cloudflare Pages, part 2: The two privescs2 people · 2 points · first shared 2022 · 1 comments on HN
- 8Taking over Azure DevOps accounts with one click1 people · 118 points · first shared 2020 · 25 comments on HN
- 9Expanding the Attack Surface: React Native Android Applications1 people · 37 points · first shared 2020 · 11 comments on HN
- 10Cloudflare Pages, part 1: The fellowship of the secret1 people · 28 points · first shared 2022 · 2 comments on HN
- 11Taking over Uber accounts through voicemail1 people · 15 points · first shared 2021 · 5 comments on HN
- 12Zoom Zero Day Followup: Getting the RCE1 people · 5 points · first shared 2019 · discussion on HN
- 13Getting access to Zendesk’s gcloud and artifactory from a GitHub dotfiles repo1 people · 4 points · first shared 2019 · discussion on HN
- 14Contextual Content Discovery: You've forgotten about the API endpoints1 people · 3 points · first shared 2021 · discussion on HN
- 15Hacking a Bank by Finding a 0day in DotCMS1 people · 3 points · first shared 2022 · discussion on HN
What HN people wrote when they linked it
EdOverflow · 2020-01-30
Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list):
- https://blog.orange.tw/
- https://ngailong.wordpress.com/
- https://whitton.io/
- https://sakurity.com/blog
- https://homakov.blogspot.com/
- https://buer.haus/
- https://philippeharewood.com/
- https://portswigger.net/research
- https://gerbenjavado.com/
- https://medium.com/@intideceukelaire
- https://samcurry.net/
- https://stephensclafani.com/
- https://www.josipfranjkovic.com/
- https://www.arneswinnen.net/
- https://blog.assetnote.io/
- https://medium.com/@alex.birsan
- https://cablej.io/
- https://jonbottarini.com/
- https://www.corben.io/
There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference.
Shameless plug: I write about web application security at https://edoverflow.com/.
mtmail · 2021-04-21
https://docs.hackerone.com/programs/bounty-tables.html
The large amounts you read about by big companies can hardly be matched my small companies. And rarely reflects the damage it could cause. Our maximum amount is US$1000 currently. We (https://opencagedata.com/security-bounty) get regular reports where high or critical severity is claimed but maybe that's only to get our attention. No report so far justified the full amount. We learned what is much appreciated is fast payout.
In https://blog.assetnote.io/2020/09/15/hacking-on-bug-bounties-for-four-… you see 'full account takeover' listed as US$300 and 'Critical issues on [redacted] (database credentials, entire application source code leaked and SQLi)' at US$800.