Researchers’ blog

Content Security Policies (CSPs) are often deployed as the last line of defense against client-side attacks such as cross-site scripting (XSS) and clickjacking. Since their first introduction in 2012, they've enabled developers to control which and what resources are allowed to load and evaluate wit

At Intigriti, we host monthly web-based Capture The Flag (CTF) challenges as a way to engage with the security research community. This month, we've decided to take on a challenge ourselves as a way to give back to the community. In response to one of our recent articles, we decided to focus on JSON

Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring: Finding an RCE using AI in GitHub CORS exploitation cheat sheet Scanning codebases with AI Bypassing paywalls SSTIs in AI models And so much more! Let’s dive in! We are thrilled to announce that Intigriti has won

What the award is and why it’s significant: Learn that Intigriti won Security Innovation of the Year at the 2025 UK IT Industry Awards, a major industry recognition for cybersecurity innovation. Why it matters to the community: Understand how this win reflects Intigriti’s impact in advancing ethical

Traditional cross-site scripting (XSS) vulnerabilities were prevalent when server-side rendering (with languages like PHP, JSP, and ASP) was the norm. However, as applications become more complex and developers continue to shift application logic to the client-side, more complex client-side vulnerab

Before JSON Web Tokens (JWTs) became popular in today's app development landscape, web applications predominantly used server-side sessions, which presented horizontal scalability issues. JWTs solved this by moving authentication data from the server to the token itself. They are self-contained, sta

Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring: Cool trick to find disclosed secrets in internal web extensions A repository full of WAF bypasses Hacking Intercom misconfigurations Wayback Machine for hackers And so much more! Let’s dive in! October’s Intigriti

Antwerp, Belgium, Oct. 23, 2025. Intigriti, a global crowdsourced security provider, is delighted to announce its latest partnership with non-profit Shield vzw within the framework agreement with the Federal Public Service (FPS) Health in Belgium. This partnership provides essential support and serv

Cross-site scripting vulnerabilities are, by no doubt, one of the vulnerability types that'll keep haunting applications for a long time. This seamless injection bug can often be further escalated to allow attackers to perform malicious actions on behalf of the victim, or even worse, on behalf of a

It is no secret that bug bounty hunters who spend lots of time on information gathering are always rewarded well for their efforts. As developers continue to in-deliberately push secrets to production or to other public-facing resources, hunting for secrets remains invaluable for security researcher

Next.js is a powerful open-source React framework that enables developers to build fast, interactive, and SEO-friendly web applications. With almost 13 million weekly downloads via NPM, and the framework being complex by nature, it makes it a prime target for unfriendly intruders. In this article, w

Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring: A common (yet unknown) SSRF attack vector in Next.js Middleware Exploiting PDF processors by generating and uploading malicious PDF payload files A full reconnaissance breakdown on how to approach any target And s

Add-on (or plugin) ecosystems unlock an entire new world of integration possibilities while also complementing the platform's extensibility to developers. However, in practice, finding the right balance between adding extensibility and maintaining security often proves to be difficult. The root caus

At Intigriti, we hold monthly web-based Capture The Flag (CTF) challenges as a way to engage with the security research community. This month's challenge, presented by @0xblackbird, featured an interesting server-side request forgery (SSRF) vulnerability affecting web applications that make use of t

Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring: Evading WAFs like Cloudflare, Akamai & AWS Cloudfront Creating your complete bug bounty automation system A powerful, targeted backup file scanner Bypassing CSP to achieve XSS via a cool trick with PDF files And s

Google Firebase is a popular back-end application development platform that provides several built-in components and services, allowing developers to seamlessly build interactive web and mobile applications. But as with any development platform and framework, security always proves to be difficult.

Most of your targets often resort to using content delivery networks (CDNs) or other anti-DDoS reverse proxies to mask their origin IP, protecting the origin server from possible (injection) attacks while also improving content delivery speed. However, when access is misconfigured, it makes it possi

Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring: Exploiting Log4Shell (Log4J) in 2025 An indispensable GitHub recon tool (not the one you have in mind) A repository full of bug bounty tips, resources and tools One of the most comprehensive guides on finding expo

Bug bounty hunters who spend time in content discovery and reconnaissance are always rewarded well for their efforts, as they often come across untested and hidden assets or endpoints. GitHub dorking is another way to leverage public search engines to discover hidden assets, endpoints and even secre

It's been a few years since Log4Shell, an injection attack in Log4J Apache logging software, has struck thousands of companies around the world. And despite all the efforts organisations took to patch this critical flaw in their systems, some web services running in 2025 are still vulnerable to Log4