Researchers’ blog

It's been a few years since Log4Shell, an injection attack in Log4J Apache logging software, has struck thousands of companies around the world. And despite all the efforts organisations took to patch this critical flaw in their systems, some web services running in 2025 are still vulnerable to Log4

Server-side template injection (SSTI) vulnerabilities still remain present in modern applications as developers continue to struggle with implementing proper input validations everywhere. And yet, despite this fact, bug bounty hunters still occasionally overlook these injection vulnerability class,

Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring: Becoming an Intigriti Pentester Exploiting CORS in 2025 (even when SameSite is set to ‘Strict’) A forgotten tool to quickly score new hidden endpoints (right before you close Burp Suite) 12 API hacking techniques

Reconnaissance plays an integral part in bug bounty hunting, with hidden parameter discovery an even more crucial role as they are often left with inadequate validation. Making these types of parameters usually more susceptible to common injection vulnerabilities such as SQLs, XSS, IDORs and even co

Hello Hackers 👋 Spring is in the air, and so is the sweet scent of freshly reported bugs. Intigriti’s blooming too—each month, we squad up with elite hackers to drop hot tips, platform news, shiny new programs, and community events you won’t want to miss. Let’s make this bug season one for the boun

What CREST accreditation means in cybersecurity and why achieving it is a significant milestone for a security testing provider, highlighting its rigorous standards for quality, technical competence, and operational integrity. How Intigriti’s CREST accreditation reinforces the credibility and effect

CORS misconfiguration vulnerabilities are a highly underestimated vulnerability class. With an impact ranging from sensitive information disclosure to facilitating SSRF attacks, this client-side security vulnerability should always be part of your security testing. In this article, we will explore t

We’re pleased to share a significant new change to our platform for companies. Our goal is to empower our customers with clear, actionable insights into their attack surface. We aim to create a platform where managing your digital footprint is intuitive, collaboration is effective, and understanding

Setting up Burp Suite for a new bug bounty program is one of those tedious, recurring tasks every bug bounty hunter knows too well. Manually copying in-scope domains, adding out-of-scope rules, pasting mandatory request headers, and double-checking that you haven't missed an asset... all before you'

As we have entered Q2 2025, let's dive into key improvements and new features introduced on the Intigriti platform in Q1, the value they bring, and how they positively impact your operation. Intigriti has rolled out several new features, designed to provide organizations with advanced control over t

NoSQL injections are relatively easier to exploit than classic SQL injections. However, developers often overlook these vulnerabilities, mainly due to limited awareness. Additionally, false beliefs among software engineers that NoSQL databases inherently resist injection attacks further increase the

Vibe coding is the latest trend sweeping through developer communities. It’s the art of describing a concept, feeding it to an AI, and letting the LLM (Large Language Model) manifest the code based purely on vibes. The quote states, "You fully give in to the vibes, embrace exponentials, and forget t

Hello Hackers 👋 Spring is in the air, and so is the sweet scent of freshly reported bugs. Intigriti’s blooming too—each month, we squad up with elite hackers to drop hot tips, platform news, shiny new programs, and community events you won’t want to miss. Let’s make this bug season one for the boun

Bug Business is a series of interviews in which experts from the bug bounty industry shine their light on bug types and trends. For this blog post, we spoke to a member of the Intigriti triage team about his experience of working as the middleman and the glue between clients and researchers. During

Subdomain takeovers are a well-documented security misconfiguration. Despite widespread awareness, developers still frequently forget to remove DNS records pointing to forgotten and unused third-party services, allowing these vulnerabilities to be present even today. In this article, we will learn w

So, you've found a valid security vulnerability in one of your bug bounty programs, now it's time to write the report. Finding the vulnerability was half the story. Writing effective reports is also an essential phase in bug bounty. Clear, well-written, and to-the-point bug bounty reports often get

Why application‑level encryption matters beyond HTTPS and basic transport‑level protections, including the specific threats it mitigates (like storage attacks and root certificate interception) for sensitive platform data. How Intigriti implements multi‑layered encryption to protect customer and res

Hey hackers, Each month, we team up with bug bounty experts to bring you insights, platform updates, new programs, and upcoming community events—all to help you find more bugs! We're excited to introduce a new way for researchers to gain valuable insights into their time allocation across different

In cybersecurity, ethical hackers are like digital guardians, keeping our online world safe. Game hacking adds a twist to this, giving hackers a chance to test their skills and help make gaming platforms secure. Today, we meet one of these ethical game hackers, diving into their world to understand

XML External Entity (XXE) vulnerabilities are one of the most overlooked yet impactful vulnerabilities in modern web applications. Although they've become seemingly harder to detect and exploit, their impact remains severe, often allowing attackers to read internal files, reach internal-only network