IIS Auth Bypass, Securing AI, and making 100k in 2 months

/The Bee's Knees 🐝

The headline picks from this issue. The full issue has more.

1. /01

   Bypass IIS Authorization with this One Weird Trick - Three RCEs and Two Auth Bypasses in Sitecore 9.3

   It’s time to look at Sitecore again! In 2021 Assetnote’s security research team took a look at Sitecore and found some nice vulnerabilities.

   Read : Bypass IIS Authorization with this One Weird Trick - Three RCEs and Two Auth Bypasses in Sitecore 9.3
2. /02

   Securing AI - Prompt Injection Defense

   After LiveOverflow explored attacking LLMs, in this video he finally talks about defending against prompt injections. Is it even possible?

   Watch : Securing AI - Prompt Injection Defense
3. /03

   NahamSec made $100,000 in two months

   How did he do it? Through luck, hard work, choosing the right programs, manually searching for for bugs such as authorization issues, and paying attention to details.

   Watch : NahamSec made $100,000 in two months
4. /04

   The CodeQL Bug Bounty program operated by the GitHub Security Lab aims at scaling the security research community’s work across open source projects. A maximum payout is capped at $7,800 USD corresponding to 8 critical CVEs.

   Read : pick 4
5. /05

   Exploring Algorithm Confusion Attacks on JWT: Exploiting ECDSA

   JSON Web Tokens (JWT) are widely used for authentication in modern applications. As their use increases, so does the importance of understanding common attacks against them, such as algorithm confusion attacks.

   Read : Exploring Algorithm Confusion Attacks on JWT: Exploiting ECDSA