Security writeups from researchers for researchers

We scan, we hack, we write about it. New interesting vulnerabilities, attack techniques, tools and bug bounty tips.

Log in Subscribe

Home
About

Next.js 14 from a hacker's perspective

Next.js 14 from a hacker's perspective

Next.js 14 (and 13) introduced many attack vectors without providing the tooling necessary for organizations to detect them. It is easier than ever before to expose server secrets, introduce unauthenticated "endpoints" or any other issue that will make you vulnerable

Dawid Moczadło

30 Oct 2023 · 4 min read

Escalating debug mode in Django to RCE, SSRF, SQLi

Escalating debug mode in Django to RCE, SSRF, SQLi

Dawid Moczadło

24 Oct 2023 · 3 min read

Vidoc Secures Funding from bValue!

Vidoc Secures Funding from bValue!

Klaudia

27 Sep 2023 · 2 min read

Vidoc - Notifications and Collab Feature Release

Vidoc - Notifications and Collab Feature Release

Klaudia

6 Jun 2023 · 2 min read

Ultimate 401 and 403 bypass methods

Ultimate 401 and 403 bypass methods

As a security researcher, I absolutely love the rush of discovering a suspicious endpoint during reconnaissance (which is super easy with Vidoc Research tool ;). It's exciting to think that you

Klaudia

9 May 2023 · 7 min read

How we made $120k bug bounty in a year with good automation

How we made $120k bug bounty in a year with good automation

2022 was very busy for several reasons, today we want to present to you what we did and learned doing large-scale bug bounty hunting

Klaudia

6 Feb 2023 · 7 min read

Introducing the New and Improved Web-Based Security Tool

Introducing the New and Improved Web-Based Security Tool

TL;DR; - We improved Active Recon and data search option - Changed payments system to subscription model - Introduced Module-based security scanning with nuclei-like templates - Introduced Module Editor

Klaudia

1 Feb 2023 · 5 min read

Why good Recon is hard, and how we make it easy

Why good Recon is hard, and how we make it easy

What sucks the most about doing recon? — Bug Bounty Reports Explained (@gregxsunday) November 2, 2022 It all started with that one twitt ;) Inspired by Greg’s post we decided to

Klaudia

3 Nov 2022 · 3 min read

Vidoc - a hacking platform

Vidoc - a hacking platform

TL;DR Vidoc platform will allow you to find new targets, test your payloads and collaborate with other professionals. The application security recon tool and scanner we are working on

Klaudia

24 Sep 2022 · 3 min read

Hacking Swagger-UI - from XSS to account takeovers

Hacking Swagger-UI - from XSS to account takeovers

We have reported more than 60 instances of this bug across a wide range of bug bounty programs including companies like Paypal, Atlassian, Microsoft, GitLab, Yahoo, ...

Dawid Moczadło

16 May 2022 · 10 min read

© 2023 Vidoc Security Lab. All rights reserved.