Client side validation strikes again: PIN code bypass !

Client side validation Client side validation is a common weakness found during penetration tests and security audits performed by Randorisec. Because client side is by definition… on the user side, it can be altered by the user and sometimes it can be done quite easily. Netflix Parental Control PIN A few months ago we figured out that the Netflix parental control PIN was very easy to bypass: Hey kids !

Continue reading

Slack session hijacking

[UPDATE] An excellent article about the same issue has been posted by Detectify a few day after this one. Unfortunately Detectify was not aware of our post and had worked independently on this problem. Well they digged deeper and warned big webistes (Ars Technica, The Register, Observer, etc…) so the media impact has been very HUGE ! So huge that Slack listened to them and finally started to move by revoking public tokens.

Continue reading