ProjectDiscovery Stories

GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487)

Introduction In light of the recent Ruby-SAML bypass discovered in GitLab, we set out to examine the SAML implementation within GitHub Enterprise. During our research, we identified a significant vulnerability that enabled bypassing GitHub’s SAML authentication when encrypted assertions were in use. This blog post will provide an in-depth look at GitHub Enterprise’s SAML implementation and analyze the specific code issue that permitted this bypass. Although we uncovered this vulnerability inde

Vulnerability Research Nuclei & Templates

October 2024 Newsletter

🎃Happy Halloween, PD community! The team are back again this month to share our latest developments, updates and releases we’ve been working on, as well as news from across the cybersecurity space. Of course, this October also saw the return of Hacktoberfest, and we couldn’t be happier with the turnout. Thank you all so much for your contributions! We’ve been hard at work creating new content for you and adding more people to our Pioneers program. As always, we love to see your contributions a

Announcements

Announcing the Nuclei Templates Community Leaderboard and Rewards!

We’re thrilled to unveil our latest milestones: over 9,000 stars and 900 unique contributors on the templates project, along with a staggering 20,000 stars on the Nuclei repository. This phenomenal growth is a testament to our community’s unwavering dedication to security and their shared passion for safeguarding the digital world. As part of the next phase in the evolution of the Nuclei Templates repository as the central, open source way for security research and engineers to communicate about

Nuclei & Templates

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409)

Introduction In this blog post, we will analyze CVE-2024-45409, a critical vulnerability impacting Ruby-SAML, OmniAuth-SAML libraries, which effectively affects GitLab. This vulnerability allows an attacker to bypass SAML authentication mechanisms and gain unauthorized access by exploiting a flaw in how SAML responses are handled. The issue arises due to weaknesses in the verification of the digital signature used to protect SAML assertions, allowing attackers to manipulate the SAML response a

Vulnerability Research

September 2024 Newsletter

With Autumn well underway and the days getting shorter, the team here at ProjectDiscovery are still hard at work with new developments on our tools, as well as some exciting next steps for the community. In this September edition of the PD Community Newsletter, we’ll dip into the latest updates and releases you need to be aware of, as well as news from in and around the cybersecurity arena that you might’ve missed. And, if you’re a regular contributor, be sure to check out the Highlights secti

Announcements

Announcing Pioneers, ProjectDiscovery's Ambassador Program

Today, we're excited to share some big news: the launch of the Pioneers Ambassador Program. This program is all about recognizing, connecting, and appreciating our active contributors and advocates. If you’re passionate about security, contributing to open-source projects, and collaborating with like-minded professionals, then you’ll want to read this. 🏆 Why We’re Launching Pioneers At ProjectDiscovery, we believe that knowledge sharing is at the heart of what makes security research impactf

Community & Open Source

Zimbra - Remote Command Execution (CVE-2024-45519)

Zimbra, a widely used email and collaboration platform, recently released a critical security update addressing a severe vulnerability in its postjournal service. This vulnerability, identified as CVE-2024-45519, allows unauthenticated attackers to execute arbitrary commands on affected Zimbra installations. In this blog post, we delve into the nature of this vulnerability, our journey in analyzing the patch, and the steps we took to exploit it manually. We also discuss the potential impact and

Nuclei & Templates

Simplifying XSS Detection with Nuclei - A New Approach

XSS (Cross-Site Scripting) detection has long been a challenge, balancing accuracy with avoiding excessive false positives. Traditionally, this meant creating specific reflection based string matchers for each target, leading to complex and hard-to-maintain configurations. But with headless modes, we can simplify and improve XSS detection in a more intuitive and efficient way. In this post, we'll explore how to leverage nuclei headless mode to detect XSS payloads more easily and accurately, usi

Nuclei & Templates

Azure Config Review - Nuclei Templates v10.0.0 🎉

We're excited to tell you about Nuclei Templates release v10.0.0! This new version includes newly added Azure Config Review templates. In this blog post, we'll discuss automating azure cloud misconfiguration review, creating custom Azure checks, and sharing results on the PDCP Cloud for review. Following our last release on AWS Cloud Security Config Review and Kubernetes Cluster Security, we decided to expand our coverage to include Azure as well. Azure is well-known for its powerful features

Nuclei & Templates

Introducing the httpx dashboard

The most widely used ProjectDiscovery tool, httpx, has been an essential asset in the arsenal of security professionals and researchers. Known for its ability to probe live hosts and capture crucial information. httpx has long been a go-to solution for: * Response data (status, server, location, etc.) * Technology detection * Extra metadata (favicon, hashes, response time, etc.) * Screenshots * Linked domain discovery (extracting domains from CSP, body) * Cloud metadata (ASN, CDN, WAF in

Attack Surface Management Community & Open Source

Advancing Asset Management - PDCP v0.8.9

We're excited to announce the release of version 0.8.9 of the ProjectDiscovery Cloud Platform. This update introduces significant enhancements to our asset management capabilities, focusing on asset inventory, AI-powered search, and improved user experience. Key Features in v0.8.9 Asset Inventory and Technologies The new interface for cataloging and organizing all assets along with their associated technologies in one place represents a significant advancement in asset management. Now, rega

Vulnerability Management

July 2024 Newsletter

Welcome to the July edition of the ProjectDiscovery Community Newsletter. As summer moves along, so too have the team been hard at work improving and iterating on our tools and templates, alongside our valuable community contributions. Our updates from the last few weeks can be caught up on below, and of course keep looking out for the latest news and developments in vulnerability and cybersecurity technology as we continue to share them with you. We’ll also keep highlighting contributions from

Announcements

ProjectDiscovery Stories

GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487)

October 2024 Newsletter

Announcing the Nuclei Templates Community Leaderboard and Rewards!

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409)

September 2024 Newsletter

Announcing Pioneers, ProjectDiscovery's Ambassador Program

Zimbra - Remote Command Execution (CVE-2024-45519)

Simplifying XSS Detection with Nuclei - A New Approach

Azure Config Review - Nuclei Templates v10.0.0 🎉

Introducing the httpx dashboard

Advancing Asset Management - PDCP v0.8.9

July 2024 Newsletter

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company