appsec.fyi · Sources

brightsec.com

5 curated AppSec resources from brightsec.com across 5 topics on appsec.fyi.

brightsec.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-10-31.

SSRF 2 AI 1 API Sec 1 Fuzzing 1 XSS 1
Date Added Resource Excerpt
2026-10-31 2026Agentic Fuzzing Across Multiple Open Source ProjectsAIFuzzingBright Security offers a solution for agentic fuzzing across multiple open-source projects. Their platform automatically detects and remediates vulnerabilities in real-time, aiming to accelerate app and API security. Bright emphasizes its role in simplifying and empowering users to control their security posture. No specific bounty payout amount is mentioned in the provided content.
2026-04-10 2026API Security Testing Tool Checklist (2026)API SecLibrary for API security testing, this resource outlines essential features for modern application security. It emphasizes robust authentication support, including OAuth2, JWT, and multi-step workflows, alongside schema import capabilities for OpenAPI, Swagger, and Postman collections to ensure comprehensive coverage of REST, GraphQL, and Async APIs. The checklist highlights the importance of rate limiting and safe scan controls to prevent operational disruption, continuous environment support across CI/CD and staging, and noise reduction through proof of exploitability. Key vulnerabilities addressed include Broken Object Level Authorization (BOLA) and business logic abuse, stressing workflow-level testing over basic scanning for effective API security.
2026-01-02 2026SSRF Attack: Impact, Types, and Attack Example - Bright SecuritySSRFLibrary for dynamic application security testing that automates the detection and remediation of vulnerabilities, including SSRF. It scans web applications and APIs, preventing attacks like those seen in the Capital One breach where a misconfigured WAF allowed access to internal IAM services, leading to data exfiltration. The tool aims to find and fix issues early in the development lifecycle by integrating into the SDLC and validating findings to achieve zero false positives.
2025-08-14 2025Server Side Request Forgery (SSRF) Attacks & How to Prevent Them - Bright SSSRFLibrary detailing Server-Side Request Forgery (SSRF) attacks, covering techniques like accessing cloud provider metadata (e.g., http://169.254.169.254), exploiting internal services via schemes such as `file://` and `gopher://`, and port scanning internal networks using loopback interfaces. It discusses the impact of these vulnerabilities, including unauthorized access to sensitive configurations and exploit chaining, and provides insights into preventing SSRF by avoiding blacklisting domains and IPs.
2024-07-22 2024DOM XSS: What Is DOM-based Cross-Site Scripting And How can you Prevent it?XSSLibrary detailing DOM-based Cross-Site Scripting (DOM XSS) vulnerabilities, which affect up to 50% of websites, impacting companies like Google, Yahoo, and Amazon. It explains how this client-side vulnerability occurs when malicious JavaScript alters the Document Object Model, enabling attackers to exploit sources like `document.URL` and sinks such as `document.write` or `innerHTML` to execute arbitrary code and steal sensitive data. The resource differentiates DOM XSS from reflected and stored XSS, highlighting its client-side root cause and the necessity for client-side code sanitization and careful handling of client data.