• Skip to main content

Redpoint Security

Helping security professionals and developers navigate the infosec world.

  • SERVICES
    • Assessment Services
      • Application Security Assessment
      • Secure-Code Review
      • Hybrid Application Security Assessment
      • Mobile Application Security Assessment
      • Web3 Assessments / Smart Contracts
    • Training
    • SDLC Consulting
    • Process Assessments
  • PRODUCTS
    • Surveyor™ – For Web Application Security
  • Industries
    • Finance
    • Software Development
    • Healthcare
    • Insurance
    • Web3
    • Ecommerce
  • RESOURCES
    • Blog
    • Absolute AppSec podcast
    • Open-Source Projects
  • About Us
    • Redpoint’s Story
    • About our team
    • Contact Page

AppSec Travels

AppSec Travels 3: Account Takeover 

July 16, 2024 by Justin Larson

During a recent assessment, our team came upon a vulnerability that felt like finding a hidden door in a seemingly secure fortress. The discovery involved the password-reset mechanism of an application, allowing us to reset any user’s password with just their email address. This flaw circumvents authentication, giving unauthorized access to user accounts. Here’s how […]

Filed Under: Appsec, AppSec Travels, Code Security, Findings Writeup Tagged With: account takeover, authentication tokens

AppSec Travels Part 2: Access-Control Bypass

March 8, 2024 by redpointsec

What happens when combined technologies counteract security controls? This is another in Redpoint’s blog series AppSec Travels where we walk you through interesting findings we’ve discovered in vulnerability assessments. AppSec Travels is on ongoing series without a regular cadence because frankly some assessments are perfunctory security checks lacking in exciting findings and we sort of […]

Filed Under: Appsec, AppSec Travels, Findings Writeup, Services

AppSec Travels Part I: Function Overload

March 8, 2024 by redpointsec

Token Caching This is our first blog of AppSec Travels where we walk you through interesting findings we’ve discovered in vulnerability assessments. This will be on ongoing series without a regular cadence because frankly some assessments are perfunctory security checks lacking in exciting findings and we sort of doubt anyone wants to read findings write-ups […]

Filed Under: Appsec, AppSec Travels, Code Security, Findings Writeup

Copyright © 2025