Open Source Web Security Campaign


Websec is pleased to announce the commencement of a newly created campaign that will contribute towards open source, and the purpose and philosophy that has been of benefit to our common community.

Websec now offers open source projects, the expertise and specialization in Web Security testing, fielding out vulnerabilities that may cause disruption to your project. This offer will be given pro-bono to a select applicant who submits all necessary information. One open source project per month will be chosen without charge for web security testing.

In the growing field of Web Security, we at Websec think of ourselves as trailblazers with the integrity, vital energy and keenness to do the best possible for our clients with our expertise. However, we want to put forth the statement by creating this campaign, that Web Security testing is also needed for advancement and development and that it should be given as a contribution freely when possible.

Tests for the following bugs will be included but not limited to: XSS - SQLi - LFI/RFI - RCE - CSRF - Redirects - Session Handling - Broken Authentication

* All discovered bugs will be reported confidentially, as will the collaboration with fixing these issues.

If you would like your open source project to be considered, please note the guidelines given below and the form included. Additionally, if you would like to give Websec a thumbs up, we always appreciate a post of your feedback regarding the service we provided, and the satisfaction gained.

We look forward to receiving your submissions and to assisting you towards the security of your project.



Guidelines and Procedures

  • We request that you communicate with us on a timely basis throughout the testing.
  • It is required that any vulnerability found in your project will get fixed within a reasonable amount of time according to the vulnerability.
  • All bugs will be reported privately at the end of the testing period.
  • If a bug is considered of high-critical risk, it will be reported immediately.
  • We will collaborate with a fix for each bug reported.
  • The details of a bug may be made public once a patch has been released.


Tell us about your project


Latest Blog Entries

New publication: Mastering the Nmap Scripting Engine
We invite you to learn more about the latest publication from our team, "Mastering the Nmap Scripting Engine".

Presentation on Optimization and Obfuscation Techniques for SQL Injections
A couple years ago Roberto Salgado had the honor of presenting his research on SQL Injections at several conferences. Just recently, Blackhat released the video of his presentation. This post contains the link to Roberto's slides and video.

Backdoors in Zhone GPON 2520 and Alcatel Lucent I240Q
While examining the "dropbear" binary for the Zhone GPON 2520 and Alcatel Lucent I240Q, we found that both routers have backdoors that allow users with SSH access to connect to these devices with maximum privileges.

Latest News

BSides Vancouver 2015
Websec is proud to announce that we will be attending the 3rd annual edition of BSides Vancouver, a local non-profit information security conference held in the heart of Vancouver, BC on March 16 and 17.

Websec present at Campus Party 2014
Websec will be participating with four conferences at the largest Campus Party ever held, which will take place from the 24-29 of June in Guadalajara, Mexico.