Open Source Web Security Campaign

Websec is pleased to announce the commencement of a newly created campaign that will contribute towards open source, and the purpose and philosophy that has been of benefit to our common community.

Websec now offers open source projects, the expertise and specialization in Web Security testing, fielding out vulnerabilities that may cause disruption to your project. This offer will be given pro-bono to a select applicant who submits all necessary information. One open source project per month will be chosen without charge for web security testing.

In the growing field of Web Security, we at Websec think of ourselves as trailblazers with the integrity, vital energy and keenness to do the best possible for our clients with our expertise. However, we want to put forth the statement by creating this campaign, that Web Security testing is also needed for advancement and development and that it should be given as a contribution freely when possible.

Tests for the following bugs will be included but not limited to: XSS - SQLi - LFI/RFI - RCE - CSRF - Redirects - Session Handling - Broken Authentication

* All discovered bugs will be reported confidentially, as will the collaboration with fixing these issues.

If you would like your open source project to be considered, please note the guidelines given below and the form included. Additionally, if you would like to give Websec a thumbs up, we always appreciate a post of your feedback regarding the service we provided, and the satisfaction gained.

We look forward to receiving your submissions and to assisting you towards the security of your project.

Guidelines and Procedures

  • We request that you communicate with us on a timely basis throughout the testing.
  • It is required that any vulnerability found in your project will get fixed within a reasonable amount of time according to the vulnerability.
  • All bugs will be reported privately at the end of the testing period.
  • If a bug is considered of high-critical risk, it will be reported immediately.
  • We will collaborate with a fix for each bug reported.
  • The details of a bug may be made public once a patch has been released.

Tell us about your project

Latest Blog Entries

Backdoors in Zhone GPON 2520 and Alcatel Lucent I240Q
While examining the "dropbear" binary for the Zhone GPON 2520 and Alcatel Lucent I240Q, we found that both routers have backdoors that allow users with SSH access to connect to these devices with maximum privileges.

Drive By ONT Botnet with IRC C&C
Demonstration of a botnet created purely by using embedded devices which are controlled remotely through vulnerabilities exploited from a webpage.

(IN)secure session data in CodeIgniter
A security analysis on how web applications created with the PHP framework CodeIgniter handle user sessions.

Latest News

Websec present at Campus Party 2014

Websec will be participating with four conferences at the largest Campus Party ever held, which will take place from the 24-29 of June in Guadalajara, Mexico.

Websec at DerbyCon 2013
A summary of Websec's participation at DerbyCon 2013 in Louisville, Kentucky.