Open Source Web Security Campaign

Websec is pleased to announce the commencement of a newly created campaign that will contribute towards open source, and the purpose and philosophy that has been of benefit to our common community.

Websec now offers open source projects, the expertise and specialization in Web Security testing, fielding out vulnerabilities that may cause disruption to your project. This offer will be given pro-bono to a select applicant who submits all necessary information. One open source project per month will be chosen without charge for web security testing.

In the growing field of Web Security, we at Websec think of ourselves as trailblazers with the integrity, vital energy and keenness to do the best possible for our clients with our expertise. However, we want to put forth the statement by creating this campaign, that Web Security testing is also needed for advancement and development and that it should be given as a contribution freely when possible.

Tests for the following bugs will be included but not limited to: XSS - SQLi - LFI/RFI - RCE - CSRF - Redirects - Session Handling - Broken Authentication

* All discovered bugs will be reported confidentially, as will the collaboration with fixing these issues.

If you would like your open source project to be considered, please note the guidelines given below and the form included. Additionally, if you would like to give Websec a thumbs up, we always appreciate a post of your feedback regarding the service we provided, and the satisfaction gained.

We look forward to receiving your submissions and to assisting you towards the security of your project.

Guidelines and Procedures

  • We request that you communicate with us on a timely basis throughout the testing.
  • It is required that any vulnerability found in your project will get fixed within a reasonable amount of time according to the vulnerability.
  • All bugs will be reported privately at the end of the testing period.
  • If a bug is considered of high-critical risk, it will be reported immediately.
  • We will collaborate with a fix for each bug reported.
  • The details of a bug may be made public once a patch has been released.

Tell us about your project

Contact Info

Websec Information Security Services
Victoria, CA
Phone:+1 (888) 501-7603
Email: [email protected]

Latest Blog Entries

Three Non Web-based XSS Injections
In this post guest blogger Alejandro Hernandez (nitr0us) writes about some interesting and fun XSS vectors which are not commonly seen.

Belkin Wemo Switch NMap Scripts
Belkin Wemo Switch Smart Plug is a network controlled power outlet. The current firmware version does not requiere authentication to switch the power ON or OFF or to gather information such as nearby wireless networks. Two NMap scripts have been published

Downloading an Application's Entire Source Code Through an Exposed GIT Directory
Website administrators sometimes inadvertently leave an exposed .git directory, from which it is possible to download the entire source code of the web application using just wget and a common server misconfiguration.

Latest News

Blackhat EU 2015
Websec participated with two tools at the Blackhat, EU Arsenal held in Amsterdam, NL from the 10-13 of November, 2015. During this event, we introduced our brand new tool "credmap: The Credential Mapper" and also presented an amped-up version of Panoptic.

BSides Vancouver 2015
Websec is proud to announce that we will be attending the 3rd annual edition of BSides Vancouver, a local non-profit information security conference held in the heart of Vancouver, BC on March 16 and 17.