--- title: "Secure and Merry Christmas" url: "https://www.bekk.christmas/post/2018/24/secure-and-merry-christmas" authors: ["Stian Fredrikstad"] published: "2018-12-24" updated: "2024-11-07T13:05:28Z" language: "en-US" type: "article" tags: ["Sikkerhet"] --- # Secure and Merry Christmas ## In short Security testing is best learned by practicing on intentionally vulnerable targets like OWASP Juice Shop and then turning that attacker mindset toward your own code. It also introduces bug bounty platforms and the security.txt standard as ways to report vulnerabilities responsibly. - **For:** Developers and security-curious readers interested in web application security - **Good to know beforehand:** Basic web security concepts _AI-generated_ As you have seen and read, it has been a diversity in the topics of this calendar, and this is also why the field of security is as complex as it is. Now that we have introduced you to a lot of different topics and attacks, you might want to test some of this knowledge. As you might remember from the [post](https://security.christmas/2018/10) Tia wrote about OWASP ZAP, it is illegal to attack other web applications without permission. That is why we proposed for you to start with [OWASP Juice Shop](https://www.owasp.org/index.php/OWASP_Juice_Shop_Project). ### Hack Yourself First After you are finished with OWASP Juice Shop, you should go and try the attacks on your own code. If you try to look at your code as an attacker, you start to see weaknesses you missed as a developer. Remember, it is much cheaper to find the vulnerabilities yourself, than reading about them on the front page of a newspaper. ### Bug Bounties If you want more challenges during the Christmas celebrations, it has become very easy to get the permission to hack other web applications. Companies have realized that they will get attacked at some point, and it is better to have hackers work for them, instead of against them. Many companies are actually paying for the bugs you find, which is a nice carrot (or candy cane) to motivate you. Two of the largest sites where you find companies to attack are [Bugcrowd](https://www.bugcrowd.com) and [HackerOne](https://hackerone.com). Both of these have a variety of different companies. It is a difficult challenge to find bugs, but it is fun to attack large companies like Spotify and Nintendo. ### security.txt Some companies handle the bug bounties themselves, or does not allow you to attack them at all, but they still want you to report bugs if you happen to find them. A new standard called _security.txt_ is getting some traction. It is located in the _.well-known_ directory of sites. Like the _robots.txt_ describes what search engines are allowed to do on the site, _security.txt_ can describe what security researchers are allowed to do and how to report bugs. As an example you can look at the _security.txt_ at Google here [https://www.google.com/.well-known/security.txt](https://www.google.com/.well-known/security.txt). We also have a _security.txt_, at [https://security.christmas/.well-known/security.txt](https://security.christmas/.well-known/security.txt). It is very slim, but it gives an email you can contact directly about security concerns. This is very nice to have in a large company, where real security concerns could get lost in large customer service department. Hopefully you have learned a lot throughout this calendar, and we hope you have a good and secure Christmas celebration.