Dawid Czagan

Dawid Czagan (@dawidczagan) has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.

Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing services with a results-driven approach. He also works as Security Architect at Future Processing.

Dawid shares his bug hunting experience in his workshop entitled "Hacking web applications - case studies of award-winning bugs in Google, Yahoo, Mozilla and more". To find out about the latest in Dawid's work, you are invited to visit his blog (https://silesiasecuritylab.com/blog) and follow him on Twitter (@dawidczagan).

Dawid Czagan

Articles from Dawid Czagan

General security

Quantitative risk analysis [updated 2021]

May 19, 2021

Utilizing a quantitative risk analysis is an integral part of security and ensuring a positive cost and benefit.

Learn More
General security

Securing cookies with httponly and secure flags [updated 2020]

August 10, 2020

Securing cookies is an important subject. Think about an authentication cookie. When the attacker is able to grab this cookie, he can impersonate the user. T

Learn More
General security

Non-repudiation and digital signature [updated 2018]

September 1, 2019

What is a digital certificate? The digital certificate is a critical component of a public key infrastructure. It is an electronic document that associates

Learn More
Cryptography

Tunneling, Crypto and VPNs

April 23, 2015

1. Introduction The idea of Virtual Private Network (VPN) is to simulate a private network over a public network. A VPN tunnel can be used to securely connec

Learn More
Hacking

Bypassing Packet Filters with IP Fragmentation Overlapping

April 20, 2015

1. Introduction The process of IP fragmentation occurs when the data of the network layer is too large to be transmitted over the data link layer in one piec

Learn More
Vulnerabilities

HTTPS and mixed content vulnerability

January 8, 2015

HTTPS is used to make communication between the server and the browser secure. However, a problem occurs when an HTTPS page loads HTTP content: this is calle

Learn More
General security

Cookies with Secure Flag: Undesired Behavior in Modern Browsers

August 11, 2014

Introduction When a cookie has secure flag set, it will only be sent over secure HTTPS, which is HTTP over SSL/TLS. This way, the authentication cookie will

Learn More
Management, compliance & auditing

Qualitative risk analysis with the DREAD model

May 21, 2014

This article introduces two types of risk analysis (quantitative, qualitative) and presents how to perform qualitative risk analysis with the DREAD model. Fi

Learn More
Application security

Cookies with HttpOnly Flag: Problem in Some Browsers

April 7, 2014

1. Introduction When a cookie has HttpOnly flag set, then JavaScript cannot read it in case of XSS exploitation. This is actually the reason why HttpOnly fla

Learn More
Application security

The Importance of Session Regeneration

February 19, 2014

1. Introduction Users of web applications are recognized by session IDs. That's why it's obvious that session management is an important subject. Session man

Learn More
Hacking

Session randomness analysis with Burp Suite sequencer

January 24, 2014

Users of web applications are identified by session IDs. An attacker can impersonate users when generated sessions are predictable. This article introduces B

Learn More
Hacking

From CSRF to Unauthorized Remote Admin Access

January 21, 2014

1. Introduction The intention of this article is to show how dangerous a cross-site request forgery (CSRF) vulnerability can be. It will be presented for the

Learn More