In the hunt for security issues, the pursuit of unexplored assets and hidden endpoints often ends up distracting you from the obvious but still essential functionality.
, — , , , - . , , . , , , PayPal: .
PayPal, javascript, , CSRF.
, JS .
, XSSI, - <script>, [ CORS], , .
, , , , : , .
, , . , _csrf _sessionID .
CSRF pay pal _csrf , . , , c .
, , . PayPal, , brute force — . , .
: , , . , , .
, , , Google, , , POST- /auth/validatecaptcha.
_csrf sessionID, , .
, . , .
, , .
, , — , . , . , .
jse .
recapcha , Google , c, , , , .
, , , .
XSSI; , , . , .
PayPal , . — , , /auth/validatecaptcha, .
, .
Bug Bounty PayPal 18 2019 HackerOne 18 . PayPal . $ 15300, 10 . , 8 ( ) CVSS — , .
24 . , 5 — .
/auth/validatecaptch CSRF, .
, , , : .
. « » . - — , «», .
, :
Data Scientist
Data Analyst
Data Engineering
Fullstack- Python
Java-
QA- JAVA
Frontend-
C++
Unity
-
iOS-
Android-
Machine Learning
"Machine Learning Deep Learning"
" Data Science"
" Machine Learning Data Science"
"Python -"
" "
DevOps