Dawid Czagan

Dawid Czagan (@dawidczagan) has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.

Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing services with a results-driven approach. He also works as Security Architect at Future Processing.

Dawid shares his bug hunting experience in his workshop entitled "Hacking web applications - case studies of award-winning bugs in Google, Yahoo, Mozilla and more". To find out about the latest in Dawid's work, you are invited to visit his blog (https://silesiasecuritylab.com/blog) and follow him on Twitter (@dawidczagan).

Articles from Dawid Czagan

Quantitative risk analysis [updated 2021]

May 19, 2021

Utilizing a quantitative risk analysis is an integral part of security and ensuring a positive cost and benefit.

Learn More

Securing cookies with httponly and secure flags [updated 2020]

August 10, 2020

Securing cookies is an important subject. Think about an authentication cookie. When the attacker is able to grab this cookie, he can impersonate the user. T

Learn More

Non-repudiation and digital signature [updated 2018]

September 1, 2019

What is a digital certificate? The digital certificate is a critical component of a public key infrastructure. It is an electronic document that associates

Learn More

Tunneling, Crypto and VPNs

April 23, 2015

1. Introduction The idea of Virtual Private Network (VPN) is to simulate a private network over a public network. A VPN tunnel can be used to securely connec

Learn More

HTTPS and mixed content vulnerability

January 8, 2015

HTTPS is used to make communication between the server and the browser secure. However, a problem occurs when an HTTPS page loads HTTP content: this is calle

Learn More

Cookies with Secure Flag: Undesired Behavior in Modern Browsers

August 11, 2014

Introduction When a cookie has secure flag set, it will only be sent over secure HTTPS, which is HTTP over SSL/TLS. This way, the authentication cookie will

Learn More

Qualitative risk analysis with the DREAD model

May 21, 2014

This article introduces two types of risk analysis (quantitative, qualitative) and presents how to perform qualitative risk analysis with the DREAD model. Fi

Learn More

Cookies with HttpOnly Flag: Problem in Some Browsers

April 7, 2014

1. Introduction When a cookie has HttpOnly flag set, then JavaScript cannot read it in case of XSS exploitation. This is actually the reason why HttpOnly fla

Learn More

The Importance of Session Regeneration

February 19, 2014

1. Introduction Users of web applications are recognized by session IDs. That's why it's obvious that session management is an important subject. Session man

Learn More

Fuzzing for SQL injection with Burp Suite intruder

November 8, 2013

This article introduces Burp Suite Intruder and shows how it can be used for SQL injection fuzzing. Burp suite intruder It is a part of Burp Suite, which i

Learn More

Understanding Session Fixation

October 31, 2013

1. Introduction Session ID is used to identify the user of web application. It can be sent with the GET method. An attacker can send a link to the user wit

Learn More

Symmetric and asymmetric encryption

October 23, 2013

This article explains how symmetric and asymmetric encryption work. It also describes how to build a secure mail system using these two types of encryption.

Learn More