The Voight-Kampff Test for Discovering Vulnerabilities
summary
Builds a practical filter that separates vulnerabilities found by dynamic scanners from those that require human context. Uses Cobalt data from about 300 freelance pentesters and focuses on black‑box web app testing. Finds scanners reliably surface misconfigurations, XSS, known‑vulnerable components and some OOB/blind issues with out‑of‑band tooling, but humans discover business‑logic bypasses, race conditions and chained exploits (examples: Uber driver IDOR via allow_not_activated, Shopify race condition payout $15,250, SSRF leading to container root and $25,000). Scanners need manual setup and produce false positives; many auth/XXE/deserialization bugs sit in the middle requiring human + tool.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:45Vanessa Sauter
- 1:28Travis McCormack
- 1:50Why does method matter
- 4:15Web Apps
- 5:06About the Research
- 6:39Web App Vulnerabilities
- 7:35Machine Wins
- 9:43Manual Setup
- 10:12Vulnerabilities
- 12:39Uber Bug Bounty
- 13:57Why write weak enforcement of workflows
- 14:48CashMoney example
- 16:13Race conditions
- 17:47Chain exploits
- 20:03Humans and Machines
- 20:45Case Study
- 22:05Debate
related talks
41mVulnerabilities that Hide from your Tools
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
43mSecurity Testing Tools: Can I Touch You There?
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
23mHack Your Cybersecurity Career: Your Role in the Ecosystem
44mApplication Security: Everything we know is wrong
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
43m Web Application Vulnerability Scanners: An Intro & Discussion