Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.
This issue covers the week from September 5th to September 10th
Intigriti News
- We’ve got 2 spare tickets for @nullcon Goa 2023, courtesy of @redbull
- Our dev friend found one of his first coding projects on an old backup drive that he made back in 2007 for his first school project
- Top 4 tools to automate SQL Injection vulnerabilities!
- Let’s see how we can solve the first JWT “expert” lab, focusing on algorithm confusion
- Some great insights from @VoysNL on why you might want to launch a bug bounty program, and how to make it a success!
- @odanorge has just launched their public bug bounty program with @intigriti, paying up to €4,000 for valid vulnerabilities!
From my notebook
- Bug Bounty Stories (EP1): Hacking An Online Casino – Slightly different format of video, but a really interesting look into NahamSec’s process
- Results of Major Technical Investigations for Storm-0558 Key Acquisition – Oops from Microsoft
- API Security Testing using AI in Postman – Really good guide on using Postman for API hacking, instead of or with Burp
- Tricky Unauthenticated RCE on WordPress Media Library Assistant Plugin using a good old Imagick – Oh ImageMagick my old friend what you have you done this time
- Episode 35: King of Collaboration: Douglas Day – ArchAngelDDay talks about how he finds bugs, his approach and auth testing
- Learn Active Directory Kerberoasting
- How The Pirate Bay Became a Religion, Political Party, and (Almost) a Country🎙Darknet Diaries Ep.92
- Risky Biz News: Microsoft explains how it lost its signing key
- UL NO. 397: Propaganda in a Box, Glacier-like Security, AGI by 2028?, Ancient Wisdom via AI, and Newsletter Differentiation
- Powerlifting and PowerShell: A Discussion with Jake Hildreth
- Risky Business #720 — How cloud identity provider federation features can get you mega-owned
- Deciphering Privacy in the Age of AI: An Expert Discussion
- SN 938: Apple Says No – Topics coming to Android, Apple security research, browser extension vulnerabilities
- Yuri Diogenes Discusses Building a Career in Cybersecurity
- EP137 Next 2023 Special: Conference Recap – AI, Cloud, Security, Magical Hallway Conversations
- 137: Predator
- Beginner
- Intermediate
- The Hidden SQL Injection Techniques That Google Doesn’t Want You To Know
- CVE-2023-38831 – WinRAR Zero-Day Vulnerability manually Exploit
- A Comprehensive approach for testing for SQL Injection Vulnerabilities
- Understanding SSTI and Building Payloads in Jinja2 Introduction
- For Newbies: Simple Examples of LDAP Injection Vulnerabilities
- Hacking a Windows Machine by Hiding a RAT Inside the File
- Exploiting CORS misconfigurations
- SAST & DevSecOps for Java
- Advanced
- Security Research
- bcrypt at 25: A retrospective on password security
- Spoof iOS devices with Bluetooth pairing messages using Android
- Orbeon Forms: The Final Form? On A Journey To RCE
- BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild
- Nagios Plugins: Hacking Monitored Servers with check_by_ssh and Argument Injection: CVE-2023-37154
- Paranoids Vulnerability Research: Ivanti Issues Security Alert
- Boot Unguarded: x86 Trust Anchor Downfalls to The Leaked OEM Internal Tools and Signing Keys
- A tale about a Red Team exercise and the Forcepoint Endpoint One DLP client
- Apache Superset Part II: RCE, Credential Harvesting and More
- Main Analytical Frameworks for Cyber Threat Intelligence
- eBPF Offensive Capabilities – Get Ready for Next-gen Malware – Sysdig
- Android 14 blocks all modification of system certificates, even as root
- Analyzing a Facebook Profile Stealer Written in Node js
- When URL parsers disagree (CVE-2023-38633)
- Uncovering Web Cache Deception: A Missed Vulnerability in the Most Unexpected Places
- Bugs
- A casual hunt of the day : Open Redirect at one of the largest MNCs
- Login Page Bypass With Google Hacking Database
- Bypassed Input Escaping for XSS
- How I placed into Apple Hall of Fame in 5 Minutes.
- Finding Loose Comparison in the wild (Unga Bunga Bugs Part-1)
- How I Find API disclosure $$$
- Subdomain takeover via Frill.co
- Information Disclosure exposes The Correct Answers through Debug in Quiz Scoring
- Bug Bounty Chronicles: an SQL death spiral
- Single XSS with Earn $600
- Leaked Database and SMTP credentials through .env file
- Wifi Soft Unibox Administration 3.0 Login Page Exploit
- Unveiling RCE on Dutch Government Website
- Bypass Mobile Phone verification using Mobile website
- How I was able to find an information disclosure on the Google Tag manager
- How I got $$$ from my First valid Bug
- How I was able to find PHP info page on the website
- My debut with a Critical Bug: How I found my first bug (API misconfiguration)
- The Art of Brute force with Facebook (Oculus) White-Hat Security Team
- Chaining low impact bugs leads to 0 click Mass ATO
- Again? Subdomain takeover via ideanote.io
- Story of Stored Blind XSS
- Revealing a Security Flaw: How I Discovered a Data Leak.
- Privilege Escalation to Super Admin
- How I ethically hacked one of the domains of the United Kingdom
- CTF challenges
- Hakluke’s Tool Stack
- DorXNG – Next Generation DorX. Built By Dorks, For Dorks
- Quick-Lookup-Ptrun – Quick Lookup Plugin For PowerToys Run (Wox)
- EmploLeaks – Finding Leaked Employees Info for the Win
- HTTP-Shell – MultiPlatform HTTP Reverse Shell
- securisec/chepy: Chepy is a python lib/cli equivalent of the awesome CyberChef tool.
- The Power of AXIOM Part 1
- Exploring Narrowlink: Your Swiss Army Knife for Secure Networking
- Enhancing Bug Bounty Workflow with Advanced Google Dorks
- Introduction to OpenVAS — A Vulnerability Scanner
- Tired of using many #Recon tools? I wrote a tool in rust that will help you do fuzzing, reverse dns lookup
- All my current bug bounty knowledge is gone. Here’s how I get it back and make $100k in the first year:
- Hunting #opendir with sql files on FOFA Search Engine @fofabot
- Account Takeover Through Host Header Injection
- Admin Panel Takeover
- IDOR leads to Mass Account Takeover of Employees
- Account Takeover tip using password resets
- How to spot the CVE vulnerability in Ivanti MobileIron Sentry (CVE-2023-38035) that affects the MICS Admin Portal.