Hi friends,
Greetings from the hive!
I hope you had a good weekend. My thoughts go out to those impacted by the earthquake in Turkey and Syria.
When I heard the news, I immediately messaged my friend Mustafa to see if he was okay. Thankfully, he was. Not long after that, he called for the community to donate if they could.
The organization he mentioned is a NGO called ahbap. In addition, he is also the driving force behind HackerOne’s Hack for Good being set to The International Federation of Red Cross and Red Crescent Societies.
So, please help if you can. We’re all in this together.
Let’s take this week by swarm!
🐝 The Bee’s Knees
The InfoSec community needs you (yes, you). Why you should be writing blogs, appearing on podcasts, and presenting at conferences… and how to get started! more
Hussein Daher talks about “Bug Bounty On Steroids” at BSides Ahmedabad 0x03. more
Unleashing the power of CSS injection: The access key to an internal API. The vulnerability was a CSS injection flaw that could be exploited in the application’s PDF generator. more
️💪 Sponsor
Sponsor the Hive Five and reach a highly engaged community of engineers, security researchers, and ethical hackers who are at the forefront of the industry.
🔥 Buzzworthy
✅ Changelog
Geekboy announced Nuclei Cloud, a SaaS platform built on the top of Project Discovery Nuclei open-source project to ease the automation experience at scale for everyone. more
gwen001/github-endpoints v1.2.2 - Find endpoints on GitHub. more
gwen001/github-search v2.0.1 - A collection of tools to perform searches on GitHub. more
ffuf v2.0 is out. There are two major features introduced with this release: scraper and FFUFHASH. more
In Hive Five 106 I shared the awesome Fearless CORS blog post. However, it was still being edited. Here’s the finished version of the blog post. more
📅 Events
🎉 Celebrate
Sebastian Wieseler became a Senior Security Engineer. Congrats! more
TESS and team won Bugcrowd’s HackerCup2022. Let’s go! more
d0nut reached 20k followers on Twitter which means another challenge. Looking forward to it! more
Olivia announced that she joined a vulnerability research team, focusing on offensive security and open source software. Awesome! more
💰 Career
Meta’s bug bounty program is hiring for a analyst position. more
Jessica Crosby got laid off from Zoom and is looking for Offensive Application Security Engineer work. more
André is looking for a content creator who wants to join the mission of securing technology at Ethiack. more
Master Salary Negotiations with this Mind Map to showcase your contributions, achievements, outputs and strengths to demonstrate your value to your boss, and ultimately getting what you want. more
Here’s a bunch of helpful resources for finding a new job. more
⚡️ Community
📰 Read
Reversing UK mobile rail tickets. What data is inside the barcode of a mobile ticket, and how do they work? more
Why are you getting indexed by crawlers. Addressing concerns over privacy and security, and offering solutions. more
Azuredly attacking Azure… For the second part in this attacking cloud series, they will attack AzureGoat which is an intentionally vulnerable Azure lab environment with multiple paths to privilege escalation. more
How Dawid and Klaudia made $120k bug bounty in a year with good automation. more
📚 Resources
What hackers invest their bug bounty earnings in. more
What Should You Do After Recon?! One of the most popular questions Ben gets asked. more
RustCrypto/formats: Cryptography-related format encoders/decoders: DER, PEM, PKCS, PKIX. more
Hunter is a search engine for security researchers. more
Burp Suite Certified Practitioner Exam study notes. more
🎥 Watch
HackTheBox - Photobomb walkthrough (a ruby Sinatra Web App).more
Broken Access Control - Lab #3 User role controlled by request parameter. This lab has an admin panel at /admin, which identifies administrators using a forgeable cookie. more
How Hackers Run For The Money. more
Generating ETH from thin air. This video is an explanation of a vulnerability in Aurora’s Rainbow bridge. It could allow a malicious attacker to generate Ethereum from thin air. It was rewarded $1 mln bug bounty. more
🎵 Listen
Day[0] Binary Exploitation Podcast 186 - An XNU Exploit and a Chrome Heap Overflow. more
Day[0] Bug Bounty Podcast 185 - Facebook Account Takeovers and a vBulletin RCE. Is it possible to escalate a self-XSS into an account takeover? more
Risky Business #694 - Cleansing fire claims ESXi, GoAnywhere servers. more
Critical Thinking Bug Bounty Podcast Episode 6 - A sit down with mobile hacking legend Joel Margolis and get the scoop on his approach to popping bugs on Android. more
The Privacy, Security, & OSINT Show 289 - Combo Lists & Extreme Privacy Series. In this episode they discuss the risks (and benefits) of combo lists and introduce our new Extreme Privacy Series. more
Get $100 to try DigitalOcean. The go-to VPS for bug bounty hunters. I use it for all of my own recon and automation needs, plus it also doubles as a VPN. They have every cloud resource you need at an affordable price.