🐝 Hive Five 48 - Duplicates

Hi friends,

Greetings from the hive!

I hope you are well—no major updates from me. I've been busy with work and personal matters.

I look forward to iterating further on my website and newsletter. I even have ideas for other projects.

Make sure you hug your loved ones.

Let's take this week by swarm!

🐝 The Bee's Knees

1. Some log4j resources:

   1. CVE-2021-44228 - Log4j - minecraft vulnerable! (and so much more).

   2. Gist with expl️oitation detection ideas and rules.

   3. Huntress Log4Shell Vulnerability Tester.

   4. Thinkst Canary point & click log4shell token.

   5. NCC Group is maintaining a meta thread on Reddit.

   6. Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package.

   7. Bugcrowd - Log4Shell, The Worst Java Vulnerability in Years.

2. Why do you Duplicate so much with Bug Bounties?: Codingo shares how to dupe less.

3. CISA Director Jen Easterly's Keynote at Black Hat USA 2021.

4. Don’t Reply - A Clever Phishing Method In Apple’s Mail App.

5. How Acunetix addresses HTTP/2 vulnerabilities.

🙏🏻 Support the Hive

• Get $100 to try DigitalOcean. The go-to VPS for bug bounty hunters. I use it for all of my own recon and automation needs, plus it also doubles as a VPN. They have every cloud resource you need at an affordable price.

• TCM Security Academy - courses, bundles, gift certs, and access passes. Cybersecurity Training That Doesn't Break the Bank. Don't overspend on your education!

• Privacy.com - Protect Yourself Online. Create virtual cards, set a spend limit on each transaction, and track your spend. Take back control of your payments.

sponsor the hive five

🔥 Buzzworthy

✅ Changelog

1. Proxy Intercept is off by default in Burp early adopter release.

2. Burp Suite 2021.12 release: with multi-host Intruder attacks, customizable Inspector panel, and a dedicated version for Mac M1 machines.

3. Shodan introducing GeoNet: a free API to ping an IP or do DNS lookups from multiple locations around the world.

4. DOMPurify 2.3.4 release.

5. FullHunt Integration with Amass + SpiderFoot: FullHunt Public API is now a data provider for Amass + SpiderFoot.

📅 Events

1. HackerOne's HackyHolidays is back: Brought to you by adamtlangley and Congon4tor.

2. Polarity’s Holiday Triage Tournament: The Triage Tournament is a competition to find the fastest security professionals and techniques in a battle of data triage.

3. Blue Team Con 2022 Call For Papers.

4. NULLCON Berlin 2022 Call For Papers.

5. HackTheBox - Hacking Party: Cyber Santa is Coming to Town 14 December 3PM UTC.