🐝 Hive Five 59 – Stay curious

Hi friends,

Greetings from the hive!

I hope you are doing well, and most importantly, you are safe in these continuously trying times. My heart goes out to Ukraine and anyone who currently has to worry for their well-being and home.

Let's take this week by swarm!

🐝 The Bee's Knees

1. UnChained- Blockchain Security Conference 2022: ‘UnChained’ is a collaborative initiative of RazzorSec and QuillAudits with an aim to spread awareness about Blockchain Security. The conference brings on board various domain experts from the Blockchain. Day 2.

2. Jack Cable Talks About His Background, Bug Bounty Methodology, and Hacking the US Government: Jack Cable is a security researcher, hacker and student. He is known for his participation in bug bounty programs, including placing first in the U.S. Department of Defense's Hack the Air Force challenge.

3. OAuth 2.0 and OpenID Connect (in plain English): Developer Advocate Nate Barbettini breaks down OpenID and OAuth 2.0 in Plain English.

4. How to Secure Anything: Security engineering is the discipline of building secure systems. Its lessons are not just applicable to computer security. In fact, in this repo, they aim to document a process for securing anything, whether it's a medieval castle, an art museum, or a computer network.

5. tmp.0ut Volume 2: The tmp.0ut Staff welcomes you to another exciting release, this second issue of the zine is about ELF binaries. They say: "Special thanks to grenlith, koronkowy, barbie, and hexadecim8 for their help with this zine. Don't ever let them take your curiosity away from you."

🙏🏻 Support the Hive

• Get $100 to try DigitalOcean. The go-to VPS for bug bounty hunters. I use it for all of my own recon and automation needs, plus it also doubles as a VPN. They have every cloud resource you need at an affordable price.

Become a sponsor

🔥 Buzzworthy

✅ Changelog

1. PentesterLab added another CVE for their code review badge.

📅 Events

1. Joe Grand's Open Lab: YouTube Live AMA - Mar 12, 2022: Since the release of their Trezor One wallet hacking video, they've received a lot of questions about engineering, hacking, and life in general.

🎉 Celebrate

1. Tanya Janca bought a farm. Awesome!

2. HackerOne's Champions of the Ambassador World Cup 2022 are the Bordeaux HackerOne club: Congrats!

3. Ananda got themselves a bug bounty bike: Let's go!

4. InfoSec Community's first ever virtual conference was a great success: Well done!

5. Dominic wrote another blog post since they last did a year ago: Can't wait to read it!

💰 Career Corner

1. Tinker on how to tell someone you don’t want regular 1:1s with them: "These 1:1s are going well, but I don't believe we need to have then on a rotating basis. Let's move to ad hoc. I'll schedule the next one as the need comes up. If something urgent comes up on your end in the mean time, let me know and I'll make time for you."

2. Marcus J. Carey's 2/25/2022 Cybersecurity Job Thread: Including remote, entry level, and intern positions.

3. Bugcrowd is hiring a Principal Security Engineer to support the appeals team: Come make a difference.

4. Paul answers pentesting career questions.

5. Choate, Hall & Stewart LLP is hiring an InfoSec engineer: In the Boston area with great compensation and work/life balance.

📰 Articles

1. The Elite Hackers of the FSB: For almost two decades, hackers with Snake have been forcing their way into government networks. They are considered one of the most dangerous hacker groups in the world.

2. OAuth and PostMessage: An OAuth misconfiguration was discovered in the redirect_uri parameter at the target’s OAuth IDP, which allowed attackers to control the path of the callback endpoint using the ../ character.

3. Logic Flaw Leading to RCE in Dynamicweb 9.5.0 - 9.12.7: When auditing enterprise applications, it’s important to not only focus on concrete vulnerability classes, but also on logic flaws which may have significant impact if exploited. This security research was performed by Shubham Shah. The CVE for this issue is CVE-2022-25369.

4. Write up – Android Application Screen Lock bypass via adb brute forcing by omespino: A short story about how simulate android keystrokes virtually in order to perform a brute-forcing attack with adb tools.

5. Behind the stalkerware network spilling the private phone data of hundreds of thousands: Much of the spyware you hear of today are the powerful nation-state-backed exploits that can quietly and remotely hack into iPhones anywhere in the world.

📚 Resources

1. Benjamin walks through how they understand, counter and expose influence operations & disinformation for the Centre for Information Resilience.

2. Awesome Tunneling: List of ngrok alternatives and other ngrok-like tunneling software and services. Focus on self-hosting.

3. Free tools for investigating digital ads: These investigations require an understanding of how digital advertising works, and the many ways people exploit the system.

4. Subdomains Tools Review - a full and detailed comparison of subdomain enumeration tools: The enumeration of subdomains is part of an almost mandatory process when attacking a new target. However, there are dozens of tools to perform this task, using as many different sources and techniques.

5. Awesome Cloud Security: A curated list of awesome cloud security related resources.

🎥 Videos

1. IppSec tackling HackTheBox - Driver.

2. Bug Bounty Podcast - CoinDesk, Zabbix, and Leaking Secrets Through Mirrored Repos: Let's talk about "sidedoors" this week, with two vulnerabilities abusing alternative access points, along with an overly verbose error message that actually had some immediate impact, and a look at the challenges of client-sided session.

3. Interview With Loránd Bodó - OSINT Jobs: A talk with Loránd Bodó (@LorandBodo) about his new project OSINT Jobs, a platform that shares hand-picked, OSINT-related job openings and helps the OSINT community grow their skills and advance their careers.

4. Crazy JSP Web Shell to Exploit Tomcat - Real World CTF 2022: This was a hard web CTF challenge involving a JSP file upload with very restricted character sets. They had to use the Expression Language (EL) to construct useful primitives and upload an ascii-only .jar file.

5. List Database Content For Further Exploitation: Learn about SQL Injection vulnerabilities. In this video, you are going to have a look at how to examine a database for table and columns that can be further used in a UNION payload.

🎵 Audio

1. Smashing Security #263 - Problèmes de Weefeee, AI artists, and Web 3.0: Ooh la la! Horreur Wi-Fi en France! Some folks have experienced the drawbacks of Web 3.0 as their NFTs are stolen, and should computers own the copyright over the art they produce?

2. Privacy, Security & OSINT #252 - Secure Communications Conversion: This week they discuss new conversion methods which encourage others in your life to start using secure messaging instead of SMS, plus the latest privacy news.

3. Risky Business #655 - USG Expect Russian cyber drama.

4. Darknet Diaries #111 - ZeuS: ZeuS is a banking trojan. Designed to steal money from online bank user’s accounts. This trojan became big, that it resulted in one of the biggest FBI operations ever.

5. Malicious Life - Crypto AG, Part 2, The Death of Bo Jr.: How did Boris Hagelin succeed in selling compromised cipher machines to half the world, for more than 50 years?

Subscribe to the Hive Five to read the rest.