🐝 Hive Five #7 - “Can you remember who you were, before the world told you who you should be?” ― Danielle LaPorte

Hi friends,

Greetings from the hive!

I hope this letter finds you well. My week was uneventful as I was busy finishing up a project. I'm pleased with the end results.In the weekend I found time to work on a new blog post, must-watch infosec talks of 2020. I made a custom video list template that I plan on re-using, so stay tuned for more content like this. It was fun revisiting these talks. Let me know if I'm missing any!

I KonMari'd my archive, so this edition is longer than normal. I hope you don't mind!

Let's get down to buzzness.

The Bee's Knees

• The Definitive Guide To SEO In 2021 - Everyone that writes for the web, should know at least some SEO. Being a developer myself, I can say that this is the most complete guide to search engine optimization I've read in a while.

• Ask HN: What are the best websites that the Anglosphere doesn't know about? - Almost all the websites that I frequent and consume are in English. This post made me realize that I shouldn't limit myself to just that. Check it out, you might find something cool.

• List of Resource Links from Open-Source Intelligence Summit 2021 - A big list of links shared by those attending the SANS 2021 Open-Source Intelligence Summit. So many resources I wasn't aware of!

• How to Find XXE Bugs: Severe, Missed and Misunderstood - XXE exploitation methods often require multiple steps and are not easily detected by automatic scanners. Find out what XXE is, where to look for it, and how to exploit it.

• Middleware, middleware everywhere - and lots of misconfigurations to fix - Detectify Crowdsource found some interesting middleware misconfigurations and potential exploits that, if left unchecked, leaves your web applications vulnerable to attack.

Buzzworthy

News:

• International Security Conference March 2021

• Shopify started an e-sports team: Rebellion

• NahamCon announcement for 03/14/21

Articles:

• My Own Digital “Decline Letter”

• The modern packager’s security nightmare

• Choose Boring Technology

• (IMHO) Apple sucks

• From Sock Puppets to Puppet Masters

• Smarty Template Engine Multiple Sandbox Escape PHP Code Injection Vulnerabilities

• ZDI-21-171: Getting Information Disclosure in Adobe Reader Through the ID Tag

• Why did I leave Google or, why did I stay so long?

• Malware in open-source web extensions

• Done Answering Questions Stack Overflow

• Paul Graham - What I Worked On

• “User Engagement” Is Code For “Addiction”

• Getting Started in Infosec

• Scope Based Recon Talks

• Damn Vulnerable IoT Device (DVID) writeup series

Resources:

• Building Secure Mobile Apps - You don’t have to learn it the hard way! - 2021-01-29

• Typography Twitter account

• Types of jobs in InfoSec Twitter Thread by casey

• I Miss My Bar

• DeepL Translate

• Hacking the bugbountyhunter.com training platform BARKER

• Ask HN: Advice for finding an entry-level remote job?

• Loading radio.garden into SQLite using jq

• Jake Creps - Making images for sock puppet accounts

• Finding more IDORs – Tips and Tricks

• How to Find Your First Bug

• Naval - How to Get Rich: Every Episode

• How they SRE

• It's OK to be a Copycat (feat. Pablo Picasso)

• A list of applications with vi keybindings

• TypeScript in 50 Lessons (paid)

• A directory of direct links for you to obtain your data from web services.

• Vimium: A more productive web browser experience

• Sans - Pen Testing Cheat Sheets

• Tuxi - A simple bash program for getting answers to questions instantly.

• OSINT At Home : Tutorials on Digital Research

• Power Searching with Google - Course

• Daniel Miessler - ffuf primer

Subscribe to the Hive Five to read the rest.