Information Disclosure Due To exposed .env file (Directory Listing) at on 22/10/2024
AWS VDP disclosed a bug submitted by necr0mancer: https://hackerone.com/reports/2784712 [...]
InfoSec Planet
A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.
No, The Chinese Have Not Broken Modern Encryption Systems with a Quantum Computer on 22/10/2024
The headline is pretty scary: “China’s Quantum Computer Scientists Crack Military-Grade Encryption.” No, it’s not true. This debunking saved me the trouble of writing one. It all seems to have come from this news article, which wasn’t bad but was taken widely out of proportion. Cryptography is safe, and will be for a long time [...]
When to quit your job to do bug bounty full-time? feat. Blaklis #bugbounty #bugbountytips on 22/10/2024
Weak Password Policy via DirectAdmin Password Change Functionality on 22/10/2024
Endless Group disclosed a bug submitted by seqode: https://hackerone.com/reports/791381 [...]
Is This The Best Recon Framework? on 21/10/2024
Windows Servers Can Expose PowerShell on the Web on 21/10/2024
Hacking AI: Bias in AI on 21/10/2024
AI and the SEC Whistleblower Program on 21/10/2024
Tax farming is the practice of licensing tax collection to private contractors. Used heavily in ancient Rome, it’s largely fallen out of practice because of the obvious conflict of interest between the state and the contractor. Because tax farmers are primarily interested in short-term revenue, they have no problem abusing taxpayers and making things worse for them in the long term. Today, the U.S [...]
Checking bug bounty report updates in the middle of the night feat. Jhaddix & Blaklis on 21/10/2024
Reflected - XSS on 21/10/2024
MTN Group disclosed a bug submitted by mathara: https://hackerone.com/reports/1779447 [...]
No rate limit in OTP code sending on 21/10/2024
MTN Group disclosed a bug submitted by mathara: https://hackerone.com/reports/1780399 [...]
Success in bug bounty is based on this feat. Jhaddix #bugbounty #bugbountytips #bugbountyhunter on 19/10/2024
Friday Squid Blogging: Squid Scarf on 18/10/2024
Cute squid scarf. Blog moderation policy. [...]
Trojanized Ethers Forks on npm Attempting to Steal Ethereum Private Keys by Phylum Research Team on 18/10/2024
Phylum’s automated risk detection platform recently flagged several suspicious packages published to npm. Upon investigation, we found these packages attempting to exfiltrate Ethereum private keys and gain SSH access to the victim’s machine by writing the attacker’s SSH public key in the root user’s authorized_keys file.--cta--Stop me if you’ve heard this one bef [...]
Prototype Pollution for Beginners on 18/10/2024
Justice Department Indicts Tech CEO for Falsifying Security Certifications on 18/10/2024
The Wall Street Journal is reporting that the CEO of a still unnamed company has been indicted for creating a fake auditing company to falsify security certifications in order to win government business. [...]
Unauthenticated WordPress Database Repair DoS on 18/10/2024
WordPress disclosed a bug submitted by wshadow: https://hackerone.com/reports/2786591 [...]
Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach by BrianKrebs on 18/10/2024
Brazilian authorities reportedly have arrested a 33-year-old man on suspicion of being “USDoD,” a prolific cybercriminal who rose to infamy in 2022 after infiltrating the FBI’s InfraGard program and leaking contact information for 80,000 members. More recently, USDoD was behind a breach at the consumer data broker National Public Data that led to the leak of Social Security numbe [...]
He spent a whole month on one $75,000 bug feat. Blaklis #bugbounty #bugbountytips #bugbountyhunter on 18/10/2024
sentry Auth Token exposed publicly in docker hub image on 18/10/2024
Mozilla disclosed a bug submitted by ghaazy: https://hackerone.com/reports/2412983 [...]
Beyond Passwords: Advanced API Authentication Strategies for Enhanced Security by Ivan Novikov on 18/10/2024
Passwordless authentication for end users is taking the world by storm, offering organizations and individuals alike unprecedented security, user experience, and efficiency benefits. By all indications, the next generation of authentication for end users has finally arrived, sending the password the way of the dodo. Although they don’t get anywhere near the same hype, advanced authentica [...]
paypal cleient_id And stripe api key indexed on web arcive on 18/10/2024
Mozilla disclosed a bug submitted by ghaazy: https://hackerone.com/reports/2380084 [...]
Race condition leads to add more than 5 email at Data breaches monitor system at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net on 18/10/2024
Mozilla disclosed a bug submitted by sushantd19: https://hackerone.com/reports/1913309 [...]
two aws access key and secret key and database username and password exposed on 18/10/2024
Mozilla disclosed a bug submitted by ghaazy: https://hackerone.com/reports/2401648 [...]
Timeline API returns private post when target of a push notification on 17/10/2024
Automattic disclosed a bug submitted by nightpool: https://hackerone.com/reports/2258950 [...]
Vulnerability Deep Dive: Gaining RCE Through ImageMagick With Frans Rosen by Andrew Pratt on 17/10/2024
Information Leakage via Clicked Link in GitHub Repository (Fingerprinting) on 17/10/2024
GitHub disclosed a bug submitted by pinguluk: https://hackerone.com/reports/2505761 - Bounty: $4000 [...]
Sudanese Brothers Arrested in ‘AnonSudan’ Takedown by BrianKrebs on 17/10/2024
The U.S. government on Wednesday announced the arrest and charging of two Sudanese brothers accused of running Anonymous Sudan (a.k.a. AnonSudan), a cybercrime business known for launching powerful distributed denial-of-service (DDoS) attacks against a range of targets, including dozens of hospitals, news websites and cloud providers. The younger brother is facing charges that could land him life [...]
Bugcrowd's VRT: with Katie Paxton-Fear and Codingo on 17/10/2024
Understanding the Bugcrowd VRT: An Insider's Guide on 17/10/2024
Start 2 hack - The Secrets They Don't Teach You In IT Class on 17/10/2024
Circular based introspetion Query leading to single request denial of service and cost consumption and query cost on api.sorare.com/graphql on 17/10/2024
Sorare disclosed a bug submitted by thebeast99: https://hackerone.com/reports/2048725 [...]
12 incident response metrics your business should be tracking by Anna Hammond on 17/10/2024
If there’s a vulnerability in your systems that cybercriminals could exploit, you’ll want to know about it. Collaborating with people outside your organization to alert you to these issues can be extremely powerful because it allows your business to discover vulnerabilities before malicious hackers do. This approach, known as vulnerability disclosure, requires clear reporting c… [...]
fs.fchown/fchmod bypasses permission model on 16/10/2024
Internet Bug Bounty disclosed a bug submitted by 4xpl0r3r: https://hackerone.com/reports/2590608 - Bounty: $249 [...]
LIVE: Hacking with TryHackMe | Cybersecurity | Pentesting | AppSec | AMA on 16/10/2024
#bugbountytips #hacker #hacking #cybersecurity on 16/10/2024
Google's Mobile VRP Behind the Scenes with Kristoffer Blasiak (Hextree Podcast Ep.1) on 16/10/2024
Cheating at Conkers on 16/10/2024
The men’s world conkers champion is accused of cheating with a steel chestnut. [...]
Safer with Google: Advancing Memory Safety on 15/10/2024
Posted by Alex Rebert, Security Foundations, and Chandler Carruth, Jen Engel, Andy Qin, Core Developers Error-prone interactions between software and memory1 are widely understood to create safety issues in software. It is estimated that about 70% of severe vulnerabilities2 in memory-unsafe codebases are due to memory safety bugs. Malicious actors exploit these vulnerabilities and continue to cr [...]
Bringing new theft protection features to Android users around the world on 15/10/2024
Posted by Jianing Sandra Guo, Product Manager and Nataliya Stanetsky, Staff Program Manager, Android Janine Roberta Ferreira was driving home from work in São Paulo when she stopped at a traffic light. A man suddenly appeared and broke the window of her unlocked car, grabbing her phone. She struggled with him for a moment before he wrestled the phone away and ran off. The incident left her dee [...]
Hackers Abuse MeshCentral for a RAT on 15/10/2024
More Details on Israel Sabotaging Hezbollah Pagers and Walkie-Talkies on 15/10/2024
The Washington Post has a long and detailed story about the operation that’s well worth reading (alternate version here). The sales pitch came from a marketing official trusted by Hezbollah with links to Apollo. The marketing official, a woman whose identity and nationality officials declined to reveal, was a former Middle East sales representative for the Taiwanese firm who had established [...]
Host header injection leads to account takeover on 15/10/2024
Enjin disclosed a bug submitted by ndizon_: https://hackerone.com/reports/1623672 [...]
Race Condition on Create API Function on 15/10/2024
Enjin disclosed a bug submitted by mo_salah12: https://hackerone.com/reports/2682392 [...]
Recon for bug bounty: 8 essential tools for performing effective reconnaissance by novasecio on 15/10/2024
We all know that reconnaissance is important in bug bounty, in fact, it is the most important phase in bug bounty & web app pentesting. Bug bounty hunters who perform effective recon are always rewarded well as they come across untouched features and hidden assets more often than others. This provides them an edge and easily increases their chances of finding security vulnerabi… [...]
NIS2 Directive: The complete guide for in-scope entities by Anna Hammond on 15/10/2024
NIS2 will take effect across the EU from 18th October 2024, meaning time is running out to comply with its provisions. This Directive, replacing NIS1 (2016), strengthens requirements for in-scope sectors to report security incidents and manage risk. In this guide, we’ll summarize which entities will need to comply with the enhanced legislation and the standards they must meet.… [...]
How To Use HackerOne’s Global Vulnerability Policy Map by Michael Woolslayer on 14/10/2024
Use HackerOne's Global Vulnerability Policy Map to keep up with evolving VDP mandates and recommendations. [...]
Upcoming Speaking Engagements on 14/10/2024
This is a current list of where and when I am scheduled to speak: I’m speaking at SOSS Fusion 2024 in Atlanta, Georgia, USA. The event will be held on October 22 and 23, 2024, and my talk is at 9:15 AM ET on October 22, 2024. The list is maintained on this page. [...]
Amazon Paid Hackers $2.1M+ in Bounties (h1-0131 vlog) on 14/10/2024
Perfectl Malware on 14/10/2024
Perfectl in an impressive piece of malware: The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33246, a vulnerability with a severity rating of 10 out of 10 that w [...]
Demo of #bac #hacking #hacker #bugbountytips on 14/10/2024
IDOR vulnerability leads to Deleting message after leaving/getting banned from group using message ID on 13/10/2024
Rocket.Chat disclosed a bug submitted by yash24: https://hackerone.com/reports/2028450 [...]
European Council Adopts Cyber Resilience Act by Ilona Cohen on 11/10/2024
Learn about the EU Council's Cyber Resilience Act, where we're headed, and what we believe should happen next. [...]
Indian Fishermen Are Catching Less Squid on 11/10/2024
Fishermen in Tamil Nadu are reporting smaller catches of squid. Blog moderation policy. [...]
HackerOne Live Hacking Event Recap: Las Vegas w/TikTok on 11/10/2024
More on My AI and Democracy Book on 11/10/2024
In July, I wrote about my new book project on AI and democracy, to be published by MIT Press in fall 2025. My co-author and collaborator Nathan Sanders and I are hard at work writing. At this point, we would like feedback on titles. Here are four possibilities: Rewiring the Republic: How AI Will Transform our Politics, Government, and Citizenship The Thinking State: How AI Can Improve Democracy B [...]
SAML Signature verification bypass allows logging into any user (with specific conditions) on 10/10/2024
GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/2579939 - Bounty: $25000 [...]
Measure Your AI Risk Preparedness with This Interactive Self-Assessment Tool by Naz Bozdemir on 10/10/2024
Learn how HackerOne's AI Risk Readiness Self-Assessment Tool helps measure your AI security and compliance preparedness. [...]
Auditing Gradio 5, Hugging Face’s ML GUI framework by Trail of Bits on 10/10/2024
This is a joint post with the Hugging Face Gradio team; read their announcement here! You can find the full report with all of the detailed findings from our security audit of Gradio 5 here. Hugging Face hired Trail of Bits to audit Gradio 5, a popular open-source library that provides a web interface that lets machine learning (ML) developers quickly showcase their models. Based on our findings a [...]
Using Chrome's accessibility APIs to find security bugs on 10/10/2024
Posted by Adrian Taylor, Security Engineer, Chrome .code { font-family: "Courier New", Courier, monospace; font-size: 11.8px; font-weight: bold; background-color: #f4f4f4; padding: 2px; border: 1px solid #ccc; border-radius: 2px; white-space: pre-wrap; display: inline-block; line-height: 12px; } .highlight { color: red; } Chrome’s [...]
Report Writing Explained: with Katie Paxton-Fear and Codingo on 10/10/2024
Get Bigger Bounties With Better Reports on 10/10/2024
Bug Bounty Q&A with Jhaddix & Blaklis on 10/10/2024
Bruteforcing Windows Defender Exclusions on 10/10/2024
The Recruitment Process: What to Expect When You Apply at HackerOne by Marina Briones on 09/10/2024
DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server on 09/10/2024
GitLab disclosed a bug submitted by a92847865: https://hackerone.com/reports/2499070 [...]
LIVE: Hacking with TryHackMe | Cybersecurity | Pentesting | AppSec | AMA on 09/10/2024
Lamborghini Carjackers Lured by $243M Cyberheist by BrianKrebs on 09/10/2024
The parents of a 19-year-old Connecticut honors student accused of taking part in a $243 million cryptocurrency heist in August were carjacked a week later — while out house-hunting in a brand new Lamborghini. Prosecutors say the couple was beaten and briefly kidnapped by six young men who traveled from Florida as part of a botched plan to hold the parents for ransom. Image: ABC7NY. youtube [...]
Pentesting for Internal Networks by Paul De Baldo V on 09/10/2024
Learn how to optimize internal network pentesting through community-driven pentesting as a service (PTaaS). [...]
Subdomain takeover in Gitlab pages on 09/10/2024
GitLab disclosed a bug submitted by fdeleite: https://hackerone.com/reports/2523654 [...]
Remote code execution [CVE-2023-36845] on 09/10/2024
MTN Group disclosed a bug submitted by m4lc0lmx: https://hackerone.com/reports/2182202 [...]
REAL Ransomware Chat Logs on 09/10/2024
Choosing the Right Deployment Option for Your API Security Solution by Raymond Kirk on 09/10/2024
You need an API security solution. That much is a given (although some may argue it isn’t!). While essential for business growth and innovation, APIs, or Application Programming Interfaces, expose the organizations that use them to cyber threats. Attackers are both aware of and actively exploiting this fact: Wallarm recently revealed that attacks on APIs impacted 98.35 million users in Q2 2024. [...]
Change phone number OTP flaw leads to any phone number takeover on 09/10/2024
inDrive disclosed a bug submitted by polem4rch: https://hackerone.com/reports/2588329 - Bounty: $2000 [...]
Challenges with IP spoofing in cloud environments on 09/10/2024
This post explores the risks and challenges of IP spoofing in cloud environments, particularly in setups using reverse proxies. It outlines various mitigation strategies to ensure accurate client IP identification for security purposes. [...]
Patch Tuesday, October 2024 Edition by BrianKrebs on 08/10/2024
Microsoft today released security updates to fix at least 117 security holes in Windows computers and other software, including two vulnerabilities that are already seeing active attacks. Also, Adobe plugged 52 security holes across a range of products, and Apple has addressed a bug in its new macOS 15 “Sequoia” update that broke many cybersecurity tools. One of the zero-day flaws [...]
How an IDOR Vulnerability Led to User Profile Modification by Andrew Pratt on 08/10/2024
Learn the ins and outs of IDOR vulnerabilities and how one exploitation led to malicious user profile modification. [...]
Path traversal in AcitveStorage, and lead RCE on 08/10/2024
Ruby on Rails disclosed a bug submitted by ooooooo_q: https://hackerone.com/reports/2334455 [...]
Sauce Labs API key unencrypted in an old commit on 08/10/2024
Ruby on Rails disclosed a bug submitted by trufflesecurity: https://hackerone.com/reports/1302395 [...]
HTML injection possible with soft email confirmations when Administrator manually confirms attacker email address on 08/10/2024
GitLab disclosed a bug submitted by cryptopone: https://hackerone.com/reports/1935628 - Bounty: $1060 [...]
Maintainer can leak sentry token by changing the configured URL (fix bypass) on 08/10/2024
GitLab disclosed a bug submitted by 70rpedo: https://hackerone.com/reports/2104591 [...]
ReDoS due to device-detector parsing user agents on 08/10/2024
GitLab disclosed a bug submitted by afewgoats: https://hackerone.com/reports/1772063 [...]
Github Intentionally Lets You Read Deleted & Private Commits on 08/10/2024
User API Key leakage in Github commit leads to unauthorized access to sql.telemetry.mozilla.org on 08/10/2024
Mozilla disclosed a bug submitted by anhchangmutrang: https://hackerone.com/reports/2735646 [...]
This Bug Got Me A $30,000 Bounty on 07/10/2024
Three Ways to Hack Mobile Apps on 07/10/2024
IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage. on 05/10/2024
MTN Group disclosed a bug submitted by hazemhussien99: https://hackerone.com/reports/1773609 [...]
Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=<VULNERABLE> on 05/10/2024
MTN Group disclosed a bug submitted by hazemhussien99: https://hackerone.com/reports/2039384 [...]
HackerOne Live Hacking Event Recap: Miami w/ Capital One on 04/10/2024
Start Web App Pentesting for Free on 04/10/2024
External service interaction (HTTP) on 04/10/2024
AWS VDP disclosed a bug submitted by hesham_elsheme: https://hackerone.com/reports/2731133 [...]
SSRF via host header let access localhost via https://go.dialexa.com on 03/10/2024
IBM disclosed a bug submitted by mersa-v6: https://hackerone.com/reports/2696271 [...]
Pixel's Proactive Approach to Security: Addressing Vulnerabilities in Cellular Modems on 03/10/2024
Posted by Sherk Chung, Stephan Chen, Pixel team, and Roger Piqueras Jover, Ivan Lozano, Android team Pixel phones have earned a well-deserved reputation for being security-conscious. In this blog, we'll take a peek under the hood to see how Pixel mitigates common exploits on cellular basebands. Smartphones have become an integral part of our lives, but few of us think about the complex softwar [...]
Interview with a hacker kevtech IT support on 03/10/2024
Evaluating Mitigations & Vulnerabilities in Chrome on 03/10/2024
Posted by Alex Gough, Chrome Security Team The Chrome Security Team is constantly striving to make it safer to browse the web. We invest in mechanisms to make classes of security bugs impossible, mitigations that make it more difficult to exploit a security bug, and sandboxing to reduce the capability exposed by an isolated security issue. When choosing where to invest it is helpful to consider [...]
A Single Cloud Compromise Can Feed an Army of AI Sex Bots by BrianKrebs on 03/10/2024
Organizations that get relieved of credentials to their cloud environments can quickly find themselves part of a disturbing new trend: Cybercriminals using stolen cloud credentials to operate and resell sexualized AI-powered chat services. Researchers say these illicit chat bots, which use custom jailbreaks to bypass content filtering, often veer into darker role-playing scenarios, including child [...]
They Say This Malware is INSANE on 03/10/2024
LIVE: Practical Junior Security Analyst (PJSA) Launch | Blue Team | Cybersecurity | Programming on 02/10/2024
Stored-XSS-ads.tiktok.com on 02/10/2024
TikTok disclosed a bug submitted by ahmed_xyz: https://hackerone.com/reports/2306491 [...]