Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series is curated by Mariem, better known as PentesterLand. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.
This issue covers the week from July 12 to 19.
Our favorite 5 hacking items
1. Article of the week
You should turn off autofill in your password manager
@marektoth explored the autofill function of popular password managers. The results are not reassuring: “It is possible to steal the saved login credentials from 11 of the 16 tested browsers and password managers in one mouse click.”.
This is worth knowing both as users (TL;DR: disable the autofill function) and hackers (XSS can be exploited to abuse the autofill feature and steal login credentials).
2. Writeups of the week
Remote code execution in cdnjs of Cloudflare (Cloudflare)
Diving into Dependabot along with a bug in npm (GitHub, $8,117)
@ryotkak discovered a Remote Code Execution via Path traversal on Cloudflare’s cdnjs CDN library. It could have allowed attackers to tamper with 12.7% of all websites on the Internet.
Another interesting finding is @tyage‘s SSRF on GitHub’s Dependabot and RCE in npm. It reads like an investigation starting with the observation that Dependabot is enabled by default and can make commits on many repositories.
3. Tool of the week
@vortexau‘s CDN is a Python script that compiles a list of subnets for major CDN and WAF providers. It runs every day and outputs results into a YAML file that you can use to quickly identify whether an IP belongs to a CDN of WAF.
This is a timesaver. I love this kind of tool/repo where the work is done once and everyone benefits from it.
4. Resources of the week
Full-time bug hunter @ajxchapman launched a new training platform for bug hunters called bughuntr.io. Currently, it has 13 attack scenarios related to Web and Container/Docker hacking. They are free and range from beginner to expert level.
This is one platform I’m keeping an eye on as more scenarios, premium content and training are planned.
5. Non technical item of the week
Should you do Bug Bounties for a Living?
@codingo_ shares some interesting questions to consider before taking the plunge into full-time bug hunting. This is must reading if you’re thinking about it and want to maximize your chances of success.
Other amazing things we stumbled upon this week
Medium to advanced
Responsible(ish) disclosure writeups
0-day & N-day vulnerabilities
Bug bounty writeups
See more writeups on The list of bug bounty writeups.
- cent: Community edition nuclei templates, a simple tool that allows you to organize all the Nuclei templates offered by the community in one place
- ppfuzz: Rust tool to scan for prototype pollution
- requests-ip-rotator: A Python library to utilize AWS API Gateway’s large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing
- SimpleAutoBurp: Python script to run burp scans from CLI using Burp’s REST API
- Lepus: Python tool for enumerating subdomains, checking for subdomain takeovers and performing port scans
Misc. pentest & bug bounty resources
Bug bounty & Pentest news
- Bug bounty
- Upcoming events
- Tool updates
Community pick of the week
Awesome! Enjoy your well-deserved vacation alicanact60 ⛱️
We love seeing you enjoy your bug bounty life! If you too have wins, swag and joys to share with other Bug Bytes readers, tag us on social media.