Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series is curated by Mariem, better known as PentesterLand. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.
This issue covers the week from July 19 to 26.
Our favorite 5 hacking items
1. Conference of the week
Traversing My Way in the Internal Network – Jasmin Landry (@JR0ch17)
What do you think when you see “?id=1337” in a HTTP request? If it is only IDOR or SQL injection, you will love this talk. @JR0ch17 demonstrates that when microservices are involved, there is much more that can be tested such as path traversal.
2. Writeups of the week
Github access token exposure (Shopify, $50,000)
Guest Blog Post – Attacking the DevTools (Microsoft, $36,000)
Pre-Auth RCE in ManageEngine OPManager
How I Found Multiple Bugs On FaceBook In 1 Month And a Part For My Methodology & Tools (Facebook)
Four beautiful findings:
- A Shopify employee’s Github Access Token @auguzanellato found while reviewing a public MacOS app and the $50K bounty that ensued.
- A writeup packed with information on the attack surface of DevTools and $36K of issues @david_erceg found in Edge.
- A nice pre-auth RCE via deserialization Johannes Moritz and Robin Peraglie found in ManageEngine OPManager.
- @GodfatherOrwa‘s methodology for finding multiple critical bugs on Facebook in one month.
3. Article of the week
Forgot password? Taking over user accounts Kaminsky style & DNS Reset Checker
Remember 2008 when Dan Kaminsky broke DNS? Well, @sec_consult researcher Timo Longin found out that some Web apps are still vulnerable.
He tested for two DNS attacks (Kaminsky and IP fragmentation attacks) on 146 apps and was able to successfully manipulate the DNS name resolution of some of these apps. This meants that “Forgot password” features could be exploited to steal password reset URLs and take over accounts.
4. Tutorial of the week
How to achieve enterprise-grade attack-surface monitoring with open source software
In this tutorial, @hakluke shows how to make the most of the open source SpiderFoot version to monitor assets with change notifications.
One of the tools mentioned is Datasette. It’s worth knowing about if you store bug bounty data using SQLite and want to turn it into a Web interface with a JSON API.
I was looking for something like this and didn’t know it existed.
5. Resource of the week
This is a blog I’ve just discovered that has so much good content on Web security. Here are a few examples:
Note that (for me at least) not all posts are visible when browsing the site. So, I’d recommended using an RSS reader to access all the content that is there.
Other amazing things we stumbled upon this week
Medium to advanced
Responsible(ish) disclosure writeups
Bug bounty writeups
See more writeups on The list of bug bounty writeups.
- wbk: Advanced waybackurls
- hakcertstream: Basic implementation of certstream to print new subdomains and domains
- Bughound & Intro: Static code analysis tool based on Elasticsearch
- MAN-SPIDER: Spider entire networks for juicy files sitting on SMB shares. Search filenames or file content – regex supported!
- 5GC_API_parse: A BurpSuite extension to parse 5GC NF OpenAPI 3.0 files to assess 5G core networks
Misc. pentest & bug bounty resources
Bug bounty & Pentest news
- Bug bounty
- Upcoming events
- Tool updates
Community pick of the week
Well done on the “draw our logo” competition Th4nu_0x0! Enjoy your swag 😎
If you want some too, make sure to participate in our ongoing XSS challenge. Also tag us on social media to share your own bug hunting wins and joys, we love hearing from you!