Bug Bounty & Agile Pentesting Platform

Bug Bytes #159 – GitBleed, BigQuery SQL injection & Salesforce Recon and Exploitation Toolkit

Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series is curated by Mariem, better known as PentesterLand. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.

This issue covers the week from February 07 to 14.

Intigriti news

Our favorite 5 hacking items

1. Article of the week

GitBleed – Finding Secrets in Mirrored Git Repositories & GitBleed Tools

@nightwatchcyber noticed that tools that scan for secrets in Git repositories will miss some secrets if they clone repos without the --mirror option.
They share how to looks for these secrets, some Bash scripts that automate the process and a couple of intentionally vulnerable repos.

2. Writeup of the week

BigQuery SQL Injection Cheat Sheet ($50k+)

@ozgur_bbh and @anilyukk discovered and exploited a BigQuery SQL injection on a bug bounty target. They share the syntax and queries they used, which is valuable considering the lack of resources on SQL injections targetting this specific type of DBMS.

3. Tutorial of the week

Bypassing the AWS WAF protection with an 8KB bullet

@riyazwalikar describes a known limitation of AWS WAF: It only inspects the first 8KB of the web request body. This allows bypassing AWS WAF by placing payloads after 8KB of junk data.
Actually, this issue is not new. @securityfu wrote about it in AWS WAF’s Dangerous Defaults, but this tutorial serves as a good reminder of this interesting behavior.

4. Tool of the week

Salesforce Recon and Exploitation Toolkit (SRET) & Intro

While learning about Salesforce vulnerabilities, @uraniumhacker created this tool to automate testing for and exploiting misconfigurations in Salesforce instances.
He used it to report multiple Critical and High impact information disclosure bugs.

5. Non technical item of the week

It is Okay to Use Writeups

Being stuck on a challenge for too long can result in loosing interest or unnecessarily wasting time in one’s learning journey. So, if you are struggling with Hack The Box machines/challenges or certifications like the OSCP, make sure to read and apply this advice by @ippsec and @0xdf_.
It will help you make consistent progress, and know when to try harder and when to look at solutions.

Other amazing things we stumbled upon this week

Videos

Podcasts / Audio

Webinars

Conferences

Tutorials

Writeups

Challenge writeups

Responsible(ish) disclosure writeups

Bug bounty writeups

See more writeups on The list of bug bounty writeups.

Tools

Tips & Tweets

Misc. pentest & bug bounty resources

Articles

Challenges

Bug bounty & Pentest news

Non technical

 

%d bloggers like this: