Bug Bytes #181 - SpookySSL, XSSHunter depreciated, and how to get a CVE

Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.

This issue covers the weeks from October 31st until November 6th.

CLICK HERE TO SUBSCRIBE

Intigriti News

From my notebook

This week I’ve been rather chaotic in what I’ve been reading and watching, so this week’s top 5 resources are all around the theme of data-driven bug hunting. What I mean by this is using large amounts of data from things like disclosed reports or write-ups to try and understand larger trends in what bugs are common or uncommon, where to look, or how to change your bug-hunting style.

A graph with an arrow pointing to a list with an arrow pointing to a brain and a final arrow pointing to bugs
the text reads "Data driven bug hunting" — Data-driven bug hunting

What I learnt from reading 217* Subdomain Takeover bug reports. – I love this article, I love how the author has really dived deep into the data to really try to understand it, I especially like their analysis of platforms for subdomain takeovers and key takeaways. Well worth a read!
Exploiting Static Site Generators: When Static Is Not Actually Static – Honestly, every time I see a new Assetnote blog post I read it immediately, they are always full of really interesting and unique security research, and this is a great look into why static sites aren’t always as static as they look!
How I made a reliable hacking tools and resources search engine in two days (~6500 entries!) – IppSec.rocks but for GitHub tools! Highly recommend this if you’re trying to figure out if your amazing new tool you’re about to spend 100 hours making already exists.
Awesome Cyber Security Newsletters – Awesome lists are fairly common around the tech community, this awesome list is of cyber security newsletters if you’re looking for curated content with a slightly different vibe.
XSS Hunter gets depreciated, new sign-ups are disabled, xss.ht domains can be redirected to local instances or a static payload until Feb 2023 and the announcement – XSS Hunter (the service) is shutting down, while you can host your own XSS Hunter (the product), new sign-ups are disabled and xss.ht domains will only be able to redirect or have a static XSS payload. Most people who’ve worked on the triage or client side of bug bounty hunting understand why, but XSS Hunter has a lot of confidential vulnerability information, and IAmMandatory is uncomfortable with this.
CVE demystified, a quick guide to get your own CVE. – CVEs can be great social proof of your hacking skills, so here’s how to get one!