Bug Bytes #159 – GitBleed, BigQuery SQL injection & Salesforce Recon and Exploitation Toolkit

By Anna Hammond

February 16, 2022

Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series is curated by Mariem, better known as PentesterLand. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.


This issue covers the week from February 07 to 14.

Intigriti news

Apply for an exclusive virtual hacking experience focused on Intel® Software Guard Extensions (Intel® SGX)

Intigriti Goals

Our favorite 5 hacking items

1. Article of the week

GitBleed – Finding Secrets in Mirrored Git Repositories & GitBleed Tools

@nightwatchcyber noticed that tools that scan for secrets in Git repositories will miss some secrets if they clone repos without the --mirror option.
They share how to looks for these secrets, some Bash scripts that automate the process and a couple of intentionally vulnerable repos.

2. Writeup of the week

BigQuery SQL Injection Cheat Sheet ($50k+)

@ozgur_bbh and @anilyukk discovered and exploited a BigQuery SQL injection on a bug bounty target. They share the syntax and queries they used, which is valuable considering the lack of resources on SQL injections targetting this specific type of DBMS.

3. Tutorial of the week

Bypassing the AWS WAF protection with an 8KB bullet

@riyazwalikar describes a known limitation of AWS WAF: It only inspects the first 8KB of the web request body. This allows bypassing AWS WAF by placing payloads after 8KB of junk data.
Actually, this issue is not new. @securityfu wrote about it in AWS WAF’s Dangerous Defaults, but this tutorial serves as a good reminder of this interesting behavior.

4. Tool of the week

Salesforce Recon and Exploitation Toolkit (SRET) & Intro

While learning about Salesforce vulnerabilities, @uraniumhacker created this tool to automate testing for and exploiting misconfigurations in Salesforce instances.
He used it to report multiple Critical and High impact information disclosure bugs.

5. Non technical item of the week

It is Okay to Use Writeups

Being stuck on a challenge for too long can result in loosing interest or unnecessarily wasting time in one’s learning journey. So, if you are struggling with Hack The Box machines/challenges or certifications like the OSCP, make sure to read and apply this advice by @ippsec and @0xdf_.
It will help you make consistent progress, and know when to try harder and when to look at solutions.


Other amazing things we stumbled upon this week


Podcasts / Audio





Challenge writeups

Responsible(ish) disclosure writeups

Bug bounty writeups

See more writeups on The list of bug bounty writeups.


Tips & Tweets

Misc. pentest & bug bounty resources



Bug bounty & Pentest news

Non technical

You may also like