Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series are curated by Mariem, better known as PentesterLand. Every week, she keeps us updated with a comprehensive list of all write-ups, tools, tutorials and resources we should not have missed.
Hey hackers! These are our favorite resources shared by pentesters and bug hunters last week.
This issue covers the week from 10 to 17 of May.
The real impact of an Open Redirect
Open redirects are often considered low impact bugs by bug bounty programs (including Google). As such, they are not rewarded unless they can be used to exploit other vulnerabilities like XSS or OAuth token disclosure. So you want to increase their impact by chaining them with other bugs.
Also, if you’re a pentester not a bug bounty hunter, the same logic applies. If you want to convince clients which bugs are the most damaging and must absolutely be fixed, you need to tell them why by providing detailed attack scenarios.
This article can help. It shows how to combine open redirect with Referrer check bypass, XSS-Auditor bypass, SSRF & OAuth token theft.
Think Outside the Scope: Advanced CORS Exploitation Techniques ($1,500)
This an excellent writeup of two CORS misconfigurations and how to exploit them in great detail (with code, PoCs, specifics of each browser, other good references…).
Highly recommended if you want to see practical examples of real-life CORS vulnerabilities.
Common API security pitfalls
This is an awesome presentation on API security. If you’re into this, make sure to watch the video to better understand the slides. I didn’t realize there was a video embedded in the page at first…
The bugs described include the lack of rate-limiting, IDOR, session flaws, mishandling client-side session data, JWT weaknesses, CSRF, CORS misconfigurations and more. Juicy stuff!
Key lessons from an ethical hacker
I found this article really interesting because it is a walkthrough of the pentest of a power station. Personally, I find physical pentests & red teaming fascinating specifically because I lack experience in this area (having done mostly “regular” pentests).
This walkthrough touches on many things including why not phishing is not always the best approach, a concrete example of recon (different from recon done for Web app testing), how to convince boards of the importance of security, etc.
It’s probably nothing new if you’re already doing these kinds of tests, but it’s a nice high-level view for anyone who’s striving to become a pentester.
SameSite cookies in practice
Have you heard of Samesite cookies recently and wondered what they are? If yes, this is a great introduction to this relatively new cookie attribute.
It’s a protection against CSRF and it seems very effective. I think we will see less and less CSRF bugs in bug bounty.
So check out this tutorial if you’re into Web app security.
Time to celebrate! We reached the 5k twitter followers! As a celebration, we made a new XSS challenge. Are you able to solve it?
NEW CHALLENGE: We're giving away a Burp Pro license, swag & invites to celebrate 5k followers! 🤩💙 Claim your prize: 👉 https://t.co/KYQHSOpGvn #BugBounty #CTF #HackWithIntigriti pic.twitter.com/h2jDTM3qos
— Intigriti (@intigriti) May 21, 2019
Medium to advanced
Beginners corner
Responsible disclosure writeups
Bug bounty writeups
See more writeups on The list of bug bounty writeups.
Match and Replace: Script used to automatically generate JSON option file to BurpSuite. Useful for SSRF testing
Pyscripter_utils.py : Burp Python Scripter scripts & Why use it’s not redundant with Match and Replace rules
DS_Store_crawler_parser: A parser + crawler for .DS_Store files exposed publically
Grepips.py: Little Python script to dump IP addresses from a file
jwt_tool: The JSON Web Token Toolkit, A toolkit for testing, tweaking and cracking JSON Web Tokens
Gitmail: Quickly grab a GitHub users email from commits, even when their email privacy is enabled
Crosslinked: LinkedIn enumeration tool to extract valid employee names from an organization through search engine scraping. Names can be formatted in a defined naming convention for further security testing
Trigmap: A wrapper for Nmap to automate the pentest
ExtAnalysis: Browser Extension Analysis Framework
SCWF: CTF tool for identifying, brute forcing and decoding encryption schemes in an automated way
LES: Linux privilege escalation auditing tool
EITR: Automates the deployment and provisioning of a remote host to be used for pentesting labs and CTF games, such as HackTheBox and VulnHub
PeekABoo: Enables Remote Desktop on targets using PowerShell. Useful for internal penetration testing
Muraena: An almost-transparent reverse proxy aimed at automating phishing and post-phishing activities
Articles
We created a collection of our favorite pentest & bug bounty related tweets shared this past week. You’re welcome to read them directly on Twitter: Tweets from 05/03/2019 to 05/10/2019.
Subscribe to the newsletter here!
Disclaimer:
The views and opinions expressed in this article are those of the curators and do not necessarily reflect the position of intigriti.Curated by Pentester Land & Sponsored by Intigriti
