Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series is curated by Mariem, better known as PentesterLand. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.
This issue covers the week from 22 to 29 of May.
@JobertAbma Talks about HackerOne, Entrepreneurship, Hacking, Bug Bounties and his recon approach!
@JobertAbma’s story is fascinating. As a hacker and entrepreneur myself, I hung on his every word during this deliciously long interview. He tells the backstory of HackerOne, how he started this successful business with @michielprins while being a student and still finding the time to hack, his hacking process, and much much more!
– Zero-day in Sign in with Apple (Apple, $100,000)
– My Expense Report resulted in a Server-Side Request Forgery (SSRF) on Lyft (Lyft)
Read the first writeup if you want to see what a $100,000 bug looks like. It’s surprisingly easier (to understand at least) than one might think: “Sign in with Apple” had a flaw that allowed for generating valid JWTs for any Email ID. This resulted in account takeover on any apps using Apple’s sign-in functionality.
The second writeup’s video is nice to watch if you need inspiration for hacking. The bug is an SSRF affecting the WeasyPrint PDF generator. @NahamSec talked about it before, but it’s lots of fun to watch hackers hacking Lyft while taking Lyft rides!
RandoriSec Mobile Hacking Workshop – iOS & Android
@RandoriSec have a track record of sharing awesome mobile hacking resources. This time, they released slides and material used for BSides Budapest 2020 workshops. This includes intentionally vulnerable apps for practicing, and slides providing theory and steps to solve the challenges.
An excellent opportunity to get into mobile hacking!
Android app vulnerability classes
This is a valuable resource for anyone interested in Android app hacking or in the Google bug bounty program. The document provides an overview of the program’s 19 most commonly reported vulnerabilities, with auditing and remediation tips.
Because this is about bug bounty, the bugs described are the type that will earn you bounties, not just good security practices or low-impact bugs. So, definitely worth a read!
My self-help guide to making sense of a confusing world
How can one avoid being deceived by fake news and disinformation campaigns? This is a question @halvarflake asked himself. His answer comes in the form of a long article detailing 7 habits he came up with to regularly examine his own beliefs.
This piece might seem too theoretical but actually provides an excellent framework for critical thinking and practicing self-critique, which is essential in these turbulent times.
See more writeups on The list of bug bounty writeups.
BurpIntruderDownloader/extract.py & Extracting files from Burp Intruder Output
DNSObserver & Intro: A handy DNS service written in Go to aid in the detection of several types of blind vulnerabilities. It monitors a pentester’s server for out-of-band DNS interactions and sends lookup notifications via Slack
httpx: A fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads
Elevate: Vertical Domain Discovery
Needle: Instant access to you bug bounty submission dashboard on various platforms + publicly disclosed reports + #bugbountytip
Ligolo: Reverse Tunneling made easy for pentesters, by pentesters
EXCELntDonut: XLM (Excel 4.0) Macro Generator for Phishing Campaigns
Cillian-Collins/subscraper: Recon tool which scans JavaScript files for subdomains & then iterates over all JS files hosted on subsequent subdomains to enumerate a list of subdomains for a given URL
ParamCleaner: Removes duplicate entries from a file, resulting in only unique parameter combinations. Useful for parsing waybackurls and making recon more effective
CorsMe: Cross Origin Resource Sharing MisConfiguration Scanner
Kalu: Keeping ArchLinux Up-to-date
RepoPeek: Python script to get details about a repository without cloning it
Kubetap: Kubectl plugin to interactively proxy Kubernetes Services with ease
Waybackcollector & How it differs from existing tools like Waybackurls & GAU: Fetch wayback machine historical content for a given url
imran-parray/paramReplacer.py: ython script which replaces the parameter values in target URL’s with your desired input, for fuzzing & mass testing
S3BucketList: Firefox plugin that lists Amazon S3 Buckets found in requests
go-windapsearch: Utility to enumerate users, groups and computers from a Windows domain through LDAP queries
apkLeaks: Scanning APK file for URIs, endpoints & secrets
We created a collection of our favorite pentest & bug bounty related tweets shared this past week. You’re welcome to read them directly on Twitter: Tweets from 05/22/2020 to 05/29/2020.
