The 5 Hacking NewsLetter 107
Posted in Newsletter on May 27, 2020
Posted in Newsletter on May 12, 2020
Hey hackers! These are our favorite resources shared by pentesters and bug hunters last week.
This issue covers the week from 01 to 08 of May.
This article revisits a known technique for decrypting TLS traffic of mobile apps. It shows why Man-in-The-Middle is not always the best method, since bypassing certificate pinning or client certificate authentication can be complicated.
The idea is to use Frida to steal the session key, sniff traffic with Wireshark and decrypt it in real time by providing Wireshark with the session key, and finally import the requests to Burp using the PDML importer for Burp Suite.
DOM XSS in Gmail with a little help from Chrome (Google, $5,000)
This is a cool DOM XSS found in Gmail. So, no recon, no looking for obscure or forgotten subdomains. @opnsec used the main site, focused on the postMessage API and understanding how the different iframes communicate with each other.
He used postMessage-logger to make cross-frames messages visible in DevTools, and analyzed the different requests and JS code to get a working PoC.
Moral of the story: DOM XSS is still a thing, complicated front-end code like Gmail’s won’t be confusing if you know exactly what to focus on (e.g. postMessage), and if DevTools is lacking a feature, develop your own extension!
The first one is an interview of @albinowax. Anyone interested in Web app hacking, bug bounty or security research should watch it. He talk about his learning process, how he leverages automation and bug bounty for research, how he chooses research topics, etc.
The second video is a talk by @InsiderPhD on API hacking. She shares her approach, the bugs to look for, with demonstrations using a custom vulnerable API.
Transformations is a new tool by @jobertabma that helps find out how inputs are transformed by Web apps. For instance, let’s say that a server responds with
c1aa46d751f1ffa58481418667134109ac5f573c, when you give it
test. Feeding both strings to the tool will tell you that the transformations performed are
This can be useful for building payloads that bypass WAFs, or understanding seemingly random strings.
Hackluke’s hacking advice:
- How to ACTUALLY get started with bug bounties
- How to pick your first bug bounty program
- What tools can you use to find critical vulnerabilities easily?
- Do you need to be able to code to find bug bounties?
- Which vulnerability should you learn first?!
- What are the best resources for beginner hackers?
- COMMUNITY. IS. IMPORTANT.
- There is such thing as too much recon
- How to stop finding duplicates
- Abusing the “first mover advantage” in bug bounties
- One of my best hacking tips: NEVER ASSUME ANYTHING!
These are the sweetest tips for bug hunters. @hakluke started tweeting short videos, each answering a specific question like the ones above. I love that he tells concise, no BS truths, in a light tone, the way only a real friend would do.
Make sure to follow him on Twitter to get any new ones!
See more writeups on The list of bug bounty writeups.
Salt framework security flaws used to attack multiple targets
CAM4 adult cam site exposes 11 million emails, private chats
GoDaddy hack: Miscreant goes AWOL with 28,000 users’ SSH login creds after vandalizing server-side file
Hackers sell stolen user data from HomeChef, ChatBooks, and Chronicle: They also claim hacks of Microsoft’s private github repos, Tokopedia & Unacademy
Hackers breach company’s MDM server to spread Android malware
Now we know what the P really stands for in PwC: X-rated ads plastered over derelict corner of accountants’ website
New Kaiji malware targets IoT devices via SSH brute-force attacks
Game patch gives hackers access to development content on Amazon S3
A passwordless server run by NSO Group sparks contact-tracing privacy concerns
We created a collection of our favorite pentest & bug bounty related tweets shared this past week. You’re welcome to read them directly on Twitter: Tweets from 05/01/2020 to 05/08/2020.
Have a nice week folks!
If you enjoyed reading this, please consider sharing it, leaving a comment, suggestions, questions…