Sponsored by

The 5 Hacking NewsLetter 29

Posted in Newsletter on November 27, 2018

The 5 Hacking NewsLetter 29

Hey hackers! These are our favorite resources shared by pentesters and bug hunters last week.

This issue covers the week from 16 to 23 of November.

On a personal note, really sorry for the delay. I’ve been under the weather and am still recovering. I’m also working on a training course and a new very exciting project. So there may be less articles (than usual) published in the next few weeks.

Our favorite 5 hacking items

1. Slides of the week

Bug bounty funshop

This is a great presentation for both web app pentesters & bug hunters. It presents a lot of tools, techniques and tips around recon, Burp Suite, reporting, testing mobile apps, etc.

I devoured it in order to add anything new to my current methodology. Hopefully, the video will be made public too.

2. Tool of the week

Lazyrecon fork

The original Lazyrecon is a Bash script by @nahamsec to automate reconnaissance. It creates a dated folder with recon notes, does subdomain enumeration, screenshots, port scanning, file/directory brute-force, etc.

This fork by @plenumlab builds on these features and adds other useful ones: notifications for potential NS subdomain takeover, subdomain enumeration with massdns, finds target’s IP address space and dead DNS records…

This is a good tool to use as is, or to analyze and maybe get new ideas for improving your own recon tools.

3. Writeup of the week

Authentication bypass on NodeSJ app (private program)

This is an interesting authentication bypass, due to SQL injection on a JavaScript app.

The app expects this kind of POST data: {“username”:”bl4de”,”password”:”secretpassword”}. Poking with it showed that:

  • {“username”:[[]],”password”:”secretpassword”} triggers a MySQL error typical of SQL injection
  • {“username”:[0],”password”:”secretpassword”} triggers a request to port 21110 with an Authorization header (for Basic auth) including secretpassword and the username super.adm. But the password is rejected
  • {"username":[0,1,2,30,50,100],"password":"secretpassword"} allows enumerating other usernames (but password still rejected)
  • {“username”:[0],”password”:true} triggers a request to port 21110 resulting in successful authentication as the super.adm user!

4. Tutorial of the week

Browsing the Internet While Using Burp Suite: and Other Productivity Hacks

Do you use the same browser instance to browse the Internet while doing tests and intercepting all requests with Burp? If yes, this tutorial is for you! Leverage Chrome browser profiles to run multiple instances at the same time: One for testing, one normal browsing, one for sensitive sites (like banking apps)…

I’ve been doing this for years with the Profile Switcher extension. I prefer Firefox to Chrome, but this extension is incompatible with the latest versions of Firefox.
If you know an equivalent and up-to-date Firefox extension, please share it with us!

5. Conference of the week

NDC Sydney 2018, especially:

I love these two talks! The first one is about advanced bugs that have become very popular in the bug bounty world (template injection, web cache poisoning, XXE, XSLT, SSRF…).
They are less known than XSS, SQL injection, open redirect, etc, but can have serious impacts and be highly rewarded.

The second one is almost an hour full of tips to help you decide if remote work is something for you or not, and how to navigate it successfully. A must watch if you’re considering remote work!

Other amazing things we stumbled upon this week




Slides only


Medium to advanced

Beginners corner


Pentest & Responsible disclosure writeups

Bug bounty writeups

See more writeups on The list of bug bounty writeups.


If you don’t have time

  • Asnlookup: Look up IP addresses (IPv4 & IPv6) registered and owned by a specific organization for reconnaissance purposes (Integrated to Lazyrecon)
  • BurpelFish: Burp extension that adds Google Translate to Burp’s Context Menu. Useful for testing sites in foreign languages
  • findsubdomains.py: Output all the data from https://findsubdomains.com/ into a JSON structure

More tools, if you have time

Misc. pentest & bug bounty resources


Yet another memory leak in ImageMagick or how to exploit CVE-2018–16323.


Full account takeover … will be rewarded an average bounty of:

  • $40,000 if user interaction is not required at all, or
  • $25,000 if minimum user interaction is required. we will not require a full exploit chain in cases where leveraging the vulnerability requires bypassing our Linkshim mechanism.

By finding as few as 3 flags, you’ll automatically be added to the priority invitation queue for private program invitations and will receive one the following day. For every 26 points you earn on the CTF, you’ll receive another invitation

Non technical

Tweeted this week

We created a collection of our favorite pentest & bug bounty related tweets shared this past week. You’re welcome to read them directly on Twitter: Tweets from 11/16/2018 to 11/23/2018

Have a nice week folks!

If you enjoyed reading this, please consider sharing it, leaving a comment, suggestions, questions…