Hey hackers! These are our favorite resources shared by pentesters and bug hunters last week.

This issue covers the week from 21 to 28 of December.

Also, I wish you and your family a very happy new year, full of bugs, bounties, fun, health & happiness!

Our favorite 5 hacking items #

1. Tip of the week #

I love the technical tricks for bug hunters that @intigriti shares on Twitter. I regularly add them to the tweets collection at the end of this newsletter.

But this trick in particular blew my mind! Here’s why: Have you ever tested a login or contact form, entered a valid email address, intercepted the request with Burp, then replaced the email with XSS/SQLi/SSTI/RCE detection payloads? This is a way to bypass client-side validation of the email field. So what do you do if you get an “invalid email” response from the server?

To me, its was the end of testing for input validation on that field because the check is done server-side.

But according to @securinti, you can smuggle any payload and trick the server into believing that it’s a valid email by putting the payload between round brackets: yourname@(${}<>'/"*-)domain.com or yourname(${}<>'/"*-)@domain.com.

Amazing, right? I can’t wait to re-test all forms in my bug bounty notes.

2. Writeup of the week #

From Hunting for a Laptop to Hunting down Remote Code Execution

This is the writeup of a WebDAV RCE on Asus. It’s a simple but powerful vulnerability to test for if you see a 403 error page typical of Microsoft Server.

Anil Tom found one on http://stw.asus.com/ and tried to add the website as a new network location on his laptop, to see if WebDAV is enabled on the server.
It worked! So just by adding http://stw.asus.com/ as a network location, he was able to create new files on the server!

3. Resource of the week #

JSONBee

More and more sites use the Content Security Policy especially those that have a bug bounty program. So this repo can come in very handy if you find an XSS and want to bypass CSP.

If you just want the list of payloads to bypass CSP for different sites (Google, Blogger, Uber, Yahoo, Alibaba…), check out the file Jsonp.txt.

Otherwise, you can get more information on CSP and JSONbee on the Bypassing CSP: Automated discovery of JSONP endpoints conference slides.

And you can play with csp_lab.php as a testbed to train for byassing CSP.

4. Tool of the week #

PA Toolkit: Pentester Academy Wireshark Toolkit

I’ve always had trouble remembering the syntax of Wireshark filters, so this tool is a blessing.

It’s a collection of plugins that extend the functionality of Wireshark. They allow you to quickly get a list of all visited websites, downloaded files, POST/GET requests, list DNS servers, etc.

5. Tutorial of the week #

How To Exploit PHP Remotely To Bypass Filters & WAF Rules

I love me some good WAF/filter bypass techniques! It’s what makes a difference between being stuck in front of a WAF and finding bugs that other hunters missed even in old programs.

This is a great tutorial on how to bypass different PHP filters like: /etc/passwd, the system() function or double & single quotes (“ and ‘) being blocked. It’s worth reading & taking notes of tricks to test on your next bug hunt/pentest.

Other amazing things we stumbled upon this week #

Videos #

• Bugcrowd Researcher José Sousa AKA JLLiS
• Hacker Interviews: Santiago (try_to_hack)

Podcasts #

• The Top Ten “Application Security Podcast” Episodes of 2018
• What’s It Like to be a High-End Red Team Member? — CyberSpeak Podcast
• http://securityinfive.libsyn.com/episode-403-blur-password-manager-had-a-breach-the-reason-will-make-you-facepalm ?
• http://securityinfive.libsyn.com/episode-404-routers-with-this-feature-enabled-were-hacked-to-promote-youtube-stars-do-you-have-this-on ?

Conferences & Webcasts #

• RDP Logging Bypass and Azure Active Directory Recon
• JSFoo 2018 Day 1 & JSFoo 2018 Day 2, particularly:
  • Everything you need to know about client-side malicious code execution
  • Demystifying web application security
  • What makes JSON Web Tokens (JWT) secure?
  • Authentication done right: Consuming (and serving) Oauth 2.0
• From Zero to Zero Day
• Wallet.fail

Slides only #

• Jailbreaking iOS: From past to present

Upcoming webinars #

• Live webinar: Let’s talk about XSS and React - by Jim Manico: 01/02/2019
• Career Opportunities in Information Security |by Shobha Jagathpal | WINJA Webinar: 01/03/2019

Tutorials #

Medium to advanced #

• A Deeper Look into XSS Payloads
• XSS with length restriction
• Edit websocket requests with Burp
• SSH Examples, Tips & Tunnels
• iOS Pentesting Tools Part 3: Frida and Objection
• Why Facebook’s api starts with a for loop

Beginners corner #

• Exploiting Jenkins Groovy Script Console in Multiple Ways
• Understanding the iOS File System
• A Little Guide to SMB Enumeration
• Exploiting Put Method
• Basic XPath Injection
• Preliminary SQL Injection (Part 1)
• Preliminary SQL Injection (Part 2)
• Learn to Use CURL Command in Linux With These Examples
• Hacking Juice Shop, the DevSecOps Way
• Penetration Testing on Group Policy Preferences
• A 9-step recipe to crack a NTLMv2 Hash from a freshly acquired .pcap
• Metasploit Basics, Part 22: Exploiting and Controlling a System When You Have Physical Access

Writeups #

Challenge writeups #

• Real World CTF 2018 | Magic Tunnel
• Hacken Cup 2018 CTF Walkthrough

Pentest & Responsible disclosure writeups #

• Exploiting an 18 Year Old Bug
• Saving the Email Subscribers of Rentomojo
• This account has been hijacked (temporarily)!
• Twitter is Broken

• Case Study: Wreaking Havoc via an API
• The easiest “HACK” ever
• Kallithea <= 0.3.4 Incorrect access control and XSS

Bug bounty writeups #

• Race condition on Hackerone ($2,100)
• Authorization flaw on Hackerone ($500)
• Unrestricted file upload on Hackerone
• Unrestricted file upload on private program
• IDOR on Google
• Client-side validation bypass on Netflix & Linxo

See more writeups on The list of bug bounty writeups.

Tools #

If you don’t have time #

• Notable: The markdown-based note-taking app that doesn’t suck
• Adhrit: Open source Android APK reversing and analysis tool that can help security researchers and CTF enthusiasts alike. The tool is an effort to cut down on the amount of time spent on reversing and basic reconnaissance of Android applications.
• Jsdir / Jspathextractor: Burp Suite extension that extracts hidden paths from js files and beautifies it
• Ipify: Public API to get your public IP & geolocation data programmatically

More tools, if you have time #

• Bolt: A dumb CSRF scanner
• SerializationDumper: A tool to dump Java serialization streams in a more human readable form
• ZIP Shotgun: Utility script to test zip file upload functionality (and possible extraction of zip files) for vulnerabilities
• PoC for CVE-2018-1002105
• Pocsuite: Open-source remote vulnerability testing framework developed by the Knownsec Security Team
• L.A.S.T.: Linux Automated Security scanning Tool
• Sandmap & Tutorial: Nmap on steroids! Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles
• Netcap: A framework for secure and scalable network traffic analysis
• Marats-h1-disclosed: Hackerone hacktivity parser app. It sends notifications about new disclosed reports to your browser & The difference with existing tools
• VulnStream website & Github repo: Using Shodan’s streaming API to show a live stream of vulnerable devices as Shodan finds them
• Infoga: Email OSINT

Misc. pentest & bug bounty resources #

• OWASP Internet of Things (IoT) Top 10 2018
• Inside the mind of a hacker 2019 Edition
• OSINT Resources for 2019
• Hacker Roadmap: A guide for amateurs pen testers and a collection of hacking tools, resources and references to practice ethical hacking, pen testing and web security
• How HTTPS works …in a comic!
• APIsecurity.io: Issue 13: Microsoft services and Chromecast hacks, the limitations of WAF

Articles #

• The best write-ups 2018 brought us
• The Importance of the Content-Type Header in HTTP Requests
• A Review of my Bug Hunting Journey
• Swig Security Review 2018: Part I & Part II
• @EdOverflow’s answer to “What are the common features to identify XSS attack from Apache log file?”
• Publicly accessible .ENV files

Challenges #

• Ctf.infosecinstitute.com: CTF with bounties
• Serverless.fail: DVSA (Damn Vulnerable Serverless Application) online & DVSA lessons
• OWASP ‘ServerlessGoat’: A Vulnerable Demo Serverless Application

News #

• Sennheiser discloses monumental blunder that cripples HTTPS on PCs and Macs: TSennheiser’s HeadSetup app used a self-signed root certificate. The private key was encrypted with the passphrase “SennheiserCC” which was stored plaintext in a configuration file. Attackers could easily extract the passphrase from the binary & use it to create a valid TLS certificate for any website.
• In January, the EU starts running Bug Bounties on Free and Open Source Software

In January the European Commission is launching 14 out of a total of 15 bug bounties on Free Software projects that the EU institutions rely on

• Investigating Apps interactions with Facebook on Android

At least 61 percent of apps we tested automatically transfer data to Facebook the moment a user opens the app. This happens whether people have a Facebook account or not, or whether they are logged into Facebook or not.

• Hackers Make a Fake Hand to Beat Vein Authentication

It’s enough to take photos from a distance of five meters, and it might work to go to a press conference and take photos of them

Non technical #

• Should I go to university?
• Automatically storing my reading backlog and other notes
• 10 Personal Finance Lessons for Technology Professionals
• Survival Tips For Women In Tech
• Social Skills For Information Security Professionals: Effective Leadership: Free book by Dawid Balut
• 2018: Top 10 biggest news stories from Linux and open source world
• 2018: The year of the data breach tsunami
• The year in #StupidSecurity

Tweeted this week #

We created a collection of our favorite pentest & bug bounty related tweets shared this past week. You’re welcome to read them directly on Twitter: Tweets from 12/21/2018 to 12/28/2018

Have a nice week folks!

If you enjoyed reading this, please consider sharing it, leaving a comment, suggestions, questions…