The 5 Hacking NewsLetter 28

19 Nov 2018 • newsletter

Hey hackers! These are our favorite resources shared by pentesters and bug hunters last week.

This issue covers the week from 09 of November to 16 of November.

T5HN28.png

Our favorite 5 hacking items

1. Conference of the week

DEF CON 26 Recon Village, particularly:
- Emergent Recon fresh methodology and tools for hackers in 2018
- Bug Bounty Hunting on Steroids
- Supercharge Your Web Recon With Commonspeak
- Building Visualisation Platforms for OSINT Data Using OSS
- Skiptracer Ghetto OSINT for Broke Hackers
- Introducing YOGA Your OSINT Graphical Analyzer

I wasn’t sure if the DEF CON Recon village talks were going to be made public. Boy, was I happy to see them shared on Youtube!

I was rooting especially for:

  • Jason Haddix’s latest methodology & tools for recon (but slides are missing)
  • More information on how BountyMachine works. Sadly it won’t be open sourced :/

All the talks are interesting since they focus on recon in a very practical way.

2. Writeup of the week

XSS in hidden input fields & PoC

When XSS payload is injected inside a hidden input field, it can be hard to exploit. Until now, one way to do it was using expression() but it worked only on IE<=9.

This writeup shows a new technique to exploit such XSS bugs on Firefox and Chrome:
<input type="hidden" accesskey="X" onclick="alert(1)"> (Firefox)
<link rel="canonical" accesskey="X" onclick="alert(1)" /> (Chrome)

The payload is executed once the victim presses the key combination ALT+SHIFT+X (on Windows & Linux) or CTRL+ALT+X (on Mac OS X).

3. Tool of the week

Universal Android SSL Pinning Bypass #2

This is a very impressive script. It allows you to bypass all SSL certificate checks on any Android app, including SSL pinning.

Playing with Android apps’ source code and different SSL pinning bypass techniques can be fun and educational. But sometimes, we’re on a hurry and just want to get rid of SSL pining to start looking for bugs. It’s never been this easy!

All you have to do is install Frida, download the script and run it on the app’s package name.
It’s almost instantaneous and you don’t have to meddle with the app’s code, re-patch it, etc.

4. Tip of the week

New technique to find Blind-XSS

This is a great tip for finding less obvious blind XSS vulnerabilities: Don’t limit yourself to testing forms. Find contact email addresses (by scraping your target site or guessing), and send your payload to them (in subject & body).

Sometimes the forms are well sanitized but the email messages are not and they’re added to the same admin portals.

5. Non technical item of the week

Singing the Blues: Taking Down an Insider Threat

This is a great account of what went wrong during a pentest… for the pentester, because the target was doing their job well!

I don’t want to spoil it. I’ll just say that it reminds me of the Stealing the network books. It’s both a (little bit) technical & a very entertaining read.

Other amazing things we stumbled upon this week

Videos

Podcasts

Conferences & Webcasts

Slides only

Tutorials

Medium to advanced

Beginners corner

Writeups

Pentest & Responsible disclosure writeups

Bug bounty writeups

See more writeups on The list of bug bounty writeups.

Tools

If you don’t have time

More tools, if you have time

  • Burp Theme Patcher: A tool to simplify the creation of Burp Suite Themes
  • hate_crack: A tool for automating cracking methodologies through Hashcat from the TrustedSec team
  • Osmedeus: Automatic Reconnaisance & Scanning, includes many modules for: subdomain enumeration, subdomain takeover, screenshots, port scanning, git recon, brute-force & more
  • ZIP File Raider: Burp Extension for ZIP File Payload Testing
  • SMWYG-Show-Me-What-You-Got: Search https://gotcha.pw for 1.4 Billion clear text credentials which was dumped as part of BreachCompilation leak. Useful for OSINT and reconnaissance on an organisation or an individual
  • Djangohunter: Tool designed to help identify incorrectly configured Django applications that are exposing sensitive information
  • DeepSearch - Advanced Web Dir Scanner: Advanced Web Dir Scanner
  • BabySploit: Beginner Pentesting Toolkit/Framework Written in Python
  • wifi_plug: python script that downloads & installs wifi pentest tools
  • CloudBunny: Tool to capture the real IP of the server that uses a WAF as a proxy or protection. In this tool we used three search engines to search domain information: Shodan, Censys & Zoomeye
  • Apkatshu: Tool for extracting urls , emails , ip address , and interesting data from APK files
  • gOSINT: OSINT Swiss Army Knife

Misc. pentest & bug bounty resources

Challenges

News

Bug bounty news

Hacking news

Non technical

Tweeted this week

We created a collection of our favorite pentest & bug bounty related tweets shared this past week. You’re welcome to read them directly on Twitter: Tweets from 11/09/2018 to 11/16/2018

Have a nice week folks!

If you want to be notified when new articles (including this newsletter) are published, you can subscribe to this blog.

And if you enjoyed reading this, please consider sharing it, leaving a comment, suggestions, questions…

 pentest  bug bounty  web app security  5 Hacking NewsLetter  news  hacking resources  websec resources

Comments

Related Posts