The 5 Hacking NewsLetter 29

Hey hackers! These are our favorite resources shared by pentesters and bug hunters last week.

This issue covers the week from 16 to 23 of November.

T5HN29.png

On a personal note, really sorry for the delay. I’ve been under the weather and am still recovering. I’m also working on a training course and a new very exciting project. So there may be less articles (than usual) published in the next few weeks.

Our favorite 5 hacking items

1. Slides of the week

Bug bounty funshop

This is a great presentation for both web app pentesters & bug hunters. It presents a lot of tools, techniques and tips around recon, Burp Suite, reporting, testing mobile apps, etc.

I devoured it in order to add anything new to my current methodology. Hopefully, the video will be made public too.

2. Tool of the week

Lazyrecon fork

The original Lazyrecon is a Bash script by @nahamsec to automate reconnaissance. It creates a dated folder with recon notes, does subdomain enumeration, screenshots, port scanning, file/directory brute-force, etc.

This fork by @plenumlab builds on these features and adds other useful ones: notifications for potential NS subdomain takeover, subdomain enumeration with massdns, finds target’s IP address space and dead DNS records…

This is a good tool to use as is, or to analyze and maybe get new ideas for improving your own recon tools.

3. Writeup of the week

Authentication bypass on NodeSJ app (private program)

This is an interesting authentication bypass, due to SQL injection on a JavaScript app.

The app expects this kind of POST data: {“username”:”bl4de”,”password”:”secretpassword”}. Poking with it showed that:

  • {“username”:[[]],”password”:”secretpassword”} triggers a MySQL error typical of SQL injection
  • {“username”:[0],”password”:”secretpassword”} triggers a request to port 21110 with an Authorization header (for Basic auth) including secretpassword and the username super.adm. But the password is rejected
  • {"username":[0,1,2,30,50,100],"password":"secretpassword"} allows enumerating other usernames (but password still rejected)
  • {“username”:[0],”password”:true} triggers a request to port 21110 resulting in successful authentication as the super.adm user!

4. Tutorial of the week

Browsing the Internet While Using Burp Suite: and Other Productivity Hacks

Do you use the same browser instance to browse the Internet while doing tests and intercepting all requests with Burp? If yes, this tutorial is for you! Leverage Chrome browser profiles to run multiple instances at the same time: One for testing, one normal browsing, one for sensitive sites (like banking apps)…

I’ve been doing this for years with the Profile Switcher extension. I prefer Firefox to Chrome, but this extension is incompatible with the latest versions of Firefox.
If you know an equivalent and up-to-date Firefox extension, please share it with us!

5. Conference of the week

NDC Sydney 2018, especially:

I love these two talks! The first one is about advanced bugs that have become very popular in the bug bounty world (template injection, web cache poisoning, XXE, XSLT, SSRF…).
They are less known than XSS, SQL injection, open redirect, etc, but can have serious impacts and be highly rewarded.

The second one is almost an hour full of tips to help you decide if remote work is something for you or not, and how to navigate it successfully. A must watch if you’re considering remote work!

Other amazing things we stumbled upon this week

Videos

Podcasts

Conferences

Slides only

Tutorials

Medium to advanced

Beginners corner

Writeups

Pentest & Responsible disclosure writeups

Bug bounty writeups

See more writeups on The list of bug bounty writeups.

Tools

If you don’t have time

  • Asnlookup: Look up IP addresses (IPv4 & IPv6) registered and owned by a specific organization for reconnaissance purposes (Integrated to Lazyrecon)
  • BurpelFish: Burp extension that adds Google Translate to Burp’s Context Menu. Useful for testing sites in foreign languages
  • findsubdomains.py: Output all the data from https://findsubdomains.com/ into a JSON structure

More tools, if you have time

  • Blacklist3r & Project Blacklist3r Introduction
  • BbSpider: Simple spider for bug bounty recon & example
  • ParamPamPam: tool for brute-forcing GET and POST parameters (without Burp)
  • NodeJsScan: A static security code scanner for Node.js applications
  • ipv666 & IPv666 – Address of the Beast: Golang IPv6 address enumeration
  • Maai: Scanner that uses the python libraries for nmap to run full port masscan on targets, then runs nse nmap scans on only found open ports
  • SubDomainizer: A tool to find subdomains hidden in inline and external Javascript files of page
  • SubFl0w: A tool which gives it a subdomains list and it’s search on it for a subdomain takeover and tells you
  • CredCatch: Find plaintext credentials from emails in bulk from password dumps

Misc. pentest & bug bounty resources

Articles

Yet another memory leak in ImageMagick or how to exploit CVE-2018–16323.

News

Full account takeover … will be rewarded an average bounty of:

  • $40,000 if user interaction is not required at all, or
  • $25,000 if minimum user interaction is required. we will not require a full exploit chain in cases where leveraging the vulnerability requires bypassing our Linkshim mechanism.

By finding as few as 3 flags, you’ll automatically be added to the priority invitation queue for private program invitations and will receive one the following day. For every 26 points you earn on the CTF, you’ll receive another invitation

Non technical

Tweeted this week

We created a collection of our favorite pentest & bug bounty related tweets shared this past week. You’re welcome to read them directly on Twitter: Tweets from 11/16/2018 to 11/23/2018


Have a nice week folks!

If you want to be notified when new articles (including this newsletter) are published, you can subscribe to this blog.

And if you enjoyed reading this, please consider sharing it, leaving a comment, suggestions, questions…


Comments