2 min read
Building a Custom OOB Server
If you're reading this, you've probably used Burp, and you're probably aware of Burp Collaborator, the out of band detection feature. Basically, it gives you a (sub)domain name…
tag
bug bounty
14 posts
4 min read
Escalating Self-XSS for Riches
I have a bit of a love hate relationship with Self XSS. I find them somewhat regularly, and while I do think programs should pay a bounty for them (the lowest they offer), I’m…
2 min read
A Very Brief Look at YesWiki
After I created TemplateSearch.io, I was testing it out by searching for random things and I came across several templates for YesWiki. So I Googled it to see exactly what it is…
1 min read
Funny Bug Bounty Reports #1
This is the first part in my new series "Funny Bug Bounty Reports". These are not judged on their merits, technical abilities, or anything other than if they make me laugh. Today,…
1 min read
Behold! TemplateSearch.io
I was tired of manually searching for the right Nuclei templates to use. The one existing site that lets you search them — while interestingly designed and certainly more stylish…
1 min read
California Top 25 Researcher 2024
I received an email saying I'm a top 25 researcher in the California VDP from 2024. Not too bad from the thousands of reports they get, I'm sure.
5 min read
Pentesting a ClickHouse DB
I recently ran across an application that allowed access to a ClickHouse DB for my user. The access was allowed, so that isn't an issue. However, when we as pentesters or bug…
1 min read
BugCrowd P1 Warrior Swag
The other day I received an email saying I was eligible for some swag for getting my 25th valid P1 submission on BugCrowd. I don't do too much BB hunting these days, and also not…
3 min read
Mura/Masa CMS - SQL Injection CVE-2024-32640
A while back the illustrious team over at Project Discovery wrote about the discovery of an SQLi in Masa/Mura CMS . It's a good writeup, so go check it out for the technical…
3 min read
iOS 16.7.8 Jailbreak on iPhone X
If you're a pentester or bug bounty hunter that is trying to do some iOS mobile application testing, half the battle is getting a phone properly jailbroken so you can proxy HTTP…
4 min read
Hacking RAMADDA, White Box Web Apps, and Bug Bounty Tips
Note: disregard any layout/content/formatting errors as this post was migrated from wordpress to jekyll As mentioned in a previous post, I was the July RotM for the DoD VDP…
1 min read
Department of Defense Researcher of the Month (Year)
I was recently awarded the DoD Researcher of the Month for July, 2023 . Between moving across the country and other hacking duties, I still had time to hammer away at a particular…
1 min read
Self-Hosted Security Part ? - Poor Rate Limiting in Organizr
Organizr is a self hosted application written in PHP that basically helps you self host other services at your home. It's nifty application with a surprisingly large amount of…
8 min read
Deploying and Configuring a Bug Bounty Box with Terraform and Ansible
Prerequisites and Getting Started I sometimes like to spin up a virutal machine in the cloud, do some testing, and then tear it down. It doesn't even have to be for bug bounty…