High-severity ReDoS vulnerability in FastAPI’s form data handling, its implications, and the patch that mitigates the risk.Continue reading on System Weakness » (https://systemweakness.com/a-deep-dive-into-fastapis-security-vulnerability-cve-2024-24762-4ab6bb64644c?source=rss------bug_bounty-5)

Harnessing Concurrency in Go: Exploring Asynchronous Execution
https://medium.com/@rezauditore/harnessing-concurrency-in-go-exploring-asynchronous-execution-4134897d66a6?source=rss------bug_bounty-5

IntroductionContinue reading on Medium » (https://medium.com/@rezauditore/harnessing-concurrency-in-go-exploring-asynchronous-execution-4134897d66a6?source=rss------bug_bounty-5)

Tumblr Subdomain Takeover
https://infosecwriteups.com/tumblr-subdomain-takeover-55f9cb494d65?source=rss------bug_bounty-5

Write up about how I successfully took over the subdomain of an Tumblr blog.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/tumblr-subdomain-takeover-55f9cb494d65?source=rss------bug_bounty-5)

ALWAYS test 404 Not Found in Bug Bounties!

Hi everyone, today I want to show why you should always test websites that have no “/” directory and what many other Bug Bounty hunters…Continue reading on Medium »
Read more...

ALWAYS test 404 Not Found in Bug Bounties!
https://medium.com/@mares.viktor/always-test-404-not-found-in-bug-bounties-2be47801b4c0?source=rss------bug_bounty-5

Hi everyone, today I want to show why you should always test websites that have no “/” directory and what many other Bug Bounty hunters…Continue reading on Medium » (https://medium.com/@mares.viktor/always-test-404-not-found-in-bug-bounties-2be47801b4c0?source=rss------bug_bounty-5)

Stored XSS by PDF upload — Bug Bounty Tuesday

Hello everyone, I’m Kerstan. Today is Bug bounty Tuesday, I will share with you how to discover stored xss by pdf upload…Continue reading on Medium »
Read more...

SharpShares - Multithreaded C# .NET Assembly To Enumerate Accessible Network Shares In A Domain
http://www.kitploit.com/2024/02/sharpshares-multithreaded-c-net.html

Multithreaded C# .NET Assembly (https://www.kitploit.com/search/label/Assembly) to enumerate accessible network shares in a domain
Built upon djhohnstein's SharpShares (https://github.com/djhohnstein/SharpShares) project > .\SharpShares.exe help

Usage:
SharpShares.exe /threads:50 /ldap:servers /ou:"OU=Special Servers,DC=example,DC=local" /filter:SYSVOL,NETLOGON,IPC$,PRINT$ /verbose /outfile:C:\path\to\file.txt

Optional Arguments:
/threads - specify maximum number of parallel threads (default=25)
/dc - specify domain controller (https://www.kitploit.com/search/label/Domain%20Controller) to query (if not ran on a domain-joined host)
/domain - specify domain name (if not ran on a domain-joined host)
/ldap - query hosts from the following LDAP filters (default=all)
:all - All enabled computers (https://www.kitploit.com/search/label/Computers) with 'primary' group 'Domain Computers'
:dc - All enabled Domain Controllers (not read-only DCs)
:exclude-dc - All enabled computers that are not Domain Controllers or read-only DCs
:servers - All enabled servers
:servers-exclude-dc - All enabled servers excluding Domain Controllers or read-only DCs
/ou - specify LDAP OU to query enabled computer objects from
ex: "OU=Special Servers,DC=example,DC=local"
/stealth - list share names without performing read/write access (https://www.kitploit.com/search/label/Access) checks
/filter - list of comma-separated shares to exclude from enumeration
default: SYSVOL,NETLOGON,IPC$,PRINT$
/outfile - specify file for shares to be appended to instead of printing to std out
/verbose - return unauthorized shares
Execute Assembly execute-assembly /path/to/SharpShares.exe /ldap:all /filter:sysvol,netlogon,ipc$,print$
Example Output Specifying Targets The /ldap and /ou flags can be used together or seprately to generate a list of hosts to enumerate. All hosts returned from these flags are combined and deduplicated before enumeration (https://www.kitploit.com/search/label/Enumeration) starts.

Download SharpShares (https://github.com/mitchmoser/SharpShares)

Unveiling CVE-2024–0953: Firefox iOS Open Redirect Vulnerability

My recent encounter with a bug in the Firefox iOS app led to the assignment of CVE-2024–0953. This blog post narrates the journey of…Continue reading on Medium »
Read more...

Unveiling CVE-2024–0953: Firefox iOS Open Redirect Vulnerability
https://lohigowda.medium.com/unveiling-cve-2024-0953-firefox-ios-open-redirect-vulnerability-57533efb4cf4?source=rss------bug_bounty-5

My recent encounter with a bug in the Firefox iOS app led to the assignment of CVE-2024–0953. This blog post narrates the journey of…Continue reading on Medium » (https://lohigowda.medium.com/unveiling-cve-2024-0953-firefox-ios-open-redirect-vulnerability-57533efb4cf4?source=rss------bug_bounty-5)

Symlink Sabotage: ZIPping Through Web Security. (LFI Lab)
https://medium.com/@josh.beck2006/symlink-sabotage-zipping-through-web-security-lfi-lab-ca20e2d30c8d?source=rss------bug_bounty-5