Android Pentesting Setup Up Burpsuite Intercept
This document provides a step-by-step guide on how to set up Burp Suite to intercept and analyze traffic from a mobile device.Continue reading on Medium »
Read more...
This document provides a step-by-step guide on how to set up Burp Suite to intercept and analyze traffic from a mobile device.Continue reading on Medium »
Read more...
Medium
Android Pentesting Setup Up Burpsuite Intercept
This document provides a step-by-step guide on how to set up Burp Suite to intercept and analyze traffic from a mobile device. By following…
Android Pentesting Setup Up Burpsuite Intercept
https://medium.com/@muhammadhuzaifa02134182093/android-pentesting-setup-up-burpsuite-intercept-53b37ea9762c?source=rss------bug_bounty-5
https://medium.com/@muhammadhuzaifa02134182093/android-pentesting-setup-up-burpsuite-intercept-53b37ea9762c?source=rss------bug_bounty-5
This document provides a step-by-step guide on how to set up Burp Suite to intercept and analyze traffic from a mobile device.Continue reading on Medium » (https://medium.com/@muhammadhuzaifa02134182093/android-pentesting-setup-up-burpsuite-intercept-53b37ea9762c?source=rss------bug_bounty-5)
Certifications Advice
https://www.reddit.com/r/Pentesting/comments/1kxvfao/certifications_advice/
<!-- SC_OFF -->Hi! Maybe can I have an advice? As an Amazon Driver I have a benefit for some programs, and I just checkd they have this programs with ed2go, and the have Secuirtiy+, Network+, A+, and another one TECH+, I thin this last one is a new from Comptia.Also I have interest in the AWS Cloud Practitioner, all of them include the boot camp style study and the vouchers.I have an amount of 5250 to spend, but I am not sure how to use it. Is A+ worth it to got?? I was going to take it because it can help ,landing that first job in IT Support. Network+ I think is a must, and of course the gold standard Security+TECH+ I think may not be necessary. AWS Cloud Practitioner may be a good one to have to. So, the comptia ones can be taken as bundles in ed2go, but my real question is about taking the A+ or your opinion is that it may not be necessary, and just go to Sec and Net, with AWS. I know I can have all this free in YouTube and all that, but I really like to study in a structured way, and also they include the vouchers so may be a good option. About me? I am pivoting from Public Administration, i am Ecuadorian and i have an Associates in Cybersecurity, and i am trying to land my first TECH job Thanks for your help! <!-- SC_ON --> submitted by /u/Fickle-Throat4940 (https://www.reddit.com/user/Fickle-Throat4940)
[link] (https://www.reddit.com/r/Pentesting/comments/1kxvfao/certifications_advice/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxvfao/certifications_advice/)
https://www.reddit.com/r/Pentesting/comments/1kxvfao/certifications_advice/
<!-- SC_OFF -->Hi! Maybe can I have an advice? As an Amazon Driver I have a benefit for some programs, and I just checkd they have this programs with ed2go, and the have Secuirtiy+, Network+, A+, and another one TECH+, I thin this last one is a new from Comptia.Also I have interest in the AWS Cloud Practitioner, all of them include the boot camp style study and the vouchers.I have an amount of 5250 to spend, but I am not sure how to use it. Is A+ worth it to got?? I was going to take it because it can help ,landing that first job in IT Support. Network+ I think is a must, and of course the gold standard Security+TECH+ I think may not be necessary. AWS Cloud Practitioner may be a good one to have to. So, the comptia ones can be taken as bundles in ed2go, but my real question is about taking the A+ or your opinion is that it may not be necessary, and just go to Sec and Net, with AWS. I know I can have all this free in YouTube and all that, but I really like to study in a structured way, and also they include the vouchers so may be a good option. About me? I am pivoting from Public Administration, i am Ecuadorian and i have an Associates in Cybersecurity, and i am trying to land my first TECH job Thanks for your help! <!-- SC_ON --> submitted by /u/Fickle-Throat4940 (https://www.reddit.com/user/Fickle-Throat4940)
[link] (https://www.reddit.com/r/Pentesting/comments/1kxvfao/certifications_advice/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxvfao/certifications_advice/)
️ Sensitive Data Exposure via WP-JSON in WordPress
https://medium.com/@noorsaper64/%EF%B8%8F-sensitive-data-exposure-via-wp-json-in-wordpress-d1dee7318d3b?source=rss------bug_bounty-5
https://medium.com/@noorsaper64/%EF%B8%8F-sensitive-data-exposure-via-wp-json-in-wordpress-d1dee7318d3b?source=rss------bug_bounty-5
$1,000 Bounty: Created Support Tickets on Behalf of Any HackerOne User via Email
Abusing Email-Based Ticketing to Impersonate Users and Bypass Identity Controls — Earned $1,000Continue reading on OSINT Team »
Read more...
Abusing Email-Based Ticketing to Impersonate Users and Bypass Identity Controls — Earned $1,000Continue reading on OSINT Team »
Read more...
Medium
$1,000 Bounty: Created Support Tickets on Behalf of Any HackerOne User via Email
Abusing Email-Based Ticketing to Impersonate Users and Bypass Identity Controls — Earned $1,000
$1,000 Bounty: Created Support Tickets on Behalf of Any HackerOne User via Email
https://osintteam.blog/1-000-bounty-created-support-tickets-on-behalf-of-any-hackerone-user-via-email-d8b6f90f0757?source=rss------bug_bounty-5
https://osintteam.blog/1-000-bounty-created-support-tickets-on-behalf-of-any-hackerone-user-via-email-d8b6f90f0757?source=rss------bug_bounty-5
Abusing Email-Based Ticketing to Impersonate Users and Bypass Identity Controls — Earned $1,000Continue reading on OSINT Team » (https://osintteam.blog/1-000-bounty-created-support-tickets-on-behalf-of-any-hackerone-user-via-email-d8b6f90f0757?source=rss------bug_bounty-5)
EG-CERT CTF25 Flog: Nowadays Arch Issues
At EG-CTF25 this year, we focused on creating real-world, practical challenges for players. Our goal wasn’t just to challenge them, but to…Continue reading on Medium »
Read more...
At EG-CTF25 this year, we focused on creating real-world, practical challenges for players. Our goal wasn’t just to challenge them, but to…Continue reading on Medium »
Read more...
Medium
EG-CERT CTF25 Flog: Nowadays Arch Issues
At EG-CTF25 this year, we focused on creating real-world, practical challenges for players. Our goal wasn’t just to challenge them, but to…
CVE-2025–4687 ( Pre-Account takeover through invite on Teletonika RMS website )
Teletonika RMS website which is used to manage remote devices was found to be vulnerable to Pre-account takeover using invite. The…Continue reading on Medium »
Read more...
Teletonika RMS website which is used to manage remote devices was found to be vulnerable to Pre-account takeover using invite. The…Continue reading on Medium »
Read more...
Medium
CVE-2025–4687 ( Pre-Account takeover through invite on Teletonika RMS website )
Teletonika RMS website which is used to manage remote devices was found to be vulnerable to Pre-account takeover using invite. The…
Uncovering Amazon S3 Bucket Vulnerabilities: A Comprehensive Guide for Ethical Hackers
How to Identify, Exploit, and Secure S3 Bucket MisconfigurationsContinue reading on InfoSec Write-ups »
Read more...
How to Identify, Exploit, and Secure S3 Bucket MisconfigurationsContinue reading on InfoSec Write-ups »
Read more...
Medium
Uncovering Amazon S3 Bucket Vulnerabilities: A Comprehensive Guide for Ethical Hackers 🔐💻
How to Identify, Exploit, and Secure S3 Bucket Misconfigurations
Added classic registry based persistence to OnionC2
https://www.reddit.com/r/redteamsec/comments/1kxuqac/added_classic_registry_based_persistence_to/
<!-- SC_OFF -->One of many persistence mechanisms to come. Simple to setup, all you need to do is slightly modify config.rs to your liking. Stay tuned as in the near future I will add advanced mechanisms of persistence. <!-- SC_ON --> submitted by /u/ZarkonesOfficial (https://www.reddit.com/user/ZarkonesOfficial)
[link] (https://github.com/zarkones/OnionC2) [comments] (https://www.reddit.com/r/redteamsec/comments/1kxuqac/added_classic_registry_based_persistence_to/)
https://www.reddit.com/r/redteamsec/comments/1kxuqac/added_classic_registry_based_persistence_to/
<!-- SC_OFF -->One of many persistence mechanisms to come. Simple to setup, all you need to do is slightly modify config.rs to your liking. Stay tuned as in the near future I will add advanced mechanisms of persistence. <!-- SC_ON --> submitted by /u/ZarkonesOfficial (https://www.reddit.com/user/ZarkonesOfficial)
[link] (https://github.com/zarkones/OnionC2) [comments] (https://www.reddit.com/r/redteamsec/comments/1kxuqac/added_classic_registry_based_persistence_to/)
I Tried 10 Recon Tools for 7 Days — Here’s What Actually Found Bugs
Free Article LinkContinue reading on InfoSec Write-ups »
Read more...
Free Article LinkContinue reading on InfoSec Write-ups »
Read more...
Medium
🔥I Tried 10 Recon Tools for 7 Days — Here’s What Actually Found Bugs
Free Article Link
Unsafe Redirects = Unlimited Ride: How Open Redirect Led Me to Internal Dashboards
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Medium
Unsafe Redirects = Unlimited Ride: How Open Redirect Led Me to Internal Dashboards 🧽🚪
Hey there!😁
Broken Access Control: The Quiet Killer in Web Applications
"I didn’t bypass the firewall, I bypassed trust." When I started bug bounty hunting, I was captivated by XSS and SQLi—the flashy vulnerabilities. But over time, I learned that real money often lies in something far quieter: Broken Access Control. It lets users do things they should never be allowed to do.🧠 What Is Broken Access Control? Access control dictates what authenticated users are allowed to do. When those rules aren’t enforced properly, users can:Access other users’ dataPerform admin-only actionsEscalate privileges by tweaking requests It’s a silent issue. There's no error, no crash. Things just… work, when they shouldn’t.🕵️♂️ Case #1 — Unauthorized Data Access via IDOR During a private program, I noticed the following request while viewing my own invoice:GET /api/invoice/45289 The ID looked incrementally generated. Classic red flag.How it works? I incremented it manually:GET /api/invoice/45290 To my surprise, another user's invoice was returned—no authorization check, no access control logic. I now had access to PII: names, emails, billing info. Impact: A simple change in the URL let me read thousands of users’ financial data. Reward: $2,500 bounty.💡 Pro tip: IDOR isn’t just about changing numbers—look for UUIDs, usernames, slugs, or even timestamps.🎭 Case #2 — Elevating to Admin by Guessing an Endpoint In one engagement, I found a hidden admin endpoint referenced in JavaScript:fetch('/admin/deleteUser?uid=934') As a regular user, the button wasn’t shown to me—but the endpoint still existed. I fired the request manually:curl -X POST "https://target.com/admin/deleteUser?uid=934" -b "session=your_cookie_here" Boom. 200 OK. The user was deleted. No RBAC (Role-Based Access Control), no validation. Impact: Anyone could delete any account. Reward: $1,800 bounty. 🔎 Just because an action is hidden from the UI doesn’t mean it’s protected.🧪 Case #3 — JWT Role Manipulation JWTs are widely used for stateless authentication, but they’re often misconfigured. I once found a site using unsigned JWTs with the "alg": "none" vulnerability. Here was the original decoded payload:{ "username": "n00b_hunter", "role": "user" } I changed it to:{ "username": "n00b_hunter", "role": "admin" } Re-encoded it, sent the token:curl -H "Authorization: Bearer <modified_token>" https://target.com/admin/dashboard And just like that—I was in the admin panel. Impact: Full administrative access. Reward: $4,000 bounty. 🚨 Always validate JWT signatures. Never trust client-side tokens blindly.🔐 How to Prevent Broken Access Control From what I’ve seen across dozens of programs, here’s what helps: ✅ Enforce server-side access control checksDon’t rely on client-side logic or hidden buttons. ✅ Use RBAC (Role-Based Access Control)Every endpoint should verify the user’s role before granting access. ✅ Validate object ownershipJust because someone is authenticated doesn’t mean they own the resource they’re requesting. ✅ Log all access control failuresFailed access attempts should trigger alerts, not just return a 403.🧰 Tools I Use While HuntingBurp Suite Pro – Intercept and manipulate requestsPostman – For structured API testingjwt.io – Decode, edit, and re-sign JWTsffuf / dirsearch – Brute-force hidden endpointsParam Miner – Discover hidden parameters🎯 Final Thoughts Broken Access Control is not glamorous—but it’s quietly powerful. It’s about understanding how systems manage trust, and spotting where that trust is misapplied.These aren’t flashy bugs—but they can be fatal. 📌 Follow me for more stories from the field: recon, bounty wins, and subtle bugs that break the web.Thank you guys… 🔓 Broken Access Control: The Quiet Killer in Web Applications was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
"I didn’t bypass the firewall, I bypassed trust." When I started bug bounty hunting, I was captivated by XSS and SQLi—the flashy vulnerabilities. But over time, I learned that real money often lies in something far quieter: Broken Access Control. It lets users do things they should never be allowed to do.🧠 What Is Broken Access Control? Access control dictates what authenticated users are allowed to do. When those rules aren’t enforced properly, users can:Access other users’ dataPerform admin-only actionsEscalate privileges by tweaking requests It’s a silent issue. There's no error, no crash. Things just… work, when they shouldn’t.🕵️♂️ Case #1 — Unauthorized Data Access via IDOR During a private program, I noticed the following request while viewing my own invoice:GET /api/invoice/45289 The ID looked incrementally generated. Classic red flag.How it works? I incremented it manually:GET /api/invoice/45290 To my surprise, another user's invoice was returned—no authorization check, no access control logic. I now had access to PII: names, emails, billing info. Impact: A simple change in the URL let me read thousands of users’ financial data. Reward: $2,500 bounty.💡 Pro tip: IDOR isn’t just about changing numbers—look for UUIDs, usernames, slugs, or even timestamps.🎭 Case #2 — Elevating to Admin by Guessing an Endpoint In one engagement, I found a hidden admin endpoint referenced in JavaScript:fetch('/admin/deleteUser?uid=934') As a regular user, the button wasn’t shown to me—but the endpoint still existed. I fired the request manually:curl -X POST "https://target.com/admin/deleteUser?uid=934" -b "session=your_cookie_here" Boom. 200 OK. The user was deleted. No RBAC (Role-Based Access Control), no validation. Impact: Anyone could delete any account. Reward: $1,800 bounty. 🔎 Just because an action is hidden from the UI doesn’t mean it’s protected.🧪 Case #3 — JWT Role Manipulation JWTs are widely used for stateless authentication, but they’re often misconfigured. I once found a site using unsigned JWTs with the "alg": "none" vulnerability. Here was the original decoded payload:{ "username": "n00b_hunter", "role": "user" } I changed it to:{ "username": "n00b_hunter", "role": "admin" } Re-encoded it, sent the token:curl -H "Authorization: Bearer <modified_token>" https://target.com/admin/dashboard And just like that—I was in the admin panel. Impact: Full administrative access. Reward: $4,000 bounty. 🚨 Always validate JWT signatures. Never trust client-side tokens blindly.🔐 How to Prevent Broken Access Control From what I’ve seen across dozens of programs, here’s what helps: ✅ Enforce server-side access control checksDon’t rely on client-side logic or hidden buttons. ✅ Use RBAC (Role-Based Access Control)Every endpoint should verify the user’s role before granting access. ✅ Validate object ownershipJust because someone is authenticated doesn’t mean they own the resource they’re requesting. ✅ Log all access control failuresFailed access attempts should trigger alerts, not just return a 403.🧰 Tools I Use While HuntingBurp Suite Pro – Intercept and manipulate requestsPostman – For structured API testingjwt.io – Decode, edit, and re-sign JWTsffuf / dirsearch – Brute-force hidden endpointsParam Miner – Discover hidden parameters🎯 Final Thoughts Broken Access Control is not glamorous—but it’s quietly powerful. It’s about understanding how systems manage trust, and spotting where that trust is misapplied.These aren’t flashy bugs—but they can be fatal. 📌 Follow me for more stories from the field: recon, bounty wins, and subtle bugs that break the web.Thank you guys… 🔓 Broken Access Control: The Quiet Killer in Web Applications was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Logic Flaw: Deleting HackerOne Team Reports Without Access Rights
How a GraphQL Mutation Allowed Unauthorized Report Deletion Across TeamsContinue reading on InfoSec Write-ups »
Read more...
How a GraphQL Mutation Allowed Unauthorized Report Deletion Across TeamsContinue reading on InfoSec Write-ups »
Read more...
Medium
Logic Flaw: Deleting HackerOne Team Reports Without Access Rights
How a GraphQL Mutation Allowed Unauthorized Report Deletion Across Teams