I begin in the name of Almighty Allah.Continue reading on Medium » (https://nahid0x1.medium.com/my-experience-of-hacking-dutch-government-dns-hijacking-d25239af5500?source=rss------bug_bounty-5)

Union-based SQL injection
https://medium.com/@MohammedMHassan/union-based-sql-injection-2e0cc3b18939?source=rss------bug_bounty-5

Union-based SQL Injection is a type of SQL injection attack where an attacker uses the UNION SQL operator to combine the results of two or…Continue reading on Medium » (https://medium.com/@MohammedMHassan/union-based-sql-injection-2e0cc3b18939?source=rss------bug_bounty-5)

I Almost Closed the Tab on My Biggest Bug Bounty
https://medium.com/@ibtissamhammadi1/i-almost-closed-the-tab-on-my-biggest-bug-bounty-8685ef3d2f46?source=rss------bug_bounty-5

How a moment of impatience nearly cost me a $4,520 account takeover vulnerability — and the simple habit that changed everything.Continue reading on Medium » (https://medium.com/@ibtissamhammadi1/i-almost-closed-the-tab-on-my-biggest-bug-bounty-8685ef3d2f46?source=rss------bug_bounty-5)

Why Ransomware Gangs Are Now Targeting APIs and SaaS Apps

Ransomware has evolved. In the early days, attackers focused on encrypting files on endpoints. Then, they moved to corporate networks…Continue reading on Medium »
Read more...

Red teaming Help
https://www.reddit.com/r/Pentesting/comments/1n4p7qa/red_teaming_help/

<!-- SC_OFF -->Hi people , So i am a security researcher who majorly comes from appsec background I have always had keen interest in red teaming but never got the opportunity Finally i have a project where in i can explore and learn some stuff but unfortunately I don't have any friends or anyone to seek guidance from. So far I have managed to get access to the network Now my initial plan was to identify how vlans are there like what segment contains server , dbs , nw devices etc and then try to find a valid cred and then maybe run bloodhound and try to find a path to DA But I would like to understand how you people approach this also what tools do u guys use Ty for the help <!-- SC_ON --> submitted by /u/Grouchy-Community-17 (https://www.reddit.com/user/Grouchy-Community-17)
[link] (https://www.reddit.com/r/Pentesting/comments/1n4p7qa/red_teaming_help/) [comments] (https://www.reddit.com/r/Pentesting/comments/1n4p7qa/red_teaming_help/)

Seeking advice on career switch
https://www.reddit.com/r/Pentesting/comments/1n4wn8h/seeking_advice_on_career_switch/

<!-- SC_OFF -->Hi all, I hope you can help me. I am a software developer based in the UK who has 4 yoe as a developer and wanting to switch to pen testing. I am currently working through the INE eJPT and look forward to doing the HTB CPTS once I've done the eJPT exam. I wanted to ask if there are other certs I should look into getting as most of the UK jobs seem to ask for CREST/CHECK certifications <!-- SC_ON --> submitted by /u/SpeedPositive1224 (https://www.reddit.com/user/SpeedPositive1224)
[link] (https://www.reddit.com/r/Pentesting/comments/1n4wn8h/seeking_advice_on_career_switch/) [comments] (https://www.reddit.com/r/Pentesting/comments/1n4wn8h/seeking_advice_on_career_switch/)

Does anyone know to brute force Facebook password without hitting the rate limiting.Note: This is for ethical Authorized pentesing purpose
https://www.reddit.com/r/Pentesting/comments/1n5c06l/does_anyone_know_to_brute_force_facebook_password/

submitted by /u/cheemse01 (https://www.reddit.com/user/cheemse01)
[link] (https://www.reddit.com/r/Pentesting/comments/1n5c06l/does_anyone_know_to_brute_force_facebook_password/) [comments] (https://www.reddit.com/r/Pentesting/comments/1n5c06l/does_anyone_know_to_brute_force_facebook_password/)

Why Ransomware Gangs Are Now Targeting APIs and SaaS Apps
https://medium.com/@paritoshblogs/why-ransomware-gangs-are-now-targeting-apis-and-saas-apps-eb08cd045ad2?source=rss------bug_bounty-5

Ransomware has evolved.
 In the early days, attackers focused on encrypting files on endpoints. Then, they moved to corporate networks…Continue reading on Medium » (https://medium.com/@paritoshblogs/why-ransomware-gangs-are-now-targeting-apis-and-saas-apps-eb08cd045ad2?source=rss------bug_bounty-5)

Anatomy of Email Security Vulnerabilities: How Spoofing, Protocol Weaknesses, and Misconfigurations…

Introduction In 2025, email remains the beating heart of enterprise collaboration, but it is also the most weaponized channel for…Continue reading on Medium »
Read more...

Security Engineer Interview Questions Part-1

With 6+ years of experience in the field of security, I’ve had the opportunity to participate in numerous interviews for Security…Continue reading on InfoSec Write-ups »
Read more...

“Day 24: The Polyglot Poison — How I Turned a Resume Upload into a Remote Shell”

Bypassing Modern File Upload Protections with a Multi-Headed FileContinue reading on InfoSec Write-ups »
Read more...

Boost Subdomain Discovery with Subfinder and API Integrations

Subfinder is a popular open-source tool created by Project Discovery which is designed for discovering and enumerating subdomains.Continue reading on InfoSec Write-ups »
Read more...

The Cookie Bomb: My First $10K in Bug Bounties

When I started bug bounty hunting in 2019–2020, I came across a vulnerability that was simple to exploit yet surprisingly widespread. I began calling it the Cookie Bomb — and it earned me over $10,000 in my first year.Where It All Started While reading public HackerOne reports, I saw a bug where a query parameter value was directly written into a cookie. Since cookies are sent back to the server with every request, an attacker could inject an oversized string into a cookie, and the victim’s browser would keep sending it in every request. This led to a self-DoS situation:The victim’s browser stored the malicious cookie.Every request to the backend included that cookie.The server hit header size limits → requests failed.The victim’s session was essentially bricked until they cleared cookies. That idea stuck in my mind: could this be happening on other sites too?Hunting for Query Parameters That Set Cookies I started experimenting with query parameters that are commonly used for tracking and analytics, like:gclid (Google Ads)utm_source, utm_medium, utm_campaign (Google Analytics)fbclid (Facebook)dclid I used Wappalyzer to quickly identify whether a target was using Google or Facebook tracking. Then, I crafted requests with random 4000-character strings (around the max size for cookies).https://target.com/?gclid=AAAA...4000 chars…AAAA On reload, I checked if the string was stored as a cookie.Sometimes one parameter was enough to trigger the DoS.Other times, I had to combine multiple parameters (gclid + utmcampaign, etc.) to push total cookie size over the limit.In a few cases, I had to repeat the attack across multiple subdomains in order to set several malicious cookies. Only after combining them did the total cookie size exceed the backend’s header size limit and trigger the DoS.The Cookie Bomb Effect When successful, here’s what happened:Victim clicks the malicious link.Tracking parameter(s) get stored as cookies.Cookies exceed header size limit.All further requests fail with errors like 400 Bad Request or 414 URI Too Large.Victim can no longer use the application until they clear their cookies.A Few rewarded reportsRewards reports on Hackerone and Bugcrowd The Cookie Bomb: My First $10K in Bug Bounties was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
[Read more...](https://infosecwriteups.com/the-cookie-bomb-my-first-10k-in-bug-bounties-f86cb22c37fa?source=rss----7b722bfd1b8d--bugbounty)

Sensitive Endpoint Wordlist for Bug Hunting

Uncover Hidden Flaws: A Powerful Wordlist for Bug Bounty SuccessContinue reading on InfoSec Write-ups »
Read more...