Boost Subdomain Discovery with Subfinder and API Integrations

Subfinder is a popular open-source tool created by Project Discovery which is designed for discovering and enumerating subdomains.Continue reading on InfoSec Write-ups »
Read more...

The Cookie Bomb: My First $10K in Bug Bounties

When I started bug bounty hunting in 2019–2020, I came across a vulnerability that was simple to exploit yet surprisingly widespread. I began calling it the Cookie Bomb — and it earned me over $10,000 in my first year.Where It All Started While reading public HackerOne reports, I saw a bug where a query parameter value was directly written into a cookie. Since cookies are sent back to the server with every request, an attacker could inject an oversized string into a cookie, and the victim’s browser would keep sending it in every request. This led to a self-DoS situation:The victim’s browser stored the malicious cookie.Every request to the backend included that cookie.The server hit header size limits → requests failed.The victim’s session was essentially bricked until they cleared cookies. That idea stuck in my mind: could this be happening on other sites too?Hunting for Query Parameters That Set Cookies I started experimenting with query parameters that are commonly used for tracking and analytics, like:gclid (Google Ads)utm_source, utm_medium, utm_campaign (Google Analytics)fbclid (Facebook)dclid I used Wappalyzer to quickly identify whether a target was using Google or Facebook tracking. Then, I crafted requests with random 4000-character strings (around the max size for cookies).https://target.com/?gclid=AAAA...4000 chars…AAAA On reload, I checked if the string was stored as a cookie.Sometimes one parameter was enough to trigger the DoS.Other times, I had to combine multiple parameters (gclid + utmcampaign, etc.) to push total cookie size over the limit.In a few cases, I had to repeat the attack across multiple subdomains in order to set several malicious cookies. Only after combining them did the total cookie size exceed the backend’s header size limit and trigger the DoS.The Cookie Bomb Effect When successful, here’s what happened:Victim clicks the malicious link.Tracking parameter(s) get stored as cookies.Cookies exceed header size limit.All further requests fail with errors like 400 Bad Request or 414 URI Too Large.Victim can no longer use the application until they clear their cookies.A Few rewarded reportsRewards reports on Hackerone and Bugcrowd The Cookie Bomb: My First $10K in Bug Bounties was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
[Read more...](https://infosecwriteups.com/the-cookie-bomb-my-first-10k-in-bug-bounties-f86cb22c37fa?source=rss----7b722bfd1b8d--bugbounty)

Sensitive Endpoint Wordlist for Bug Hunting

Uncover Hidden Flaws: A Powerful Wordlist for Bug Bounty SuccessContinue reading on InfoSec Write-ups »
Read more...

Sliver is my favourite C2. Change my mind
https://www.reddit.com/r/redteamsec/comments/1n4udsr/sliver_is_my_favourite_c2_change_my_mind/

<!-- SC_OFF -->Change my mind: Rock-Solid Sessions Once a beacon lands, it stays put. I’ve left shells for months and if a connection fails a few times it'll reconnect based on the retry configuration you set up. Customization kinda easy: Cross-platform: Native clients for Windows, macOS, and Linux mean no awkward juggling. CLI based: Tab-complete everything, vps friendly, linux -tism friendly. I mean you can probably design a UI for this but why. Partial “task automation” baked-in: Now available for sessions i think but with a bit of custom thingy can work for beacons as well for sure (haven't tried yet, it's in my backlog) Nice to have features: Nonce+TOTP encryption by default: No extra flags, no forgotten certs—traffic’s wrapped the moment the beacon calls back. Custom HTTP requests: Being able to customize strings and extensions in the http requests is nice MTLS beacons: Bit less incognito stuff but still nice in some environments. Donut launcher built-in: Fire raw shellcode/assembly on the fly. God tier for executing tools through the beacon ETW patch & AMSI bypass: Haven’t stress-tested them yet, but early smoke tests look promising. Evasion: I rc4 encrypt the compiled beacons, and pack them inside a custom loader so, no much to say here. Around 90% bypass rate against the EDR in real exercises and testing. (Not a very crazy loader neither, made it just to work) Some more gimmicks i really haven't used much like canaries and watchtower or wireguard sessions and stuff. True that Linux beacons and sessions are kinda trash. Mainly focused on Windows targets but do someone have any C2 that truly dethrones Sliver? Or do you agree.. <!-- SC_ON --> submitted by /u/wh1t3k4t (https://www.reddit.com/user/wh1t3k4t)
[link] (https://github.com/BishopFox/sliver) [comments] (https://www.reddit.com/r/redteamsec/comments/1n4udsr/sliver_is_my_favourite_c2_change_my_mind/)

Adaptix c2 framework extender tab not showing.
https://www.reddit.com/r/redteamsec/comments/1n5dz6w/adaptix_c2_framework_extender_tab_not_showing/

<!-- SC_OFF -->Hi im new to using Adaptix C2, but I can’t seem to load up extension kit because the extender tab isn’t showing but instead AxScript. Can someone help? I’d appreciate it. Since I can’t upload a photo. The tabs shown are Projects > AxScript > Settings <!-- SC_ON --> submitted by /u/Maleficent-Can3175 (https://www.reddit.com/user/Maleficent-Can3175)
[link] (https://adaptix-framework.gitbook.io/adaptix-framework) [comments] (https://www.reddit.com/r/redteamsec/comments/1n5dz6w/adaptix_c2_framework_extender_tab_not_showing/)

Puzzle to Pwnage: Decoding Hidden Endpoints for Maximum Exploitation

Hey there!😁Continue reading on InfoSec Write-ups »
Read more...

How I Bypassed VPN Detection, Broke Client-Side Crypto and Found Multiple IDORS

A security test on a popular local mobile wallet Flutter-based Android App…Continue reading on Medium »
Read more...

HTB-LAB Local File Inclusion (LFI)

IntroductionContinue reading on Medium »
Read more...

BackDoor 1: Walkthrough of NET-SQUARE Hacking Warm-Up Mobile Application Challenge

Recently got an opportunity to participate in a CTF (Capture-The-Flag) event which was organized by NET-SQUARE. They had their different…Continue reading on InfoSec Write-ups »
Read more...

How I Exploited a JWT Misconfiguration for Account Takeover and Admin Access in 5 Minutes

Hey there, back again with another post! 😄 In this post I’ll be sharing an interesting finding from an internal web pentest where I…Continue reading on InfoSec Write-ups »
Read more...

Anatomy of Email Security Vulnerabilities: How Spoofing, Protocol Weaknesses, and Misconfigurations…
https://medium.com/@mohamednfe78/anatomy-of-email-security-vulnerabilities-how-spoofing-protocol-weaknesses-and-misconfigurations-e3264c712479?source=rss------bug_bounty-5

Introduction
In 2025, email remains the beating heart of enterprise collaboration, but it is also the most weaponized channel for…Continue reading on Medium » (https://medium.com/@mohamednfe78/anatomy-of-email-security-vulnerabilities-how-spoofing-protocol-weaknesses-and-misconfigurations-e3264c712479?source=rss------bug_bounty-5)

I Broke Rate Limits to Hijack Accounts — Without Getting Blocked

During a bug bounty hunt, a single flaw was discovered that allowed me to reset any user’s password, without a single click from the…Continue reading on Medium »
Read more...

Ultimate Bug Bounty Guide 2025: Top 100 Essential Tools + 100 Proven Techniques for Ethical Hackers

Stop learning cybersecurity the wrong way. While most aspiring ethical hackers waste months jumping between random tutorials and outdated…Continue reading on Medium »
Read more...

Critical Unauthorized Data Disclosure via HTTP Method Manipulation: A Lesson in API Security in…

Assalam o alaikum for muslim brothers, sisters and hello for non muslims. i hope all of you are doing well and learning new things day by…Continue reading on Medium »
Read more...

Understanding the OWASP Top 10: The Simplest Guide for Web Security

The OWASP Top 10 is a globally recognized list of the most critical web application security risks, published by the Open Web Application…Continue reading on Medium »
Read more...

Recon to Responsible Disclosure

My First Accepted Bug!Continue reading on Medium »
Read more...

Cloudflare Tunnel — Origin Exposure Weaponized

🔎 IntroductionContinue reading on Medium »
Read more...

The Little CV + CSRF That Broke an Account

السَّلاَمُ عَلَيْكُمْ وَرَحْمَةُ اللهِ وَبَرَكَاتُهُ. اللَّهُمَّ صَلِّ عَلَى مُحَمَّدٍ وَعَلَى آلِ مُحَمَّدٍ، كَمَا صَلَّيْتَ عَلَى…Continue reading on Medium »
Read more...

Linux File Permissions Exploits Every Hacker Should Know

Understanding Linux file permissions is critical for both system administrators and penetration testers. When misconfigured, file…Continue reading on Medium »
Read more...