Every offensive security course avl
https://www.reddit.com/r/Pentesting/comments/1nwzidt/every_offensive_security_course_avl/
<!-- SC_OFF -->If anybody wants offensive security course contents which includes pdfs and videos Contact me , i have them . I just want to help the community. <!-- SC_ON --> submitted by /u/Repulsive_Hotel555 (https://www.reddit.com/user/Repulsive_Hotel555)
[link] (https://www.reddit.com/r/Pentesting/comments/1nwzidt/every_offensive_security_course_avl/) [comments] (https://www.reddit.com/r/Pentesting/comments/1nwzidt/every_offensive_security_course_avl/)
https://www.reddit.com/r/Pentesting/comments/1nwzidt/every_offensive_security_course_avl/
<!-- SC_OFF -->If anybody wants offensive security course contents which includes pdfs and videos Contact me , i have them . I just want to help the community. <!-- SC_ON --> submitted by /u/Repulsive_Hotel555 (https://www.reddit.com/user/Repulsive_Hotel555)
[link] (https://www.reddit.com/r/Pentesting/comments/1nwzidt/every_offensive_security_course_avl/) [comments] (https://www.reddit.com/r/Pentesting/comments/1nwzidt/every_offensive_security_course_avl/)
Production Security, Not That Kind
https://www.reddit.com/r/Pentesting/comments/1nx98ym/production_security_not_that_kind/
https://www.reddit.com/r/Pentesting/comments/1nx98ym/production_security_not_that_kind/
<!-- SC_OFF -->Hi everyone, in our latest post we look under the hood of a professional-grade audio mixer to explore its security profile and consider how vulnerabilities could be leveraged by an attacker in a real world setting. <!-- SC_ON --> submitted by /u/IncludeSec (https://www.reddit.com/user/IncludeSec)
[link] (https://blog.includesecurity.com/2025/10/production-security-not-that-kind/) [comments] (https://www.reddit.com/r/Pentesting/comments/1nx98ym/production_security_not_that_kind/)
[link] (https://blog.includesecurity.com/2025/10/production-security-not-that-kind/) [comments] (https://www.reddit.com/r/Pentesting/comments/1nx98ym/production_security_not_that_kind/)
AI vs AI: How ChatGPT and I Became Bug Hunting Buddies to Find What Scanners Missed
Hey there!😁Continue reading on Medium »
Read more...
Hey there!😁Continue reading on Medium »
Read more...
Medium
🤖 AI vs AI: How ChatGPT and I Became Bug Hunting Buddies to Find What Scanners Missed
Hey there!😁
AI vs AI: How ChatGPT and I Became Bug Hunting Buddies to Find What Scanners Missed
https://medium.com/@iski/ai-vs-ai-how-chatgpt-and-i-became-bug-hunting-buddies-to-find-what-scanners-missed-806b61707131?source=rss------bug_bounty-5
https://medium.com/@iski/ai-vs-ai-how-chatgpt-and-i-became-bug-hunting-buddies-to-find-what-scanners-missed-806b61707131?source=rss------bug_bounty-5
Hey there!😁Continue reading on Medium » (https://medium.com/@iski/ai-vs-ai-how-chatgpt-and-i-became-bug-hunting-buddies-to-find-what-scanners-missed-806b61707131?source=rss------bug_bounty-5)
Cache Crash: How I Poisoned CDN Responses and Became Every User Simultaneously
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Medium
🚀 Cache Crash: How I Poisoned CDN Responses and Became Every User Simultaneously
Hey there!😁
Token Trouble: How Leaked JWTs Let Me Become Everyone on the Internet
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Medium
🎯 Token Trouble: How Leaked JWTs Let Me Become Everyone on the Internet
Hey there!😁
Cowsay as a Service (CaaS) — PicoCTF Walkthrough
Cowsay as a Service (CaaS) — PicoCTF Walkthroughcowsay as a serviceHello everyone! Welcome to my very first CTF walkthrough that I’m excited to share with you today. This particular challenge stood out to me as one of the more interesting ones, and I had a great time working through it. So, without further ado, let’s dive into the solving process!Challenge Overview In this CTF challenge, we’re introduced to a quirky little web service called Cowsay as a Service (CaaS). The functionality is simple: whatever input we give in the URL, it will be displayed using the classic `cowsay` ASCII art format. For example, visiting the following URL: https://caas.mars.picoctf.net/cowsay/<message> will result in:How it works?Looks innocent, right?🕵️♂️ Time to Explore The key part of the challenge lies in how the user input (`{message}` in the URL) is being handled. The fact that the text we pass in gets echoed in the output hints at potential command injection. Given the use of backticks (`) is a feature in Bash command substitution, it’s worth testing to see if we can run actual shell commands through the input field. Let’s try something simple: https://caas.mars.picoctf.net/cowsay/`ls` Output:Infected input — `ls` 💥 Boom! — We just executed `ls` on the server! That means the input is being passed directly to a shell without sanitization.🏁 Finding the Flag From the directory listing above, we can see a file named `falg.txt`. It seems like a typo for `flag.txt`, but hey — CTFs love to keep us on our toes. Let’s try to read it: ``` https://caas.mars.picoctf.net/cowsay/`cat falg.txt` ``` And the result:Infected input — `cat falg.txt`🎉 Flag Captured!🎉 Flag Captured!What We LearnedAlways test how user input is handled, especially in URL paths.Command injection is a common web vulnerability — and a dangerous one if not mitigated.Bash features like command substitution (` `) can be powerful tools in CTF challenges.Final Thoughts This was a fun and lighthearted challenge that combined humor with core cybersecurity concepts. The use of `cowsay` made it a bit more entertaining than your average command injection problem, and I really enjoyed solving it.Thanks for reading, and stay tuned for more CTF walkthroughs! Cowsay as a Service (CaaS) — PicoCTF Walkthrough was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Cowsay as a Service (CaaS) — PicoCTF Walkthroughcowsay as a serviceHello everyone! Welcome to my very first CTF walkthrough that I’m excited to share with you today. This particular challenge stood out to me as one of the more interesting ones, and I had a great time working through it. So, without further ado, let’s dive into the solving process!Challenge Overview In this CTF challenge, we’re introduced to a quirky little web service called Cowsay as a Service (CaaS). The functionality is simple: whatever input we give in the URL, it will be displayed using the classic `cowsay` ASCII art format. For example, visiting the following URL: https://caas.mars.picoctf.net/cowsay/<message> will result in:How it works?Looks innocent, right?🕵️♂️ Time to Explore The key part of the challenge lies in how the user input (`{message}` in the URL) is being handled. The fact that the text we pass in gets echoed in the output hints at potential command injection. Given the use of backticks (`) is a feature in Bash command substitution, it’s worth testing to see if we can run actual shell commands through the input field. Let’s try something simple: https://caas.mars.picoctf.net/cowsay/`ls` Output:Infected input — `ls` 💥 Boom! — We just executed `ls` on the server! That means the input is being passed directly to a shell without sanitization.🏁 Finding the Flag From the directory listing above, we can see a file named `falg.txt`. It seems like a typo for `flag.txt`, but hey — CTFs love to keep us on our toes. Let’s try to read it: ``` https://caas.mars.picoctf.net/cowsay/`cat falg.txt` ``` And the result:Infected input — `cat falg.txt`🎉 Flag Captured!🎉 Flag Captured!What We LearnedAlways test how user input is handled, especially in URL paths.Command injection is a common web vulnerability — and a dangerous one if not mitigated.Bash features like command substitution (` `) can be powerful tools in CTF challenges.Final Thoughts This was a fun and lighthearted challenge that combined humor with core cybersecurity concepts. The use of `cowsay` made it a bit more entertaining than your average command injection problem, and I really enjoyed solving it.Thanks for reading, and stay tuned for more CTF walkthroughs! Cowsay as a Service (CaaS) — PicoCTF Walkthrough was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Errors to API Exposure
Error Based Hunting for API ExposureContinue reading on InfoSec Write-ups »
Read more...
Error Based Hunting for API ExposureContinue reading on InfoSec Write-ups »
Read more...
Medium
Errors to API Exposure
Error Based Hunting for API Exposure
CORS Misadventures: How Misconfigured Origins Turned Me Into an Accidental Admin
Free Link 🎈Continue reading on InfoSec Write-ups »
Read more...
Free Link 🎈Continue reading on InfoSec Write-ups »
Read more...
Medium
🎩 CORS Misadventures: How Misconfigured Origins Turned Me Into an Accidental Admin
Free Link 🎈
How Blind XSS Payloads Earned Me $10,000+ in Bug Bounties
The patient hunter’s guide to finding vulnerabilitiesContinue reading on InfoSec Write-ups »
Read more...
The patient hunter’s guide to finding vulnerabilitiesContinue reading on InfoSec Write-ups »
Read more...
Medium
How Blind XSS Payloads Earned Me $10,000+ in Bug Bounties
The patient hunter’s guide to finding vulnerabilities
The Mirage of Automation: When Your Tools Start Thinking For You
Automation was supposed to make hacking smarter. Instead, for many, it made thinking optional.Continue reading on Medium »
Read more...
Automation was supposed to make hacking smarter. Instead, for many, it made thinking optional.Continue reading on Medium »
Read more...
Medium
The Mirage of Automation: When Your Tools Start Thinking For You 🤖
Automation was supposed to make hacking smarter. Instead, for many, it made thinking optional.
How Blind XSS Payloads Earned Me $10,000+ in Bug Bounties
https://infosecwriteups.com/how-blind-xss-payloads-earned-me-10-000-in-bug-bounties-70789f3940f9?source=rss------bug_bounty-5
https://infosecwriteups.com/how-blind-xss-payloads-earned-me-10-000-in-bug-bounties-70789f3940f9?source=rss------bug_bounty-5
The patient hunter’s guide to finding vulnerabilitiesContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-blind-xss-payloads-earned-me-10-000-in-bug-bounties-70789f3940f9?source=rss------bug_bounty-5)
The Mirage of Automation: When Your Tools Start Thinking For You
https://su6osec.medium.com/the-mirage-of-automation-when-your-tools-start-thinking-for-you-c02465b8f4d2?source=rss------bug_bounty-5
https://su6osec.medium.com/the-mirage-of-automation-when-your-tools-start-thinking-for-you-c02465b8f4d2?source=rss------bug_bounty-5
Automation was supposed to make hacking smarter. Instead, for many, it made thinking optional.Continue reading on Medium » (https://su6osec.medium.com/the-mirage-of-automation-when-your-tools-start-thinking-for-you-c02465b8f4d2?source=rss------bug_bounty-5)
How Blind XSS Payloads Earned Me $10,000+ in Bug Bounties
The patient hunter’s guide to finding vulnerabilitiesContinue reading on InfoSec Write-ups »
Read more...
The patient hunter’s guide to finding vulnerabilitiesContinue reading on InfoSec Write-ups »
Read more...
Medium
How Blind XSS Payloads Earned Me $10,000+ in Bug Bounties
The patient hunter’s guide to finding vulnerabilities