How weak JWT algorithm handling exposes admin-level access without leaking a private key.Continue reading on MeetCyber » (https://medium.com/meetcyber/jwt-authentication-bypass-via-algorithm-confusion-with-no-exposed-key-a9958117b6a2?source=rss------bug_bounty-5)
The Unconventional OSINT: How Dark Web Tools Gave Me the Edge to Find a $ Bug ️♂️
https://infosecwriteups.com/the-unconventional-osint-how-dark-web-tools-gave-me-the-edge-to-find-a-bug-%EF%B8%8F-%EF%B8%8F-29397e2d6a1a?source=rss------bug_bounty-5
https://infosecwriteups.com/the-unconventional-osint-how-dark-web-tools-gave-me-the-edge-to-find-a-bug-%EF%B8%8F-%EF%B8%8F-29397e2d6a1a?source=rss------bug_bounty-5
Free Link🎈Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/the-unconventional-osint-how-dark-web-tools-gave-me-the-edge-to-find-a-bug-%EF%B8%8F-%EF%B8%8F-29397e2d6a1a?source=rss------bug_bounty-5)
Backdoor CTF-2025: Flask of Cookies writeup | by Dargham Ali
https://medium.com/@wireshark.pcap/backdoor-ctf-2025-flask-of-cookies-writeup-by-dargham-ali-fcd81b892608?source=rss------bug_bounty-5
https://medium.com/@wireshark.pcap/backdoor-ctf-2025-flask-of-cookies-writeup-by-dargham-ali-fcd81b892608?source=rss------bug_bounty-5
Flask of Cookies WEB writeup by Dargham Ali for Backdoor CTF 2025: exploiting weak Flask SECRET_KEY to forge admin session cookie.Continue reading on Medium » (https://medium.com/@wireshark.pcap/backdoor-ctf-2025-flask-of-cookies-writeup-by-dargham-ali-fcd81b892608?source=rss------bug_bounty-5)
ISP/router blocking pentesting tools in Germany?
https://www.reddit.com/r/Pentesting/comments/1ph96ha/isprouter_blocking_pentesting_tools_in_germany/
<!-- SC_OFF -->Hello guys! I have recently moved to Germany from Russia, and I have recently discovered that my ISP (or maybe it's the router?) is limiting a lot of stuff regarding evil-winrm, reverse shells, uploading files to victim machines, ssh, and much more. How do people in Germany deal with this? What do I need to do - do people contact their ISP and tell them about it, or do I need to configure something in the router? Is there an article where I can read about this? LLMs were pretty useless in this regard. Any help would be appreciated! <!-- SC_ON --> submitted by /u/strikoder (https://www.reddit.com/user/strikoder)
[link] (https://www.reddit.com/r/Pentesting/comments/1ph96ha/isprouter_blocking_pentesting_tools_in_germany/) [comments] (https://www.reddit.com/r/Pentesting/comments/1ph96ha/isprouter_blocking_pentesting_tools_in_germany/)
https://www.reddit.com/r/Pentesting/comments/1ph96ha/isprouter_blocking_pentesting_tools_in_germany/
<!-- SC_OFF -->Hello guys! I have recently moved to Germany from Russia, and I have recently discovered that my ISP (or maybe it's the router?) is limiting a lot of stuff regarding evil-winrm, reverse shells, uploading files to victim machines, ssh, and much more. How do people in Germany deal with this? What do I need to do - do people contact their ISP and tell them about it, or do I need to configure something in the router? Is there an article where I can read about this? LLMs were pretty useless in this regard. Any help would be appreciated! <!-- SC_ON --> submitted by /u/strikoder (https://www.reddit.com/user/strikoder)
[link] (https://www.reddit.com/r/Pentesting/comments/1ph96ha/isprouter_blocking_pentesting_tools_in_germany/) [comments] (https://www.reddit.com/r/Pentesting/comments/1ph96ha/isprouter_blocking_pentesting_tools_in_germany/)
Good ways to pentest Macs?
https://www.reddit.com/r/Pentesting/comments/1phx87s/good_ways_to_pentest_macs/
<!-- SC_OFF -->Title sums it up. I have been thinking about using badusb as something simple for testing users but wanted some input. I am kind of limited in the scope of what I am allowed to do. <!-- SC_ON --> submitted by /u/West_Atmosphere_9601 (https://www.reddit.com/user/West_Atmosphere_9601)
[link] (https://www.reddit.com/r/Pentesting/comments/1phx87s/good_ways_to_pentest_macs/) [comments] (https://www.reddit.com/r/Pentesting/comments/1phx87s/good_ways_to_pentest_macs/)
https://www.reddit.com/r/Pentesting/comments/1phx87s/good_ways_to_pentest_macs/
<!-- SC_OFF -->Title sums it up. I have been thinking about using badusb as something simple for testing users but wanted some input. I am kind of limited in the scope of what I am allowed to do. <!-- SC_ON --> submitted by /u/West_Atmosphere_9601 (https://www.reddit.com/user/West_Atmosphere_9601)
[link] (https://www.reddit.com/r/Pentesting/comments/1phx87s/good_ways_to_pentest_macs/) [comments] (https://www.reddit.com/r/Pentesting/comments/1phx87s/good_ways_to_pentest_macs/)
Open Call for Contributors: Democratizing Ransomware Recovery Knowledge
https://www.reddit.com/r/redteamsec/comments/1phxvw5/open_call_for_contributors_democratizing/
<!-- SC_OFF -->https://github.com/subodhss23/ransomware-recovery-wiki The Ransomware Recovery Wiki is now opening up for community contributions, ideas, and direction. The mission is simple but urgent: to build a free, open, and practical resource that anyone can use — especially individuals, nonprofits, schools, small businesses, and teams without enterprise-level budgets or access to expensive incident-response services. Ransomware preparedness shouldn’t be a luxury. It should be accessible to everyone. Right now, the most critical knowledge in ransomware response and recovery is locked behind paywalls, consultant reports, or high-priced services costing tens or hundreds of thousands of dollars. Many organizations don’t know where to start, what tools they need, or what steps to take before or after an attack. By contributing — whether through guides, tools, checklists, research, or real-world lessons — you can help create a community-driven resource that empowers those who need it most. I invite you to join and help build something truly impactful. <!-- SC_ON --> submitted by /u/LastReporter2966 (https://www.reddit.com/user/LastReporter2966)
[link] (https://github.com/subodhss23/ransomware-recovery-wiki) [comments] (https://www.reddit.com/r/redteamsec/comments/1phxvw5/open_call_for_contributors_democratizing/)
https://www.reddit.com/r/redteamsec/comments/1phxvw5/open_call_for_contributors_democratizing/
<!-- SC_OFF -->https://github.com/subodhss23/ransomware-recovery-wiki The Ransomware Recovery Wiki is now opening up for community contributions, ideas, and direction. The mission is simple but urgent: to build a free, open, and practical resource that anyone can use — especially individuals, nonprofits, schools, small businesses, and teams without enterprise-level budgets or access to expensive incident-response services. Ransomware preparedness shouldn’t be a luxury. It should be accessible to everyone. Right now, the most critical knowledge in ransomware response and recovery is locked behind paywalls, consultant reports, or high-priced services costing tens or hundreds of thousands of dollars. Many organizations don’t know where to start, what tools they need, or what steps to take before or after an attack. By contributing — whether through guides, tools, checklists, research, or real-world lessons — you can help create a community-driven resource that empowers those who need it most. I invite you to join and help build something truly impactful. <!-- SC_ON --> submitted by /u/LastReporter2966 (https://www.reddit.com/user/LastReporter2966)
[link] (https://github.com/subodhss23/ransomware-recovery-wiki) [comments] (https://www.reddit.com/r/redteamsec/comments/1phxvw5/open_call_for_contributors_democratizing/)
Known-Plaintext Attack on PHP-Proxy: From Broken Encryption to FastCGI RCE
How a Caesar cipher implementation turned URL encryption into a complete server compromise through known-plaintext attack and FastCGI…Continue reading on Medium »
Read more...
How a Caesar cipher implementation turned URL encryption into a complete server compromise through known-plaintext attack and FastCGI…Continue reading on Medium »
Read more...
Medium
Known-Plaintext Attack on PHP-Proxy: From Broken Encryption to FastCGI RCE
How a Caesar cipher implementation turned URL encryption into a complete server compromise through known-plaintext attack and FastCGI…
The Best Vulnerability Disclosure Programs (VDP): A 2026 Guide for Security Researchers
Meta Description (SEO): Discover the best Vulnerability Disclosure Programs (VDPs) in 2026, including top platforms, pros & cons, and…Continue reading on Bug Bounty Hunting: A Comprehensive Guide in English and french »
Read more...
Meta Description (SEO): Discover the best Vulnerability Disclosure Programs (VDPs) in 2026, including top platforms, pros & cons, and…Continue reading on Bug Bounty Hunting: A Comprehensive Guide in English and french »
Read more...
Medium
The Best Vulnerability Disclosure Programs (VDP): A 2026 Guide for Security Researchers
Meta Description (SEO):
Discover the best Vulnerability Disclosure Programs (VDPs) in 2026, including top platforms, pros & cons, and…
Discover the best Vulnerability Disclosure Programs (VDPs) in 2026, including top platforms, pros & cons, and…
Internal vs External Pentest: 12 Tools Clients Don’t Know Exist (and How Pros Use Them)
Ever sat across from a client, nodding as they ask about “just running Nessus or nmap” for their pentest? Here’s a stat: 80% of successful…Continue reading on Medium »
Read more...
Ever sat across from a client, nodding as they ask about “just running Nessus or nmap” for their pentest? Here’s a stat: 80% of successful…Continue reading on Medium »
Read more...
Medium
Internal vs External Pentest: 12 Tools Clients Don’t Know Exist (and How Pros Use Them)
Ever sat across from a client, nodding as they ask about “just running Nessus or nmap” for their pentest? Here’s a stat: 80% of successful…
DoS on a live streaming and chatting App (Ethically).
Assalam-O-Alaikum , I hope you are doing well. Today, I will share one of my DoS findings and walk you through the idea behind it. I hope…Continue reading on Medium »
Read more...
Assalam-O-Alaikum , I hope you are doing well. Today, I will share one of my DoS findings and walk you through the idea behind it. I hope…Continue reading on Medium »
Read more...
Medium
DoS on a live streaming and chatting App (Ethically).
Assalam-O-Alaikum , I hope you are doing well. Today, I will share one of my DoS findings and walk you through the idea behind it. I hope…
How I Made $5,000 (₹4.49 Lakh) in Just 1 Hour by Scanning JavaScript Files
Hi everyone, It’s been a while since I published something useful, so here’s a quick write-up of how I made $5,000 in about one hour of…Continue reading on Medium »
Read more...
Hi everyone, It’s been a while since I published something useful, so here’s a quick write-up of how I made $5,000 in about one hour of…Continue reading on Medium »
Read more...
Medium
How I Made $5,000 (₹4.49 Lakh) in Just 1 Hour by Scanning JavaScript Files
Hi everyone,
It’s been a while since I published something useful, so here’s a quick write-up of how I made $5,000 in about one hour of…
It’s been a while since I published something useful, so here’s a quick write-up of how I made $5,000 in about one hour of…
API Breach Forensics Toolkit: Step-by-Step Tools to Uncover Every Hidden Threat
Ever heard about the 2023 API breach that exposed millions of private records in under 24 hours? It wasn’t some fancy zero-day — it was a…Continue reading on Medium »
Read more...
Ever heard about the 2023 API breach that exposed millions of private records in under 24 hours? It wasn’t some fancy zero-day — it was a…Continue reading on Medium »
Read more...
Medium
API Breach Forensics Toolkit: Step-by-Step Tools to Uncover Every Hidden Threat
Ever heard about the 2023 API breach that exposed millions of private records in under 24 hours? It wasn’t some fancy zero-day — it was a…
Bug Bounty Hunting — Complete Guide (Part-158)
🎨 RGB (Red-Green-Blue) Color ModelContinue reading on Medium »
Read more...
🎨 RGB (Red-Green-Blue) Color ModelContinue reading on Medium »
Read more...
Medium
Bug Bounty Hunting — Complete Guide (Part-158)
🎨 RGB (Red-Green-Blue) Color Model
Bug Bounty Hunting — Complete Guide (Part-159)
📱 RIL (Radio Interface Layer) ExplainedContinue reading on Medium »
Read more...
📱 RIL (Radio Interface Layer) ExplainedContinue reading on Medium »
Read more...
Medium
Bug Bounty Hunting — Complete Guide (Part-159)
📱 RIL (Radio Interface Layer) Explained
I got €€ for finding a bug that others missed
I was hunting on a self-hosted program and trying to understand the application as it was a sass platform.Continue reading on Medium »
Read more...
I was hunting on a self-hosted program and trying to understand the application as it was a sass platform.Continue reading on Medium »
Read more...
Medium
I got €€ for finding a bug that others missed
I was hunting on a self-hosted program and trying to understand the application as it was a sass platform.
Discovering Cloud Misconfigurations with Google Dorks
Find exposed sensitive data in AWS, Google Cloud, and other platforms when private information becomes searchable on Google.Continue reading on InfoSec Write-ups »
Read more...
Find exposed sensitive data in AWS, Google Cloud, and other platforms when private information becomes searchable on Google.Continue reading on InfoSec Write-ups »
Read more...
Medium
Discovering Cloud Misconfigurations with Google Dorks
Find exposed sensitive data in AWS, Google Cloud, and other platforms when private information becomes searchable on Google.
Members Can Prevent Admins/Owners from Accessing Reviews via Manipulated UUID
DescriptionContinue reading on Medium »
Read more...
DescriptionContinue reading on Medium »
Read more...
Medium
Members Can Prevent Admins/Owners from Accessing Reviews via Manipulated UUID
Description
This bug take to me 4 days to understand how is work
إِنَّ اللَّهَ وَمَلَائِكَتَهُ يُصَلُّونَ عَلَى النَّبِيِّ ۚ يَا أَيُّهَا الَّذِينَ آمَنُوا صَلُّوا عَلَيْهِ وَسَلِّمُوا تَسْلِيمًاContinue reading on Medium »
Read more...
إِنَّ اللَّهَ وَمَلَائِكَتَهُ يُصَلُّونَ عَلَى النَّبِيِّ ۚ يَا أَيُّهَا الَّذِينَ آمَنُوا صَلُّوا عَلَيْهِ وَسَلِّمُوا تَسْلِيمًاContinue reading on Medium »
Read more...
Medium
This bug take to me 4 days to understand how is work
إِنَّ اللَّهَ وَمَلَائِكَتَهُ يُصَلُّونَ عَلَى النَّبِيِّ ۚ يَا أَيُّهَا الَّذِينَ آمَنُوا صَلُّوا عَلَيْهِ وَسَلِّمُوا تَسْلِيمًا