Broken Link Hijacking: That One Bug Everyone Ignores (Until It Pays )

Let me guess.Continue reading on Medium »
Read more...

Retour d’expérience sur la HTB CWES

Après avoir décroché la certification HTB Certified Web Exploitation Specialist (CWES), je reviens sur mon parcours, ma préparation et mes…Continue reading on Medium »
Read more...

Homoglyph-based Email Identity Collision in a Secure Email Platform

🐦‍🔥 Platform OverviewContinue reading on Medium »
Read more...

2. OAuth Misbinding Vulnerability
https://infosecwriteups.com/2-oauth-misbinding-vulnerability-ed0e0830bdde?source=rss------bug_bounty-5

The Silent Account Takeover Nobody Notices.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/2-oauth-misbinding-vulnerability-ed0e0830bdde?source=rss------bug_bounty-5)

ReconFTW : automatiser la reconnaissance pour une surface d’attaque complète
https://medium.com/bug-bounty-hunting-a-comprehensive-guide-in/reconftw-automatiser-la-reconnaissance-pour-une-surface-dattaque-compl%C3%A8te-e3a474ecc92d?source=rss------bug_bounty-5

🔎 Introduction à ReconFTW — la reconnaissance automatisée pour les chercheurs en sécuritéContinue reading on Bug Bounty Hunting: A Comprehensive Guide in English and french » (https://medium.com/bug-bounty-hunting-a-comprehensive-guide-in/reconftw-automatiser-la-reconnaissance-pour-une-surface-dattaque-compl%C3%A8te-e3a474ecc92d?source=rss------bug_bounty-5)

How I Got My First Real Attention in Bug Bounty (And Why This Matters More Than Money)
https://medium.com/@nayan12cr7/how-i-got-my-first-real-attention-in-bug-bounty-and-why-this-matters-more-than-money-702982e924ba?source=rss------bug_bounty-5

Bug bounty hunting can feel like shouting into the void sometimes. You spend hours, days, even weeks hunting for vulnerabilities, writing…Continue reading on Medium » (https://medium.com/@nayan12cr7/how-i-got-my-first-real-attention-in-bug-bounty-and-why-this-matters-more-than-money-702982e924ba?source=rss------bug_bounty-5)

CVE-2026–0800: Unauthenticated Stored Cross-Site Scripting in User Submitted Posts WordPress Plugin
https://balax01.medium.com/cve-2026-0800-unauthenticated-stored-cross-site-scripting-in-user-submitted-posts-wordpress-plugin-303cfeecee1f?source=rss------bug_bounty-5

Hi, I’m Balamurugan R.
 I am currently an unemployed cybersecurity student and an independent security researcher.Continue reading on Medium » (https://balax01.medium.com/cve-2026-0800-unauthenticated-stored-cross-site-scripting-in-user-submitted-posts-wordpress-plugin-303cfeecee1f?source=rss------bug_bounty-5)

How I Earned a 4-Digit Bounty: Complete Account Takeover via Insecure Session Cookie
https://adityasunny06.medium.com/how-i-earned-a-4-digit-bounty-complete-account-takeover-via-insecure-session-cookie-75d1992c9367?source=rss------bug_bounty-5

TL;DR: A missing `Secure` flag on a session cookie led to a complete account takeover vulnerability on a popular AI-powered SaaS platform…Continue reading on Medium » (https://adityasunny06.medium.com/how-i-earned-a-4-digit-bounty-complete-account-takeover-via-insecure-session-cookie-75d1992c9367?source=rss------bug_bounty-5)

CRTP - how did you study?
https://www.reddit.com/r/redteamsec/comments/1qowexe/crtp_how_did_you_study/

<!-- SC_OFF -->I’m currently preparing for the CRTP certification and I’d really appreciate some advice from people who already went through it. A bit of background: I already have OSCP, so I’m comfortable with hands-on learning and lab-driven study. I’m not sure about the best approach for CRTP: • Is it better to go through all the video lessons first and then do the labs? • Or does it make more sense to alternate between video lessons and labs (study a section → do the related lab → move on)? One important thing about me: I really struggle with long video lessons — I get distracted very easily. Slides + practice work much better for me than passive watching but I’m not sure is enough. Any advice, study plans, or lessons learned from your CRTP journey would be super appreciated <!-- SC_ON --> submitted by /u/th3d4rkp4ss3ng3r (https://www.reddit.com/user/th3d4rkp4ss3ng3r)
[link] (https://www.alteredsecurity.com/crtp-bootcamp) [comments] (https://www.reddit.com/r/redteamsec/comments/1qowexe/crtp_how_did_you_study/)

GitHub - dereeqw/BlackBerryC2: Encrypted command‑and‑control (C2) research framework for cybersecurity education, red team labs, and secure client‑server communication experiments.
https://www.reddit.com/r/redteamsec/comments/1qp35jc/github_dereeqwblackberryc2_encrypted/

<!-- SC_OFF -->BlackBerryC2 v1.7 – Encrypted C2 Framework (Compiled) Encrypted Command & Control framework using AES-GCM + RSA-2048. Features: End-to-end encryption (AES-GCM + RSA-2048) TLS / HTTP / HTTPS proxy daemon & GUI Recursive file transfers with compression Anti-scan protection & IP blocking 🔗 GitHub (compiled version): https://github.com/dereeqw/BlackBerryC2 Built for security research and penetration testing. NetSpy – Encrypted C2 Framework (Source Code) Open-source C2 framework written in Python 3.3+, compatible with any system that supports Python. 🔗 GitHub (source code): https://github.com/dereeqw/NetSpy <!-- SC_ON --> submitted by /u/Key-Reserve-5645 (https://www.reddit.com/user/Key-Reserve-5645)
[link] (https://github.com/dereeqw/BlackBerryC2) [comments] (https://www.reddit.com/r/redteamsec/comments/1qp35jc/github_dereeqwblackberryc2_encrypted/)

Thread-Hijack Supply Chain Phishing: Analysis of EvilProxy Campaign
https://www.reddit.com/r/redteamsec/comments/1qpa5wk/threadhijack_supply_chain_phishing_analysis_of/

<!-- SC_OFF -->TL;DR Initial access: Likely compromise of a contractor mailbox already involved in the thread, enabling conversation hijacking inside a real C-suite approval flow. Attack chain: SCA phishing email → 7x forwards → phishing link → Cloudflare Turnstile antibot page → Turnstile-protected phishing page → EvilProxy AiTM for Microsoft credential theft. Evasion: Multi-step redirects + Turnstile mean the final phishing content is only exposed during real execution, not simple URL or static checks. Detection: Behavioral detonation is required to see the full chain and confirm intent; static analysis alone is unlikely to flag it reliably. <!-- SC_ON --> submitted by /u/malwaredetector (https://www.reddit.com/user/malwaredetector)
[link] (https://any.run/cybersecurity-blog/enterprise-email-thread-phishing/?utm_source=reddit) [comments] (https://www.reddit.com/r/redteamsec/comments/1qpa5wk/threadhijack_supply_chain_phishing_analysis_of/)

What still shows up in Windows memory after basic execution
https://www.reddit.com/r/redteamsec/comments/1qpesfw/what_still_shows_up_in_windows_memory_after_basic/

<!-- SC_OFF -->I’ve been spending some time looking at Windows memory from the other side and trying to sanity check what actually shows up after basic execution and post compromise activity. The goal wasn’t deep malware analysis or evasion research, more just understanding what artefacts are realistically visible in memory if a defender pulls a dump and starts poking around. I went through process listings, command line history, parent child relationships and a few other common areas to see what stands out quickly versus what ends up being noisy or not that useful early on. A couple of things surprised me, mainly how much context is still there even without doing anything fancy, and how easy it is to get distracted by data that looks interesting but doesn’t really move the investigation forward. This was done in a small lab rather than a hardened environment, but I’m curious how others approach this from a red team perspective. Are there particular behaviours or artefacts you deliberately try to avoid leaving behind, or do you mostly assume memory is burned once it’s captured anyway? Happy to hear how others think about this. <!-- SC_ON --> submitted by /u/Glass-Ant-6041 (https://www.reddit.com/user/Glass-Ant-6041)
[link] (https://youtu.be/BDk4YlyMRKw?si=-pK__AiJRpKBIIQN) [comments] (https://www.reddit.com/r/redteamsec/comments/1qpesfw/what_still_shows_up_in_windows_memory_after_basic/)

Is Evilginx still good?
https://www.reddit.com/r/redteamsec/comments/1qph9zw/is_evilginx_still_good/

<!-- SC_OFF -->I’ve gone through most of the usual hardening steps: such as Cloudflare/Turnstile, removing obvious IOCs, disabling the Easter egg, and using my own wildcard cert — and I’m still having trouble getting consistent results. At this point, I can’t tell if the issue is the fact that I might need the pro version, if my phishlets are incorrect, or if most sites have simply rolled out much stronger protections overall. The only platform where I’ve had somewhat success with O365; but usually it has been hit-or-miss at best. Any insight? <!-- SC_ON --> submitted by /u/Littlemike0712 (https://www.reddit.com/user/Littlemike0712)
[link] (https://github.com/kgretzky/evilginx2) [comments] (https://www.reddit.com/r/redteamsec/comments/1qph9zw/is_evilginx_still_good/)

Bug Bounty Tutorial
https://www.reddit.com/r/Pentesting/comments/1qpa1jd/bug_bounty_tutorial/

<!-- SC_OFF -->Hello! I created this repository with great enthusiasm, covering a wide range of topics on cybersecurity and bug hunting! Visit it and tell me what you think. If you find it useful, give me a star! I’ve just pushed a massive update to the Hacking-Cheatsheets repository. We are moving beyond network pentesting into full-scale Web Application Security. I have organized a complete methodology for Bug Hunting, covering everything from Recon to Advanced Exploitation. 🔥 New Categories Include: ✅ Automation: Nuclei, ffuf, Subfinder, Katana & more. ✅ Payloads: Quick references for XSS, SQLi, SSTI, and LFI. ✅ Advanced Techniques: WAF Bypass, HTTP Request Smuggling, Prototype Pollution & Race Conditions. ✅ Vulnerabilities: In-depth guides for IDOR, SSRF, and API Security. Whether you are hunting on HackerOne or doing a pentest, having these commands ready is a game-changer. 👇 Check it out and please drop a ⭐ STAR on the repo if you find it useful! https://github.com/Ilias1988/Hacking-Cheatsheets <!-- SC_ON --> submitted by /u/Elliot-1988 (https://www.reddit.com/user/Elliot-1988)
[link] (https://www.reddit.com/gallery/1qpa1jd) [comments] (https://www.reddit.com/r/Pentesting/comments/1qpa1jd/bug_bounty_tutorial/)