📌 IntroductionContinue reading on Medium » (https://medium.com/@Hasan_khan0x/idor-vulnerability-in-campaign-workflows-accessing-archived-campaigns-of-any-user-150-f24b46c0cf59?source=rss------bug_bounty-5)

Meet ReVex: The Cyberpunk HTTP Repeater that lives in your DevTools ☠
https://medium.com/@medjahdii/meet-revex-the-cyberpunk-http-repeater-that-lives-in-your-devtools-4f648c8659e7?source=rss------bug_bounty-5

Why I built a lightweight “Burp Suite Lite” for Firefox to stop context-switching.Continue reading on Medium » (https://medium.com/@medjahdii/meet-revex-the-cyberpunk-http-repeater-that-lives-in-your-devtools-4f648c8659e7?source=rss------bug_bounty-5)

JS Recon to Uncover Hidden Web Vulnerabilities in Minutes — And How You Can Too

A Practical Guide to Finding Real-World Bugs Hidden Inside JavaScript FilesContinue reading on OSINT Team »
Read more...

JS Recon to Uncover Hidden Web Vulnerabilities in Minutes — And How You Can Too
https://osintteam.blog/js-recon-to-uncover-hidden-web-vulnerabilities-in-minutes-and-how-you-can-too-350b49b805c1?source=rss------bug_bounty-5

A Practical Guide to Finding Real-World Bugs Hidden Inside JavaScript FilesContinue reading on OSINT Team » (https://osintteam.blog/js-recon-to-uncover-hidden-web-vulnerabilities-in-minutes-and-how-you-can-too-350b49b805c1?source=rss------bug_bounty-5)

CTF Galaxy Dash Access JWT Private Key

Galaxy Dash recently rolled out new features to their application, and with that came a fresh security challenge. In this weekly lab, the…Continue reading on Medium »
Read more...

Static analyzer for ERC20 honeypot attack patterns
https://www.reddit.com/r/redteamsec/comments/1qsfeqy/static_analyzer_for_erc20_honeypot_attack_patterns/

submitted by /u/tcoder7 (https://www.reddit.com/user/tcoder7)
[link] (https://github.com/Teycir/honeypotscan) [comments] (https://www.reddit.com/r/redteamsec/comments/1qsfeqy/static_analyzer_for_erc20_honeypot_attack_patterns/)

[Research] Kernel-mode EDR PoC detecting undeclared DLL loads (static vs dynamic imports) — global & targeted modes
https://www.reddit.com/r/redteamsec/comments/1qswt3i/research_kernelmode_edr_poc_detecting_undeclared/

<!-- SC_OFF -->I’ve been building an experimental kernel-mode EDR as a learning/research project, and I just tagged v0.2. The idea is intentionally simple and explainable: Instead of blocking or scoring, the driver explains *why* a process looks suspicious. What v0.2 does: - Hooks process creation (PsSetCreateProcessNotifyRoutineEx) - Parses PE import table to build a static DLL baseline - Monitors runtime image loads (PsSetLoadImageNotifyRoutine) - Flags DLLs that are loaded dynamically but were never statically declared - Suppresses common Windows base DLLs to reduce noise - Supports **two modes**: - Global mode (observe everything) - Targeted mode (single binary only) This lets me answer questions like: “Why did this binary suddenly load wininet.dll / netutils.dll at runtime when it never declared them?” No blocking, no prevention — only signals + reasoning. This is strictly a research / lab PoC, not production EDR. GitHub (code + README): https://github.com/amberchalia/NORM-EDR I’d really appreciate feedback from red teamers / RE folks: - Is this signal actually useful? - What obvious bypasses should I expect? - What would you track next at kernel level? The next phase I’m planning is moving from “events” to an **intent graph** instead of flat alerts. <!-- SC_ON --> submitted by /u/amberchalia (https://www.reddit.com/user/amberchalia)
[link] (https://www.youtube.com/watch?v=8UJkUuJGNbI) [comments] (https://www.reddit.com/r/redteamsec/comments/1qswt3i/research_kernelmode_edr_poc_detecting_undeclared/)

CTF Galaxy Dash Access JWT Private Key
https://medium.com/@Mr3Moe/ctf-galaxy-dash-access-jwt-private-key-b83ad360f300?source=rss------bug_bounty-5

Galaxy Dash recently rolled out new features to their application, and with that came a fresh security challenge. In this weekly lab, the…Continue reading on Medium » (https://medium.com/@Mr3Moe/ctf-galaxy-dash-access-jwt-private-key-b83ad360f300?source=rss------bug_bounty-5)

Clickjacking 2025: 10 Tools Showing Real Impact (with Practical Guides)

Ever clicked a button online, only to realize — too late — that you triggered something you never agreed to? You’re not alone. In 2024…Continue reading on Medium »
Read more...

Clickjacking 2025: 10 Tools Showing Real Impact (with Practical Guides)
https://medium.com/@verylazytech/clickjacking-2025-10-tools-showing-real-impact-with-practical-guides-4e28741f0e51?source=rss------bug_bounty-5

Ever clicked a button online, only to realize — too late — that you triggered something you never agreed to? You’re not alone. In 2024…Continue reading on Medium » (https://medium.com/@verylazytech/clickjacking-2025-10-tools-showing-real-impact-with-practical-guides-4e28741f0e51?source=rss------bug_bounty-5)

One Token to Rule Them All: Persistent MFA Bypass via Trusted Client Abuse

🐦‍🔥 Platform OverviewContinue reading on Medium »
Read more...

Part 2: A Real-World Recon Workflow — One Command, Clean Results

Part 2: A Real-World Recon Workflow — One Command, Clean ResultsContinue reading on Bug Bounty Hunting: A Comprehensive Guide in English and french »
Read more...

I am having issues installing InQL on Kalilinux
https://www.reddit.com/r/Pentesting/comments/1qsonaa/i_am_having_issues_installing_inql_on_kalilinux/

<!-- SC_OFF -->It has been 2days now that im stuck on how to install InQL I readed their readme file on github, but i am still having i hard time to install it when i put “task all” there is no file that have been created. <!-- SC_ON --> submitted by /u/IntrepidPenalty4316 (https://www.reddit.com/user/IntrepidPenalty4316)
[link] (https://www.reddit.com/r/Pentesting/comments/1qsonaa/i_am_having_issues_installing_inql_on_kalilinux/) [comments] (https://www.reddit.com/r/Pentesting/comments/1qsonaa/i_am_having_issues_installing_inql_on_kalilinux/)