Advice Needed
https://www.reddit.com/r/Pentesting/comments/1rblymv/advice_needed/
<!-- SC_OFF -->Hey guys, I’ve just accepted a 6-month internship as a pentester at a quant company. For context, I recently passed the PNPT and I’m currently working through the HTB Academy CPTS modules while preparing for the OSCP. I’ve also been doing HTB boxes regularly. Recently, I tried doing some CVE hunting on an open-source CMS, and honestly I felt a bit lost. Do you have any tips on how I can better prepare for the internship and improve in general? Especially in terms of building more confidence and methodology with real-world testing and research. <!-- SC_ON --> submitted by /u/Dramatic_Fix5116 (https://www.reddit.com/user/Dramatic_Fix5116)
[link] (https://www.reddit.com/r/Pentesting/comments/1rblymv/advice_needed/) [comments] (https://www.reddit.com/r/Pentesting/comments/1rblymv/advice_needed/)
https://www.reddit.com/r/Pentesting/comments/1rblymv/advice_needed/
<!-- SC_OFF -->Hey guys, I’ve just accepted a 6-month internship as a pentester at a quant company. For context, I recently passed the PNPT and I’m currently working through the HTB Academy CPTS modules while preparing for the OSCP. I’ve also been doing HTB boxes regularly. Recently, I tried doing some CVE hunting on an open-source CMS, and honestly I felt a bit lost. Do you have any tips on how I can better prepare for the internship and improve in general? Especially in terms of building more confidence and methodology with real-world testing and research. <!-- SC_ON --> submitted by /u/Dramatic_Fix5116 (https://www.reddit.com/user/Dramatic_Fix5116)
[link] (https://www.reddit.com/r/Pentesting/comments/1rblymv/advice_needed/) [comments] (https://www.reddit.com/r/Pentesting/comments/1rblymv/advice_needed/)
How a Small Validation Bypass Enabled Invisible Identities
https://medium.com/@eng.mahmoudbughunter/how-a-small-validation-bypass-enabled-invisible-identities-cc600577b98d?source=rss------bug_bounty-5
https://medium.com/@eng.mahmoudbughunter/how-a-small-validation-bypass-enabled-invisible-identities-cc600577b98d?source=rss------bug_bounty-5
الحمد لله والصلاة والسلام على رسول الله وعلى آله وصحبه أما بعدContinue reading on Medium » (https://medium.com/@eng.mahmoudbughunter/how-a-small-validation-bypass-enabled-invisible-identities-cc600577b98d?source=rss------bug_bounty-5)
Chaining Bugs for Critical Impact: From Missing Rate Limit to Persistent ATO
https://medium.com/@k4r33m/chaining-bugs-for-critical-impact-from-missing-rate-limit-to-persistent-ato-7b856bfe20d7?source=rss------bug_bounty-5
When testing the authentication workflow of domain.tld, what started as a standard brute-force vulnerability quickly escalated into a…Continue reading on Medium » (https://medium.com/@k4r33m/chaining-bugs-for-critical-impact-from-missing-rate-limit-to-persistent-ato-7b856bfe20d7?source=rss------bug_bounty-5)
https://medium.com/@k4r33m/chaining-bugs-for-critical-impact-from-missing-rate-limit-to-persistent-ato-7b856bfe20d7?source=rss------bug_bounty-5
When testing the authentication workflow of domain.tld, what started as a standard brute-force vulnerability quickly escalated into a…Continue reading on Medium » (https://medium.com/@k4r33m/chaining-bugs-for-critical-impact-from-missing-rate-limit-to-persistent-ato-7b856bfe20d7?source=rss------bug_bounty-5)
Escalating a Duplicate Finding to a CVSS 10.0: Chaining Logic and Session Flaws for Persistent ATO
In bug bounty and penetration testing, a “duplicate” finding is often viewed as a dead end.Continue reading on Medium »
Read more...
In bug bounty and penetration testing, a “duplicate” finding is often viewed as a dead end.Continue reading on Medium »
Read more...
Medium
Escalating a Duplicate Finding to a CVSS 10.0: Chaining Logic and Session Flaws for Persistent ATO
In bug bounty and penetration testing, a “duplicate” finding is often viewed as a dead end. However, a duplicate bug is essentially a known…
Double Compromise: Unearthing Unauthenticated SSRF and Weaponized XSS on Legacy Oracle…
When assessing enterprise perimeters, legacy subdomains often hide complex architectural flaws. During a recent engagement targeting a…Continue reading on Medium »
Read more...
When assessing enterprise perimeters, legacy subdomains often hide complex architectural flaws. During a recent engagement targeting a…Continue reading on Medium »
Read more...
Medium
Double Compromise: Unearthing Unauthenticated SSRF and Weaponized XSS on Legacy Oracle Infrastructure
When assessing enterprise perimeters, legacy subdomains often hide complex architectural flaws. During a recent engagement targeting a…
Mining Wayback URLs for High-Impact Vulnerability Discovery
Hi everyone, let me start with a simple question.Continue reading on Medium »
Read more...
Hi everyone, let me start with a simple question.Continue reading on Medium »
Read more...
Medium
Mining Wayback URLs for High-Impact Vulnerability Discovery
Hi everyone, let me start with a simple question.
Full Organization Account Takeover (ATO) by Changing One Parameter
Sometimes, hacking is not about complex payloads.Continue reading on Medium »
Read more...
Sometimes, hacking is not about complex payloads.Continue reading on Medium »
Read more...
Medium
Full Organization Account Takeover (ATO) by Changing One Parameter
Sometimes, hacking is not about complex payloads.
How I Found a Business Logic Vulnerability in SaaS applicationThat Allowed Unlimited Trial…
Hey everyone, I’m Sreejith, a security researcher.Continue reading on Medium »
Read more...
Hey everyone, I’m Sreejith, a security researcher.Continue reading on Medium »
Read more...
Medium
How I Found a Business Logic Vulnerability in SaaS applicationThat Allowed Unlimited Trial…
Hey everyone, I’m Sreejith, a security researcher. In this writeup I’ll walk you through how I discovered a business logic vulnerability in…
Double Compromise: Unearthing Unauthenticated SSRF and Weaponized XSS on Legacy Oracle…
https://medium.com/@k4r33m/double-compromise-unearthing-unauthenticated-ssrf-and-weaponized-xss-on-legacy-oracle-d41ed9f7f7b8?source=rss------bug_bounty-5
When assessing enterprise perimeters, legacy subdomains often hide complex architectural flaws. During a recent engagement targeting a…Continue reading on Medium » (https://medium.com/@k4r33m/double-compromise-unearthing-unauthenticated-ssrf-and-weaponized-xss-on-legacy-oracle-d41ed9f7f7b8?source=rss------bug_bounty-5)
https://medium.com/@k4r33m/double-compromise-unearthing-unauthenticated-ssrf-and-weaponized-xss-on-legacy-oracle-d41ed9f7f7b8?source=rss------bug_bounty-5
When assessing enterprise perimeters, legacy subdomains often hide complex architectural flaws. During a recent engagement targeting a…Continue reading on Medium » (https://medium.com/@k4r33m/double-compromise-unearthing-unauthenticated-ssrf-and-weaponized-xss-on-legacy-oracle-d41ed9f7f7b8?source=rss------bug_bounty-5)
Mining Wayback URLs for High-Impact Vulnerability Discovery
https://medium.com/@nitinsgavane/mining-wayback-urls-for-high-impact-vulnerability-discovery-dfa6ebbe63aa?source=rss------bug_bounty-5
https://medium.com/@nitinsgavane/mining-wayback-urls-for-high-impact-vulnerability-discovery-dfa6ebbe63aa?source=rss------bug_bounty-5
Hi everyone, let me start with a simple question.Continue reading on Medium » (https://medium.com/@nitinsgavane/mining-wayback-urls-for-high-impact-vulnerability-discovery-dfa6ebbe63aa?source=rss------bug_bounty-5)
Full Organization Account Takeover (ATO) by Changing One Parameter
https://medium.com/@2os5/full-organization-account-takeover-ato-by-changing-one-parameter-9f67472d3138?source=rss------bug_bounty-5
https://medium.com/@2os5/full-organization-account-takeover-ato-by-changing-one-parameter-9f67472d3138?source=rss------bug_bounty-5
Sometimes, hacking is not about complex payloads.Continue reading on Medium » (https://medium.com/@2os5/full-organization-account-takeover-ato-by-changing-one-parameter-9f67472d3138?source=rss------bug_bounty-5)
How I Found a Business Logic Vulnerability in SaaS applicationThat Allowed Unlimited Trial…
https://medium.com/@sreejihkn43073/how-i-found-a-business-logic-vulnerability-in-saas-applicationthat-allowed-unlimited-trial-3f680a38f372?source=rss------bug_bounty-5
https://medium.com/@sreejihkn43073/how-i-found-a-business-logic-vulnerability-in-saas-applicationthat-allowed-unlimited-trial-3f680a38f372?source=rss------bug_bounty-5
Hey everyone, I’m Sreejith, a security researcher.Continue reading on Medium » (https://medium.com/@sreejihkn43073/how-i-found-a-business-logic-vulnerability-in-saas-applicationthat-allowed-unlimited-trial-3f680a38f372?source=rss------bug_bounty-5)
I built a local AI tool to automate the BloodHound & Nmap grind Syd v3.1 Demo
https://www.reddit.com/r/redteamsec/comments/1rbuiz4/i_built_a_local_ai_tool_to_automate_the/
<!-- SC_OFF -->Been building this for a few months. Here's what it actually does After every engagement I was spending hours manually trawling through Nmap XML, BloodHound JSON and Volatility output looking for the stuff that matters. Syd automates that grind. You paste load your scan output, it extracts the facts deterministically (no LLM guessing), then answers questions grounded only in what's actually in your data. If a service isn't in the scan, it won't mention it. in the video i show Nmap: parses XML, surfaces CVEs, flags SMB signing, weak services, attack surface BloodHound loads SharpHound ZIP, identifies Kerberoastable accounts, delegation issues, shortest paths Volatility: memory dump analysis, network connections, code injection, suspicious processes YARA: rule match analysis with automatic IOC extraction (IPs, domains, mutexes, registry keys) Key things Fully airgapped. No API keys, no cloud, runs entirely on your laptop Anti-hallucination layer answers get validated against extracted facts before you see them Runs on 16GB RAM with a local Qwen 14B model Tested on 119 real pentest scenarios, averaging 9.27/10 accuracy Not trying to replace your brain just cuts down the time between "scan finished" and "here's what matters." Happy to answer questions on the architecture or how the validation works. syd is a free tool on github https://github.com/Sydsec/syd and my website is sydsec.co.uk (http://sydsec.co.uk/) there are also more videos on my youtube showing syd answering questions <!-- SC_ON --> submitted by /u/Glass-Ant-6041 (https://www.reddit.com/user/Glass-Ant-6041)
[link] (https://www.youtube.com/watch?v=yfaVbvo1UjI) [comments] (https://www.reddit.com/r/redteamsec/comments/1rbuiz4/i_built_a_local_ai_tool_to_automate_the/)
https://www.reddit.com/r/redteamsec/comments/1rbuiz4/i_built_a_local_ai_tool_to_automate_the/
<!-- SC_OFF -->Been building this for a few months. Here's what it actually does After every engagement I was spending hours manually trawling through Nmap XML, BloodHound JSON and Volatility output looking for the stuff that matters. Syd automates that grind. You paste load your scan output, it extracts the facts deterministically (no LLM guessing), then answers questions grounded only in what's actually in your data. If a service isn't in the scan, it won't mention it. in the video i show Nmap: parses XML, surfaces CVEs, flags SMB signing, weak services, attack surface BloodHound loads SharpHound ZIP, identifies Kerberoastable accounts, delegation issues, shortest paths Volatility: memory dump analysis, network connections, code injection, suspicious processes YARA: rule match analysis with automatic IOC extraction (IPs, domains, mutexes, registry keys) Key things Fully airgapped. No API keys, no cloud, runs entirely on your laptop Anti-hallucination layer answers get validated against extracted facts before you see them Runs on 16GB RAM with a local Qwen 14B model Tested on 119 real pentest scenarios, averaging 9.27/10 accuracy Not trying to replace your brain just cuts down the time between "scan finished" and "here's what matters." Happy to answer questions on the architecture or how the validation works. syd is a free tool on github https://github.com/Sydsec/syd and my website is sydsec.co.uk (http://sydsec.co.uk/) there are also more videos on my youtube showing syd answering questions <!-- SC_ON --> submitted by /u/Glass-Ant-6041 (https://www.reddit.com/user/Glass-Ant-6041)
[link] (https://www.youtube.com/watch?v=yfaVbvo1UjI) [comments] (https://www.reddit.com/r/redteamsec/comments/1rbuiz4/i_built_a_local_ai_tool_to_automate_the/)