Double Compromise: Unearthing Unauthenticated SSRF and Weaponized XSS on Legacy Oracle…

When assessing enterprise perimeters, legacy subdomains often hide complex architectural flaws. During a recent engagement targeting a…Continue reading on Medium »
Read more...

Mining Wayback URLs for High-Impact Vulnerability Discovery

Hi everyone, let me start with a simple question.Continue reading on Medium »
Read more...

Full Organization Account Takeover (ATO) by Changing One Parameter

Sometimes, hacking is not about complex payloads.Continue reading on Medium »
Read more...

How I Found a Business Logic Vulnerability in SaaS applicationThat Allowed Unlimited Trial…

Hey everyone, I’m Sreejith, a security researcher.Continue reading on Medium »
Read more...

Double Compromise: Unearthing Unauthenticated SSRF and Weaponized XSS on Legacy Oracle…
https://medium.com/@k4r33m/double-compromise-unearthing-unauthenticated-ssrf-and-weaponized-xss-on-legacy-oracle-d41ed9f7f7b8?source=rss------bug_bounty-5

When assessing enterprise perimeters, legacy subdomains often hide complex architectural flaws. During a recent engagement targeting a…Continue reading on Medium » (https://medium.com/@k4r33m/double-compromise-unearthing-unauthenticated-ssrf-and-weaponized-xss-on-legacy-oracle-d41ed9f7f7b8?source=rss------bug_bounty-5)

Mining Wayback URLs for High-Impact Vulnerability Discovery
https://medium.com/@nitinsgavane/mining-wayback-urls-for-high-impact-vulnerability-discovery-dfa6ebbe63aa?source=rss------bug_bounty-5

Hi everyone, let me start with a simple question.Continue reading on Medium » (https://medium.com/@nitinsgavane/mining-wayback-urls-for-high-impact-vulnerability-discovery-dfa6ebbe63aa?source=rss------bug_bounty-5)

Full Organization Account Takeover (ATO) by Changing One Parameter
https://medium.com/@2os5/full-organization-account-takeover-ato-by-changing-one-parameter-9f67472d3138?source=rss------bug_bounty-5

Sometimes, hacking is not about complex payloads.Continue reading on Medium » (https://medium.com/@2os5/full-organization-account-takeover-ato-by-changing-one-parameter-9f67472d3138?source=rss------bug_bounty-5)

How I Found a Business Logic Vulnerability in SaaS applicationThat Allowed Unlimited Trial…
https://medium.com/@sreejihkn43073/how-i-found-a-business-logic-vulnerability-in-saas-applicationthat-allowed-unlimited-trial-3f680a38f372?source=rss------bug_bounty-5

Hey everyone, I’m Sreejith, a security researcher.Continue reading on Medium » (https://medium.com/@sreejihkn43073/how-i-found-a-business-logic-vulnerability-in-saas-applicationthat-allowed-unlimited-trial-3f680a38f372?source=rss------bug_bounty-5)

I built a local AI tool to automate the BloodHound & Nmap grind Syd v3.1 Demo
https://www.reddit.com/r/redteamsec/comments/1rbuiz4/i_built_a_local_ai_tool_to_automate_the/

<!-- SC_OFF -->Been building this for a few months. Here's what it actually does After every engagement I was spending hours manually trawling through Nmap XML, BloodHound JSON and Volatility output looking for the stuff that matters. Syd automates that grind. You paste load your scan output, it extracts the facts deterministically (no LLM guessing), then answers questions grounded only in what's actually in your data. If a service isn't in the scan, it won't mention it. in the video i show Nmap: parses XML, surfaces CVEs, flags SMB signing, weak services, attack surface BloodHound loads SharpHound ZIP, identifies Kerberoastable accounts, delegation issues, shortest paths Volatility: memory dump analysis, network connections, code injection, suspicious processes YARA: rule match analysis with automatic IOC extraction (IPs, domains, mutexes, registry keys) Key things Fully airgapped. No API keys, no cloud, runs entirely on your laptop Anti-hallucination layer answers get validated against extracted facts before you see them Runs on 16GB RAM with a local Qwen 14B model Tested on 119 real pentest scenarios, averaging 9.27/10 accuracy Not trying to replace your brain just cuts down the time between "scan finished" and "here's what matters." Happy to answer questions on the architecture or how the validation works. syd is a free tool on github https://github.com/Sydsec/syd and my website is sydsec.co.uk (http://sydsec.co.uk/) there are also more videos on my youtube showing syd answering questions <!-- SC_ON --> submitted by /u/Glass-Ant-6041 (https://www.reddit.com/user/Glass-Ant-6041)
[link] (https://www.youtube.com/watch?v=yfaVbvo1UjI) [comments] (https://www.reddit.com/r/redteamsec/comments/1rbuiz4/i_built_a_local_ai_tool_to_automate_the/)

AI-Powered Bug Hunting: 20 Tools to Find Vulnerabilities and Targets Faster

Ever spent hours poking at a target, only to realize you missed an obvious vulnerability? Or maybe you’ve watched as bug bounty…Continue reading on Medium »
Read more...

Hidden in Plainsight — Steganography Done Right

In CTF forensics challenges, the flag is often right in front of you, yet completely invisible. This challenge is a classic example of…Continue reading on Medium »
Read more...

AI-Powered Bug Hunting: 20 Tools to Find Vulnerabilities and Targets Faster
https://medium.com/@verylazytech/ai-powered-bug-hunting-20-tools-to-find-vulnerabilities-and-targets-faster-10a98b16d040?source=rss------bug_bounty-5

Ever spent hours poking at a target, only to realize you missed an obvious vulnerability? Or maybe you’ve watched as bug bounty…Continue reading on Medium » (https://medium.com/@verylazytech/ai-powered-bug-hunting-20-tools-to-find-vulnerabilities-and-targets-faster-10a98b16d040?source=rss------bug_bounty-5)

Hidden in Plainsight — Steganography Done Right
https://medium.com/@VulnHunt3r/hidden-in-plainsight-steganography-done-right-f11808f0a3b2?source=rss------bug_bounty-5