OverviewContinue reading on Medium » (https://letchupkt.medium.com/cwd-based-module-hijacking-in-python-pymanager-cve-2026-5271-2fb57bbc65eb?source=rss------bug_bounty-5)

HTTPX + DNSX Live Hosts Filter Karo aur DNS Secrets Nikalo! (Hinglish Mein)
https://medium.com/@HackerMD/httpx-dnsx-live-hosts-filter-karo-aur-dns-secrets-nikalo-hinglish-mein-64e80ba0ff14?source=rss------bug_bounty-5

Series: Bug Bounty Zero se Hero 🦸 | Article #8
By HackerMD | 16 min readContinue reading on Medium » (https://medium.com/@HackerMD/httpx-dnsx-live-hosts-filter-karo-aur-dns-secrets-nikalo-hinglish-mein-64e80ba0ff14?source=rss------bug_bounty-5)

Logout Vulnerabilities Explained: 13 Critical Security Tests Every Hacker Must Know
https://pradyumntiwarenexus.medium.com/logout-vulnerabilities-explained-13-critical-security-tests-every-hacker-must-know-46db9038540a?source=rss------bug_bounty-5

“You logged out… but did the server really forget you?”Continue reading on Medium » (https://pradyumntiwarenexus.medium.com/logout-vulnerabilities-explained-13-critical-security-tests-every-hacker-must-know-46db9038540a?source=rss------bug_bounty-5)

Password Strength Policy Bypass via Server-Side Validation Flaw

Ringkasan EksekutifContinue reading on Medium »
Read more...

Red Team Automation: 12 Scripts That Save Hours (and Win Real Engagements)

Ever burned a whole weekend on manual recon, only to realize you missed a low-hanging RCE vector because you were sorting through logs by…Continue reading on Medium »
Read more...

Password Strength Policy Bypass via Server-Side Validation Flaw
https://medium.com/@rrozif96/password-strength-policy-bypass-via-server-side-validation-flaw-2279c2e167db?source=rss------bug_bounty-5

Ringkasan EksekutifContinue reading on Medium » (https://medium.com/@rrozif96/password-strength-policy-bypass-via-server-side-validation-flaw-2279c2e167db?source=rss------bug_bounty-5)

Red Team Automation: 12 Scripts That Save Hours (and Win Real Engagements)
https://medium.com/@verylazytech/red-team-automation-12-scripts-that-save-hours-and-win-real-engagements-4e52c49579bc?source=rss------bug_bounty-5

Ever burned a whole weekend on manual recon, only to realize you missed a low-hanging RCE vector because you were sorting through logs by…Continue reading on Medium » (https://medium.com/@verylazytech/red-team-automation-12-scripts-that-save-hours-and-win-real-engagements-4e52c49579bc?source=rss------bug_bounty-5)

PenScope — Chrome extension for passive web recon via CDP (6 domains, dual-path script grep, active probing)
https://www.reddit.com/r/redteamsec/comments/1saav8x/penscope_chrome_extension_for_passive_web_recon/

<!-- SC_OFF -->Chrome extension that maps web app attack surfaces through three modes. Passive mode observes traffic and DOM with zero requests. Deep mode uses Chrome Debugger Protocol across 6 CDP domains to grep every JS bundle for endpoints, extract framework runtime state, capture console output, and run Chrome's security auditor. Active mode sends authenticated requests for GraphQL introspection, source map parsing, Swagger fetching, path probing, and API suffix bruteforce. Dual-path script analysis catches JS bundles loaded before the debugger attached (via Network.getResponseBody) and dynamic scripts after (via Debugger.getScriptSource). Walks React Router fiber trees, Vue Router configs, Next.js BUILD_MANIFEST, webpack modules, and Apollo cache for route discovery. Tested across dozens of targets, pulled 942 undocumented API endpoints from a single page load on one engagement. Works on 80-90% of modern web apps regardless of framework. 2,600 lines, 5 files, no dependencies, MIT licensed. <!-- SC_ON --> submitted by /u/CARQLLESS (https://www.reddit.com/user/CARQLLESS)
[link] (https://github.com/spider12223/PenScope) [comments] (https://www.reddit.com/r/redteamsec/comments/1saav8x/penscope_chrome_extension_for_passive_web_recon/)

red team sandbox with real detection
https://www.reddit.com/r/redteamsec/comments/1safyia/red_team_sandbox_with_real_detection/

<!-- SC_OFF -->Built a free red team arena for testing real attack paths against a live defense system for ShieldNet DLX7. This is NOT a CTF or a static lab. It actually responds to what you do. Current scenarios: prompt injection bypass DOM tamper (including honeytrap detection) JWT forging (alg confusion, role escalation) API exfil (debug routes, traversal) indirect injection (markdown, SVG, base64 payloads) Everything runs in a sandbox. No production targets. Novel attacks generate detection rules that get reviewed and pushed into the system If you want to test how your payloads actually hold up against modern defenses, this is useful. https://www.shieldnet.app/red-team-arena.html <!-- SC_ON --> submitted by /u/No-Magazine2625 (https://www.reddit.com/user/No-Magazine2625)
[link] (https://www.shieldnet.app/red-team-arena.html) [comments] (https://www.reddit.com/r/redteamsec/comments/1safyia/red_team_sandbox_with_real_detection/)

Antivirus isn't as smart as you think
https://www.reddit.com/r/redteamsec/comments/1saghi9/antivirus_isnt_as_smart_as_you_think/

<!-- SC_OFF -->Last time I posted a shellcode loader that has few to mostly 0 av detections on VT. Most of those AV detections disappeared not as I made my code more complicated or obfuscated. The steps that had the most impact on detections were the following: Use an Icon! If your exe has an Icon it is instantly less suspicious to AV and even sandboxes. It even seems like filesize in general has a huge impact which gets pushed by a lot by an icon group. Add Versioninfo and a Manifest. Both reduce detections by a lot and you an force admin execution with the manifest too Change the Creation Time Timestamp. Especially Trojan:Win32/Wacatac.C!ml seems to be very sensitive to very new timestamps. all those things can easily be changed with "Resource Hacker" and will save you a lot of headache while writing your own malware or use existing solutions. <!-- SC_ON --> submitted by /u/Difficult-Advice3002 (https://www.reddit.com/user/Difficult-Advice3002)
[link] (https://www.virustotal.com/gui/file/49756e39f3c77aaf65ffc3fc40729969a58556773d4510ee8bdae330ef6e3587?nocache=1) [comments] (https://www.reddit.com/r/redteamsec/comments/1saghi9/antivirus_isnt_as_smart_as_you_think/)

From Open Source to an AIO Phishing Platform for Red Team & a Free CybsercurityABCs Book!
https://www.reddit.com/r/redteamsec/comments/1sagkzj/from_open_source_to_an_aio_phishing_platform_for/

<!-- SC_OFF -->Hey everyone. I'm Curtis Brazzell. Some of you might know me from my security research and blog posts on Medium (curtbraz.medium.com), things like phishing password managers, bypassing MFA, AI-generated phishing PoCs, and building evasion blocklists to keep landing pages alive. I also wrote the Cybersecurity ABCs children's book series, including "M is for Malware" and "S is for Spear Phishing." Phishing and offensive security research has been a consistent passion throughout my entire career. Every technique I've published ended up in a tool I started building in 2014 as an open-source project. That project eventually became the PhishU Framework. The problem it solves: a solid spear-phishing assessment used to take me 60-80 hours doing it from scratch. Most of that was infrastructure, recon, pretext development, and campaign content, not the actual social engineering. The offensive tools out there require stitching together separate projects with tons of setup and tweaking. The commercial platforms are allow-listed, don't capture credentials or sessions, don't support custom domains, and aren't built for red teams. A lot of consulting firms stopped offering social engineering because of this. Meanwhile, phishing is still the number one attack path. The PhishU Framework handles the full lifecycle in one platform: Domain acquisition with automated DKIM/SPF/DMARC and M365 provisioning Landing pages (AI cloning, manual browser capture, AiTM transparent proxy) Email delivery with per-recipient personalization and evasion Credential capture, session hijacking with one-click replay Custom analytics and branded reports with evidence Conditional training specific to what each person actually fell for AI-assisted recon, campaign planning, email generation, deliverability analysis, and report writing New techniques added as they trend in the wild (AiTM, BiB, ClickFix, OAuth Consent Grant, Device Code Phishing) A few hours of total effort now gets better results than those 60-80 hour engagements ever did. I'm opening up free limited trials. Full platform access, test sending domain, limited email sends. The few people who've seen it have been genuinely excited, and I think practitioners will feel the same once they get their hands on it. I'm a small one-person startup so really just trying to get it recognized from all of the noisy big vendors. Feels a bit like shouting into the void, and I'm not a sales/marketing person, haha. I figured what I'll do is for the first 50 sign-ups you'll get a signed copy of "S is for Spear Phishing" (CybersecurityABCs.com), my favorite of the four books. I just ask that you please cover $5 for shipping. DM me if interested. Invite only. Happy to discuss techniques supported, etc. <!-- SC_ON --> submitted by /u/IndySecMan (https://www.reddit.com/user/IndySecMan)
[link] (https://phishu.net/) [comments] (https://www.reddit.com/r/redteamsec/comments/1sagkzj/from_open_source_to_an_aio_phishing_platform_for/)

I’m building an iPhone app to hack WPA3 WiFi. Do you think I can get it into the App Store?
https://www.reddit.com/r/redteamsec/comments/1sb57ip/im_building_an_iphone_app_to_hack_wpa3_wifi_do/

<!-- SC_OFF -->I’ve decided I want to create a phone app that can capture handshakes and audit WPA3 networks. Now, before you think me a fool, I know there is no way to capture raw WiFi traffic via Android or iPhone unless it's rooted or jailbroken, but that is not my focus. I think I found a way to smuggle the functionality in anyway. My plan is to submit it to the Apple and Google stores as a PCAPNG Analyzer. It’s going to be marketed strictly as a tool for analyzing network traffic and reading binary capture blocks. The trick is that the phone isn't doing any of the hacking; it’s just a serial interface for a library I wrote called Politician. The ESP32 does all the heavy lifting—things like CSA (Channel Switch Announcement) injection to get around WPA3 protections and extracting PMKIDs—and then streams that data to the phone at 921600 baud. To get past the reviewers, I’m just labeling the offensive triggers as boring diagnostic tests. For example, a Roaming Latency Check actually starts the CSA bursts, and a Handshake Timing Test initiates the PMKID fishing. I'm even hiding the 802.1X identity harvesting under a label like Credential Audit. It even supports dual-band auditing on the ESP32-C6. To a reviewer, it just looks like a data visualizer for external hardware. Is this a fools errand? Do you think it will work, or should I just build a standalone tool for the Cheap Yellow Display or a Flipper Zero app? I'd love to hear what you guys would actually find useful—should I keep fighting with the App Store or just pivot to a dedicated device like the M5Stack or Flipper? Link to the Politician library: https://github.com/0ldev/Politician <!-- SC_ON --> submitted by /u/JonDowSmith (https://www.reddit.com/user/JonDowSmith)
[link] (https://github.com/0ldev/Politician) [comments] (https://www.reddit.com/r/redteamsec/comments/1sb57ip/im_building_an_iphone_app_to_hack_wpa3_wifi_do/)

How Cybersecurity Can Change the World

We talk about cybersecurity as defence — a wall between attackers and victims. That framing is too small. Robust cybersecurity is the…Continue reading on Medium »
Read more...

GraphQL Security: How I Found and Exploited Critical IDOR and Authorization Bypass in a…

How I earned $12,500 finding GraphQL introspection and batch query vulnerabilities in a fintech startup’s API infrastructureContinue reading on InfoSec Write-ups »
Read more...