Imagine if you could trick a web server into visiting internal websites, reading local files, and even scanning private IP ranges on your…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/bug-bounty-bootcamp-35-ssrf-turning-the-server-into-your-personal-proxy-to-hack-internal-c9f74582cf0c?source=rss------bug_bounty-5)
I Used One Google Search to Find Exposed API Keys, Databases, and Cloud Secrets
Continue reading on Medium »
Read more...
Continue reading on Medium »
Read more...
Medium
The Most Underrated Google Dork That Keeps Leaking Secrets
The Most Underrated Google Dork That Keeps Leaking Secrets How ext:env quietly exposes API keys, database passwords, and cloud credentials across the web By oldman Security Researcher & Bug Bounty …
One Phone Number = Unlimited Free Meals at California Burrito ️
Continue reading on Medium »
Read more...
Continue reading on Medium »
Read more...
Medium
One Phone Number = Unlimited Free Meals at California Burrito 💀🍽️
All It Took Was a Phone Number to Break California Burrito’s Loyalty System 📱💥 Hey Paals… 😁😁 Came up with one more finding… and this time it started with FOOD 🌯😅 Let’s get …
How I Found a Critical Bug Using Claude Desktop (Free)
TL;DR: I fed a JavaScript bundle to Claude Desktop (I use Burp MCP with Claude). It mapped hidden endpoints I’d missed after multiple…Continue reading on Medium »
Read more...
TL;DR: I fed a JavaScript bundle to Claude Desktop (I use Burp MCP with Claude). It mapped hidden endpoints I’d missed after multiple…Continue reading on Medium »
Read more...
Medium
How I Found a Critical Bug Using Claude Desktop (Free)
TL;DR: I fed a JavaScript bundle to Claude Desktop (I use Burp MCP with Claude). It mapped hidden endpoints I’d missed after multiple…
Security Assessment — Pentesting: 23andMe Web Platform
Author: Leen Adeeb HackerOne: leenadeeb Program: 23andMe Bug Bounty (Public) Testing Date: April 23, 2026 Scope: api.23andme.com ·…Continue reading on Medium »
Read more...
Author: Leen Adeeb HackerOne: leenadeeb Program: 23andMe Bug Bounty (Public) Testing Date: April 23, 2026 Scope: api.23andme.com ·…Continue reading on Medium »
Read more...
Medium
Security Assessment — Pentesting: 23andMe Web Platform
Author: Leen Adeeb HackerOne: leenadeeb Program: 23andMe Bug Bounty (Public) Testing Date: April 23, 2026 Scope: api.23andme.com ·…
Wordfence Intelligence Weekly WordPress Vulnerability Report (April 13, 2026 to April 19, 2026)
Last week, 139 vulnerabilities were disclosed in 116 WordPress Plugins and 10 WordPress Themes, with contributions from 84 vulnerability…Continue reading on Medium »
Read more...
Last week, 139 vulnerabilities were disclosed in 116 WordPress Plugins and 10 WordPress Themes, with contributions from 84 vulnerability…Continue reading on Medium »
Read more...
Medium
Wordfence Intelligence Weekly WordPress Vulnerability Report (April 13, 2026 to April 19, 2026)
Last week, 139 vulnerabilities were disclosed in 116 WordPress Plugins and 10 WordPress Themes, with contributions from 84 vulnerability…
Bypassing a Payment Gateway Through Smali-Level Dead Code Discovery
How static analysis of an unused code path led to a full payment bypass in a production mobile application.Continue reading on Medium »
Read more...
How static analysis of an unused code path led to a full payment bypass in a production mobile application.Continue reading on Medium »
Read more...
Medium
Bypassing a Payment Gateway Through Smali-Level Dead Code Discovery
How static analysis of an unused code path led to a full payment bypass in a production mobile application.
Security Assessment: 23andMe Web Platform
Authorized bug bounty testing across authentication flows, object-level authorization, client-side disclosure, and e-commerce logic on a…Continue reading on Medium »
Read more...
Authorized bug bounty testing across authentication flows, object-level authorization, client-side disclosure, and e-commerce logic on a…Continue reading on Medium »
Read more...
Medium
Security Assessment: 23andMe Web Platform
Authorized bug bounty testing across authentication flows, object-level authorization, client-side disclosure, and e-commerce logic on a…
How a Fake Image and an Expired Token Made a Server Confess Everything
During a recent assessment of a mobile application’s backend API, I triggered a verbose error response from a profile image upload…Continue reading on Medium »
Read more...
During a recent assessment of a mobile application’s backend API, I triggered a verbose error response from a profile image upload…Continue reading on Medium »
Read more...
Medium
How a Fake Image and an Expired Token Made a Server Confess Everything
During a recent assessment of a mobile application’s backend API, I triggered a verbose error response from a profile image upload endpoint…
WebVersePro Labs — Challenge: Fermata Writeup (Reflected XSS)
OBJECTIVE: To identify the injection point, break out of an HTML comment block, and execute arbitrary JavaScript to retrieve the challenge…Continue reading on Medium »
Read more...
OBJECTIVE: To identify the injection point, break out of an HTML comment block, and execute arbitrary JavaScript to retrieve the challenge…Continue reading on Medium »
Read more...
Medium
WebVersePro Labs — Challenge: Fermata Writeup (Reflected XSS)
OBJECTIVE: To identify the injection point, break out of an HTML comment block, and execute arbitrary JavaScript to retrieve the challenge…
Race Condition Allows Users to Obtain More Than 1 Free Domain
Disclaimer: This is a report from someone else that I am studying, not my own finding. (Source: Automattic | Report #2616045 — Race…Continue reading on Medium »
Read more...
Disclaimer: This is a report from someone else that I am studying, not my own finding. (Source: Automattic | Report #2616045 — Race…Continue reading on Medium »
Read more...
Medium
Race Condition Allows Users to Obtain More Than 1 Free Domain
Disclaimer: This is a report from someone else that I am studying, not my own finding. (Source: Automattic | Report #2616045 — Race…
Day 10: Bypassing SameSite Lax with Method Override (CSRF Lab Walkthrough)
hello everyone, this is nobody.Continue reading on Medium »
Read more...
hello everyone, this is nobody.Continue reading on Medium »
Read more...
Medium
Day 10: Bypassing SameSite Lax with Method Override (CSRF Lab Walkthrough)
hello everyone, this is nobody.
Guía Maestra de SSRF: Estrategias de Explotación y Mitigación
Aprende a detectar y explotar vulnerabilidades SSRF en entornos Cloud-Native, desde servicios de metadata hasta evasión de filtros.Continue reading on Medium »
Read more...
Aprende a detectar y explotar vulnerabilidades SSRF en entornos Cloud-Native, desde servicios de metadata hasta evasión de filtros.Continue reading on Medium »
Read more...
Medium
Guía Maestra de SSRF: Estrategias de Explotación y Mitigación
Aprende a detectar y explotar vulnerabilidades SSRF en entornos Cloud-Native, desde servicios de metadata hasta evasión de filtros.
Bug Bounty Series— Part 1 (Bug Bounty Basics)
Inside: A deep dive into the lessons learned and techniques applied during my latest hands-on experiments.Continue reading on Medium »
Read more...
Inside: A deep dive into the lessons learned and techniques applied during my latest hands-on experiments.Continue reading on Medium »
Read more...
Medium
Bug Bounty Series— Part 1 (Bug Bounty Basics)
Inside: A deep dive into the lessons learned and techniques applied during my latest hands-on experiments.
Currently on a internal pen test, need some fresh perspectives
https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/
<!-- SC_OFF -->So I am currently on an internal AD pentest. I started of with responder and I got a lot of hashes both user and computer. SMB signing is disabled in some hosts so did a relay got an interactive smb shell, but all the accounts I relayed did not have any permissions to open the ADMIN and C share. I ran a mitm6 attack and got the loot. Took all the SAM account and tried asreproasting and kerberoasting, but didn’t yield to much. Found some VNC creds in an anonymous FTP server, but that doesn’t work either. I exploited iLO and created an admin user and signed into the site but the server is off and turning back on doesn’t seem smart. There is bluekeep and message queuejumper but I’m not going to exploit that since it’s too risky. Got an IPMI hash, need to crack it. This all that I have now and I still don’t have real initial access, seasoned penetesters out there how would you go forward now ? I know password guessing could work but I’ve never done it before and the lockout policy is pretty strong. Any ideas would be greatly appreciated. Just wanted to add - I’ve been trying to do an ADCS attack but I’m having tough time finding the CA. It’s not on the two DCs and I’ve heard it’s usually a standalone server. I think the client put that out of scope, because when I dumped in the loot, I saw a pentesting service account from the clients previous pentest. But how do you guys find the CA server though ? Another addition - both the DCs are vulnerable to coercion, petitotam and printer bug Edit - y’all are some real ones, I did not expect to get this much engagement and help especially this early in the morning. Y’all are goated. Thank you <!-- SC_ON --> submitted by /u/Tasty_Departure5277 (https://www.reddit.com/user/Tasty_Departure5277)
[link] (https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/)
https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/
<!-- SC_OFF -->So I am currently on an internal AD pentest. I started of with responder and I got a lot of hashes both user and computer. SMB signing is disabled in some hosts so did a relay got an interactive smb shell, but all the accounts I relayed did not have any permissions to open the ADMIN and C share. I ran a mitm6 attack and got the loot. Took all the SAM account and tried asreproasting and kerberoasting, but didn’t yield to much. Found some VNC creds in an anonymous FTP server, but that doesn’t work either. I exploited iLO and created an admin user and signed into the site but the server is off and turning back on doesn’t seem smart. There is bluekeep and message queuejumper but I’m not going to exploit that since it’s too risky. Got an IPMI hash, need to crack it. This all that I have now and I still don’t have real initial access, seasoned penetesters out there how would you go forward now ? I know password guessing could work but I’ve never done it before and the lockout policy is pretty strong. Any ideas would be greatly appreciated. Just wanted to add - I’ve been trying to do an ADCS attack but I’m having tough time finding the CA. It’s not on the two DCs and I’ve heard it’s usually a standalone server. I think the client put that out of scope, because when I dumped in the loot, I saw a pentesting service account from the clients previous pentest. But how do you guys find the CA server though ? Another addition - both the DCs are vulnerable to coercion, petitotam and printer bug Edit - y’all are some real ones, I did not expect to get this much engagement and help especially this early in the morning. Y’all are goated. Thank you <!-- SC_ON --> submitted by /u/Tasty_Departure5277 (https://www.reddit.com/user/Tasty_Departure5277)
[link] (https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/)
We let an LLM loose on open-source apps. It found 3 CVEs, one of them a CVSS 8.9 RCE.
https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/
<!-- SC_OFF -->We've been running AIDA an autonomous pentesting agent against open-source targets as part of testing the tool itself. The agent reasons about the application, generates payloads, iterates, and documents everything. Here's what came out: CVE-2026-32034 — openclaw/openclaw (https://github.com/openclaw/openclaw)
CVSS 5.6 MEDIUM
Insecure HTTP permits traffic hijacking. Classic, but the agent found it by correlating the tech stack with known attack paths and confirming it via HTTP manipulation. GHSA-xfvv-ggvq-pchh — appsmithorg/appsmith (https://github.com/appsmithorg/appsmith)
CVSS 8.9 HIGH
RCE via newline injection in an env variable endpoint. The agent generated a custom Python payload, sent it, observed the behavior, confirmed code execution, and logged the full reproduction chain. This one ended up in the security advisory. GHSA-vvxf-f8q9-86gh — appsmithorg/appsmith
CVSS 5.1 MEDIUM
SSRF through the SMTP test endpoint — the agent used it for internal port scanning and flagged the reachable services. All three reported through proper channels. More are under coordinated disclosure and haven't published yet. The agent doesn't replace the human, you still review, reproduce, and decide what to report. But it runs the grunt work and hands you everything: the command, the raw output, the reasoning. Repo: https://github.com/Vasco0x4/AIDA <!-- SC_ON --> submitted by /u/TomatoWasabi (https://www.reddit.com/user/TomatoWasabi)
[link] (https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/)
https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/
<!-- SC_OFF -->We've been running AIDA an autonomous pentesting agent against open-source targets as part of testing the tool itself. The agent reasons about the application, generates payloads, iterates, and documents everything. Here's what came out: CVE-2026-32034 — openclaw/openclaw (https://github.com/openclaw/openclaw)
CVSS 5.6 MEDIUM
Insecure HTTP permits traffic hijacking. Classic, but the agent found it by correlating the tech stack with known attack paths and confirming it via HTTP manipulation. GHSA-xfvv-ggvq-pchh — appsmithorg/appsmith (https://github.com/appsmithorg/appsmith)
CVSS 8.9 HIGH
RCE via newline injection in an env variable endpoint. The agent generated a custom Python payload, sent it, observed the behavior, confirmed code execution, and logged the full reproduction chain. This one ended up in the security advisory. GHSA-vvxf-f8q9-86gh — appsmithorg/appsmith
CVSS 5.1 MEDIUM
SSRF through the SMTP test endpoint — the agent used it for internal port scanning and flagged the reachable services. All three reported through proper channels. More are under coordinated disclosure and haven't published yet. The agent doesn't replace the human, you still review, reproduce, and decide what to report. But it runs the grunt work and hands you everything: the command, the raw output, the reasoning. Repo: https://github.com/Vasco0x4/AIDA <!-- SC_ON --> submitted by /u/TomatoWasabi (https://www.reddit.com/user/TomatoWasabi)
[link] (https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/)
<!-- SC_OFF -->Hi all, our most recent post gives a first-hand account of how LLMs have transformed the CTF landscape, with winning teams being decided by their orchestration pipelines and access to resources vs a traditional disparity in technical knowledge. We describe why pentests haven't seen a similar surge of automated success due to a variety of factors that show models still have a long way to go in cyber security. <!-- SC_ON --> submitted by /u/IncludeSec (https://www.reddit.com/user/IncludeSec)
[link] (https://blog.includesecurity.com/2026/04/ctfs-in-the-ai-era/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stn5wy/ctfs_in_the_ai_era/)
[link] (https://blog.includesecurity.com/2026/04/ctfs-in-the-ai-era/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stn5wy/ctfs_in_the_ai_era/)
Mythos can't replace real penetration testers and AI is not a threat, its a workforce amplifier.
https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/
<!-- SC_OFF -->Hi All! I grew tired of hearing about how Mythos / AI will replace human penetration testers. Those of us who understand that real penetration testing is not a checkbox exercise, also know that AI can't touch what we do. I called it out here as best as I could and wanted to share. I welcome feedback, questions, etc. but I figured you'd all appreciate this. https://netragard.com/blog/claude-mythos-and-the-hype-that-will-get-you-breached/ <!-- SC_ON --> submitted by /u/netragard-inc (https://www.reddit.com/user/netragard-inc)
[link] (https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/)
https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/
<!-- SC_OFF -->Hi All! I grew tired of hearing about how Mythos / AI will replace human penetration testers. Those of us who understand that real penetration testing is not a checkbox exercise, also know that AI can't touch what we do. I called it out here as best as I could and wanted to share. I welcome feedback, questions, etc. but I figured you'd all appreciate this. https://netragard.com/blog/claude-mythos-and-the-hype-that-will-get-you-breached/ <!-- SC_ON --> submitted by /u/netragard-inc (https://www.reddit.com/user/netragard-inc)
[link] (https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/)
Recherche binôme sérieux (15 ans) – apprentissage & pratique en cyber / programmation / business / tech 🇫🇷
https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/
<!-- SC_OFF -->Hey, Je cherche un binôme motivé (français de préférence) pour progresser sérieusement en cybersécurité principalement, et en tech en général. Moi : • Intéressé par le pentest / bug bounty / programmation / business • J’aime les projets concrets (scripts, outils, automatisation, sites web, SaaS) • Objectif long terme : monter en compétences + créer des projets (SaaS, etc.) Je cherche : • Quelqu’un de sérieux, régulier et ambitieux • Partant pour : • faire des CTF à 2 • apprendre ensemble (sécurité, dev, systèmes) • lancer des projets tech Pourquoi : Aller plus vite, se motiver et construire quelque chose de solide ensemble. Si t’es chaud, envoie-moi un message <!-- SC_ON --> submitted by /u/DataHorizon- (https://www.reddit.com/user/DataHorizon-)
[link] (https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/)
https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/
<!-- SC_OFF -->Hey, Je cherche un binôme motivé (français de préférence) pour progresser sérieusement en cybersécurité principalement, et en tech en général. Moi : • Intéressé par le pentest / bug bounty / programmation / business • J’aime les projets concrets (scripts, outils, automatisation, sites web, SaaS) • Objectif long terme : monter en compétences + créer des projets (SaaS, etc.) Je cherche : • Quelqu’un de sérieux, régulier et ambitieux • Partant pour : • faire des CTF à 2 • apprendre ensemble (sécurité, dev, systèmes) • lancer des projets tech Pourquoi : Aller plus vite, se motiver et construire quelque chose de solide ensemble. Si t’es chaud, envoie-moi un message <!-- SC_ON --> submitted by /u/DataHorizon- (https://www.reddit.com/user/DataHorizon-)
[link] (https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/)