Bypassing a Payment Gateway Through Smali-Level Dead Code Discovery

How static analysis of an unused code path led to a full payment bypass in a production mobile application.Continue reading on Medium »
Read more...

Security Assessment: 23andMe Web Platform

Authorized bug bounty testing across authentication flows, object-level authorization, client-side disclosure, and e-commerce logic on a…Continue reading on Medium »
Read more...

How a Fake Image and an Expired Token Made a Server Confess Everything

During a recent assessment of a mobile application’s backend API, I triggered a verbose error response from a profile image upload…Continue reading on Medium »
Read more...

WebVersePro Labs — Challenge: Fermata Writeup (Reflected XSS)

OBJECTIVE: To identify the injection point, break out of an HTML comment block, and execute arbitrary JavaScript to retrieve the challenge…Continue reading on Medium »
Read more...

Race Condition Allows Users to Obtain More Than 1 Free Domain

Disclaimer: This is a report from someone else that I am studying, not my own finding. (Source: Automattic | Report #2616045 — Race…Continue reading on Medium »
Read more...

Day 10: Bypassing SameSite Lax with Method Override (CSRF Lab Walkthrough)

hello everyone, this is nobody.Continue reading on Medium »
Read more...

Guía Maestra de SSRF: Estrategias de Explotación y Mitigación

Aprende a detectar y explotar vulnerabilidades SSRF en entornos Cloud-Native, desde servicios de metadata hasta evasión de filtros.Continue reading on Medium »
Read more...

Bug Bounty Series— Part 1 (Bug Bounty Basics)

Inside: A deep dive into the lessons learned and techniques applied during my latest hands-on experiments.Continue reading on Medium »
Read more...

Currently on a internal pen test, need some fresh perspectives
https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/

<!-- SC_OFF -->So I am currently on an internal AD pentest. I started of with responder and I got a lot of hashes both user and computer. SMB signing is disabled in some hosts so did a relay got an interactive smb shell, but all the accounts I relayed did not have any permissions to open the ADMIN and C share. I ran a mitm6 attack and got the loot. Took all the SAM account and tried asreproasting and kerberoasting, but didn’t yield to much. Found some VNC creds in an anonymous FTP server, but that doesn’t work either. I exploited iLO and created an admin user and signed into the site but the server is off and turning back on doesn’t seem smart. There is bluekeep and message queuejumper but I’m not going to exploit that since it’s too risky. Got an IPMI hash, need to crack it. This all that I have now and I still don’t have real initial access, seasoned penetesters out there how would you go forward now ? I know password guessing could work but I’ve never done it before and the lockout policy is pretty strong. Any ideas would be greatly appreciated. Just wanted to add - I’ve been trying to do an ADCS attack but I’m having tough time finding the CA. It’s not on the two DCs and I’ve heard it’s usually a standalone server. I think the client put that out of scope, because when I dumped in the loot, I saw a pentesting service account from the clients previous pentest. But how do you guys find the CA server though ? Another addition - both the DCs are vulnerable to coercion, petitotam and printer bug Edit - y’all are some real ones, I did not expect to get this much engagement and help especially this early in the morning. Y’all are goated. Thank you <!-- SC_ON --> submitted by /u/Tasty_Departure5277 (https://www.reddit.com/user/Tasty_Departure5277)
[link] (https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stfh75/currently_on_a_internal_pen_test_need_some_fresh/)

CTFs in the AI Era
https://www.reddit.com/r/Pentesting/comments/1stn5wy/ctfs_in_the_ai_era/

We let an LLM loose on open-source apps. It found 3 CVEs, one of them a CVSS 8.9 RCE.
https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/

<!-- SC_OFF -->We've been running AIDA an autonomous pentesting agent against open-source targets as part of testing the tool itself. The agent reasons about the application, generates payloads, iterates, and documents everything. Here's what came out: CVE-2026-32034 — openclaw/openclaw (https://github.com/openclaw/openclaw)
CVSS 5.6 MEDIUM
Insecure HTTP permits traffic hijacking. Classic, but the agent found it by correlating the tech stack with known attack paths and confirming it via HTTP manipulation. GHSA-xfvv-ggvq-pchh — appsmithorg/appsmith (https://github.com/appsmithorg/appsmith)
CVSS 8.9 HIGH
RCE via newline injection in an env variable endpoint. The agent generated a custom Python payload, sent it, observed the behavior, confirmed code execution, and logged the full reproduction chain. This one ended up in the security advisory. GHSA-vvxf-f8q9-86gh — appsmithorg/appsmith
CVSS 5.1 MEDIUM
SSRF through the SMTP test endpoint — the agent used it for internal port scanning and flagged the reachable services. All three reported through proper channels. More are under coordinated disclosure and haven't published yet. The agent doesn't replace the human, you still review, reproduce, and decide what to report. But it runs the grunt work and hands you everything: the command, the raw output, the reasoning. Repo: https://github.com/Vasco0x4/AIDA <!-- SC_ON --> submitted by /u/TomatoWasabi (https://www.reddit.com/user/TomatoWasabi)
[link] (https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3/)

<!-- SC_OFF -->Hi all, our most recent post gives a first-hand account of how LLMs have transformed the CTF landscape, with winning teams being decided by their orchestration pipelines and access to resources vs a traditional disparity in technical knowledge. We describe why pentests haven't seen a similar surge of automated success due to a variety of factors that show models still have a long way to go in cyber security. <!-- SC_ON --> submitted by /u/IncludeSec (https://www.reddit.com/user/IncludeSec)
[link] (https://blog.includesecurity.com/2026/04/ctfs-in-the-ai-era/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stn5wy/ctfs_in_the_ai_era/)

Mythos can't replace real penetration testers and AI is not a threat, its a workforce amplifier.
https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/

<!-- SC_OFF -->Hi All! I grew tired of hearing about how Mythos / AI will replace human penetration testers. Those of us who understand that real penetration testing is not a checkbox exercise, also know that AI can't touch what we do. I called it out here as best as I could and wanted to share. I welcome feedback, questions, etc. but I figured you'd all appreciate this. https://netragard.com/blog/claude-mythos-and-the-hype-that-will-get-you-breached/ <!-- SC_ON --> submitted by /u/netragard-inc (https://www.reddit.com/user/netragard-inc)
[link] (https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/1strrg5/mythos_cant_replace_real_penetration_testers_and/)

Recherche binôme sérieux (15 ans) – apprentissage & pratique en cyber / programmation / business / tech 🇫🇷
https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/

<!-- SC_OFF -->Hey, Je cherche un binôme motivé (français de préférence) pour progresser sérieusement en cybersécurité principalement, et en tech en général. Moi : • Intéressé par le pentest / bug bounty / programmation / business • J’aime les projets concrets (scripts, outils, automatisation, sites web, SaaS) • Objectif long terme : monter en compétences + créer des projets (SaaS, etc.) Je cherche : • Quelqu’un de sérieux, régulier et ambitieux • Partant pour : • faire des CTF à 2 • apprendre ensemble (sécurité, dev, systèmes) • lancer des projets tech Pourquoi : Aller plus vite, se motiver et construire quelque chose de solide ensemble. Si t’es chaud, envoie-moi un message <!-- SC_ON --> submitted by /u/DataHorizon- (https://www.reddit.com/user/DataHorizon-)
[link] (https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/) [comments] (https://www.reddit.com/r/Pentesting/comments/1stw2vj/recherche_bin%C3%B4me_s%C3%A9rieux_15_ans_apprentissage/)

Open Redirect Simple Bug, Powerful Chains: Phishing Se OAuth Bypass Tak! (Hinglish Mein)

Series: Bug Bounty Zero se Hero 🦸 | Article #22 By HackerMD | 16 min readContinue reading on Medium »
Read more...

The Easiest Bug Bounty Win You’re Overlooking [The $$ Bug Hiding in Plain Sight]

Today,Continue reading on Medium »
Read more...

SameSite=Strict? No Problem — Bypassing It With a Client-Side Redirect

Hey everyone, let’s talk about another CSRF lab from PortSwigger.net.Continue reading on Medium »
Read more...

GitHub Dorking: The Complete 2026 Hunter’s Guide to Finding Exposed Secrets

Every day, developers accidentally push secrets to public GitHub repositories. API keys. Database passwords. AWS credentials. Private…Continue reading on Medium »
Read more...

SSRF → Cloud Compromise — From Internal Access to Credentials

✍️ IntroductionContinue reading on Bug Bounty Hunting: A Comprehensive Guide in English and french »
Read more...

How a Newline Injection in Folder Names Broke Access Revocation: 750$ Bug

How a Newline Injection in Folder Names Broke Access Revocation Sometimes the smallest input validation issues can snowball into serious business logic flaws. This bug is a great example — a simple newline character (%0a) in a folder name was enough to block owners from revoking access rights, leaving attackers stuck with elevated privileges.Understanding the Target CollabSpace(pseudo name for private bbp product) is a cloud-based platform for project collaboration, offering resource sharing, folder management, and granular access controls. Owners can share resources and grant collaborators rights such as View, Edit, or Transfer Edit Rights. To maintain control, project owners should always be able to revoke or update collaborator access. However, this restriction was bypassed by abusing folder naming logic.The Flaw: Newline Injection in Folder Names The vulnerability occurred because the backend failed to validate folder names properly. By creating a folder with a newline character (%0a) at the start of its name, the system broke critical permission workflows. Here’s the malicious request:POST /api/v1/fs?path=&rid=<resource_id>&dirname=%0aattackerfolder HTTP/2 Host: collabspace.com This created a folder with a malformed name that disrupted backend path handling.Steps to ReproduceOwner grants Transfer Edit Rights to a collaborator (attacker).Attacker(editor user) creates a folder with %0a at the start of the folder name.Owner attempts to revoke rights or delete the folderThis action fails due to backend errors triggered by the malformed folder name. Result: The attacker retains their access indefinitely.ImpactPersistent Access: Attackers could keep edit rights permanently.Denial of Control: Owners couldn’t revoke access or delete malicious folders.Workflow Disruption: Ownership revocation logic was effectively broken.Potential Abuse: Attackers could create multiple such folders, locking down workspaces.Bounty & Program ResponseReported: July 7, 2025Triaged: July 9, 2025Severity: High (8.5) → downgraded to Medium (6.0)Bounty Awarded: $500 + $250 bonus The program acknowledged that although the confidentiality impact was low, this was a well-crafted and creative finding that broke ownership workflows, which earned a bonus.Key TakeawaysAlways check user inputs, including folder and file names.Small oversights in business logic can cause privilege persistence issues.Test boundaries with unusual inputs: newlines, nulls, special characters often reveal flaws.Even if a bug seems minor, well-documented reports can lead to bonus rewards.Conclusion This was a unique case where a simple newline injection caused project owners to lose control over collaborator access. It highlights how critical input validation is for access control and ownership workflows. Until next time, happy hacking! 🚀Connect and Engage 💬 What’s your experience with business logic bugs? Follow me on Twitter: @a13h1_ Keep clapping, commenting, and sharing your thoughts — your support motivates me to share more real bug bounty stories! How a Newline Injection in Folder Names Broke Access Revocation: 750$ Bug was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

“Bug Bounty Bootcamp #35: SSRF — Turning the Server Into Your Personal Proxy to Hack Internal…

Imagine if you could trick a web server into visiting internal websites, reading local files, and even scanning private IP ranges on your…Continue reading on InfoSec Write-ups »
Read more...