OverTheWire-Bandit Notes

Level 0 → Level 1Continue reading on Medium »
Read more...

How focusing on a single bug bounty program for months helped me find critical vulnerabilities

Most bug hunters jump from one program to another.Continue reading on Medium »
Read more...

Misconfiguration In Wordpress “wp-cron.php” to peform DOS Attack

السلام عليكم ورحمة الله و بركاتهContinue reading on Medium »
Read more...

How I Discovered 5 broken Access Control Bugs in a Single Web Application

Hi Hunters,Continue reading on Medium »
Read more...

How I Turned $3 Into 8 Paid Bugs

بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ اللَّهُمَّ صَلِّ وَسَلِّمْ وَبَارِكْ عَلَى سَيِّدِنَا مُحَمَّدٍContinue reading on Medium »
Read more...

How I Earned a Hall of Fame from NASA Success in bug bounty hunting isn’t just about the tools you…

Continue reading on Medium »
Read more...

MultiCode — picoCTF Writeup (Layered Encoding Explained)

Challenge DescriptionContinue reading on Medium »
Read more...

How I discovered my first valid Bug

This was the first bug I discovered in a employee managment web application. After discovering the bug, I responsibly reported it to the…Continue reading on Medium »
Read more...

From Source Code Review To Critical Vulnerability — Critical Firebase API Takeover

SummaryContinue reading on Medium »
Read more...

This is my third bug bounty report: How I found an XSS vulnerability

Hi everyone! Today I’m going to tell you about a vulnerability I found and discuss the topic of exploit chaining.Continue reading on Medium »
Read more...

GitHub - iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail: Rust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).
https://www.reddit.com/r/redteamsec/comments/1szpnxo/github_iss4cf0ngcve202631431linuxcopyfail_rust/

submitted by /u/AcrobaticMonitor9992 (https://www.reddit.com/user/AcrobaticMonitor9992)
[link] (https://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail) [comments] (https://www.reddit.com/r/redteamsec/comments/1szpnxo/github_iss4cf0ngcve202631431linuxcopyfail_rust/)

Getting AdaptixC2 Past Windows Defender with Beatrice.py (Opcode Substitution | YARA Hunting | SIEM Detection)
https://www.reddit.com/r/redteamsec/comments/1t0vq8h/getting_adaptixc2_past_windows_defender_with/

<!-- SC_OFF -->Getting AdaptixC2 Past Windows Defender with Beatrice.py (Opcode Substitution | YARA Hunting | SIEM Detection) New Weekly Purple Team video covering end-to-end evasion technique, then detection on the blue side. The tool, Beatrice, is an open-source Python script that patches compiled binaries by swapping x64 opcodes with semantically equivalent alternatives — same functionality, different bytes. It strictly matches machine code, so it doesn't break binaries by accidentally hitting strings or data. What the video covers: How Beatrice.py works under the hood (opcode substitution, instruction re-encoding, what it won't help with) Generating an AdaptixC2 payload with IAT Hiding enabled Running Beatrice.py against the beacon and reviewing the patches Live test against Windows Defender — real-time protection on, no exclusions YARA-based detection via Velociraptor for hunting modified beacons in your environment SIEM detections for AdaptixC2 beacon activity Worth noting: Beatrice.py won't save you from behavior-based detection, string-based signatures, or import analysis — it's a static evasion layer, not a silver bullet. AdaptixC2 with IAT Hiding is already fairly evasive, but this adds a layer of resilience against future Microsoft signature updates. Links: 📺 Video: https://youtu.be/H3BdgCekrjY 🔗 Beatrice.py: https://github.com/raskolnikov90/Beatrice.py 🔗 AdaptixC2: https://github.com/Adaptix-Framework/AdaptixC2 Happy to answer questions on either the red or blue side. <!-- SC_ON --> submitted by /u/Infosecsamurai (https://www.reddit.com/user/Infosecsamurai)
[link] (https://youtu.be/H3BdgCekrjY) [comments] (https://www.reddit.com/r/redteamsec/comments/1t0vq8h/getting_adaptixc2_past_windows_defender_with/)

How focusing on a single bug bounty program for months helped me find critical vulnerabilities
https://medium.com/@deepk007/how-focusing-on-a-single-bug-bounty-program-for-months-helped-me-find-critical-vulnerabilities-3581d3e32e38?source=rss------bug_bounty-5

Most bug hunters jump from one program to another.Continue reading on Medium » (https://medium.com/@deepk007/how-focusing-on-a-single-bug-bounty-program-for-months-helped-me-find-critical-vulnerabilities-3581d3e32e38?source=rss------bug_bounty-5)

Misconfiguration In Wordpress “wp-cron.php” to peform DOS Attack
https://medium.com/@amrturboo11/misconfiguration-in-wordpress-wp-cron-php-to-peform-dos-attack-ada4f28c9dfb?source=rss------bug_bounty-5

السلام عليكم ورحمة الله و بركاتهContinue reading on Medium » (https://medium.com/@amrturboo11/misconfiguration-in-wordpress-wp-cron-php-to-peform-dos-attack-ada4f28c9dfb?source=rss------bug_bounty-5)

How I Discovered 5 broken Access Control Bugs in a Single Web Application
https://medium.com/@0xyz_/how-i-discovered-5-broken-access-control-bugs-in-a-single-web-application-44d95652872f?source=rss------bug_bounty-5

Hi Hunters,Continue reading on Medium » (https://medium.com/@0xyz_/how-i-discovered-5-broken-access-control-bugs-in-a-single-web-application-44d95652872f?source=rss------bug_bounty-5)