ghostyjoe™Continue reading on Bug Bounty Hunting: A Comprehensive Guide in English and french » (https://medium.com/bug-bounty-hunting-a-comprehensive-guide-in/bloodhound-series-part-5-detection-defense-blue-team-perspective-final-ba96c5bd2982?source=rss------bug_bounty-5)
Chaining a Session Leak and Broken Access Control in Revive Adserver 6.0.7 Program Hackerone
https://medium.com/@kenjisubagja/chaining-a-session-leak-and-broken-access-control-in-revive-adserver-6-0-7-program-hackerone-156e5cf97826?source=rss------bug_bounty-5
https://medium.com/@kenjisubagja/chaining-a-session-leak-and-broken-access-control-in-revive-adserver-6-0-7-program-hackerone-156e5cf97826?source=rss------bug_bounty-5
How a failed XML-RPC login opened the door to cross-agency unauthorized associations.Continue reading on Medium » (https://medium.com/@kenjisubagja/chaining-a-session-leak-and-broken-access-control-in-revive-adserver-6-0-7-program-hackerone-156e5cf97826?source=rss------bug_bounty-5)
Bounty for an Out-of-Scope Vulnerability
https://medium.com/@hemand390hemanth/bounty-for-an-out-of-scope-vulnerability-96dd0a6ba536?source=rss------bug_bounty-5
https://medium.com/@hemand390hemanth/bounty-for-an-out-of-scope-vulnerability-96dd0a6ba536?source=rss------bug_bounty-5
Why API Security Matters More Than EverContinue reading on Medium » (https://medium.com/@hemand390hemanth/bounty-for-an-out-of-scope-vulnerability-96dd0a6ba536?source=rss------bug_bounty-5)
Introducing Ghost Engine v3.2: An Automated Bug Bounty Recon Suite
https://medium.com/@muhammed_shifan_kamalsha_tk/introducing-ghost-engine-v3-2-an-automated-bug-bounty-recon-suite-9900fe246fd4?source=rss------bug_bounty-5
https://medium.com/@muhammed_shifan_kamalsha_tk/introducing-ghost-engine-v3-2-an-automated-bug-bounty-recon-suite-9900fe246fd4?source=rss------bug_bounty-5
How I Got My NASA Hall of Fame: A Unique Twist on Google Dorking
https://vanshrathorebughunter.medium.com/how-i-got-my-nasa-hall-of-fame-a-unique-twist-on-google-dorking-a954193b317f?source=rss------bug_bounty-5
https://vanshrathorebughunter.medium.com/how-i-got-my-nasa-hall-of-fame-a-unique-twist-on-google-dorking-a954193b317f?source=rss------bug_bounty-5
How I Got My NASA Hall of Fame: A Unique Twist on Google Dorking
LinkedIn:- https://www.linkedin.com/in/vansh-rathore-cybersecurity/Continue reading on Medium »
Read more...
LinkedIn:- https://www.linkedin.com/in/vansh-rathore-cybersecurity/Continue reading on Medium »
Read more...
How a 19-Year-Old Made $2,500 in 10 Minutes (And Why Most Bug Bounty Advice Is Garbage)
Forget zero-days. Forget writing 500-line Python scripts. Here’s the blunt reality of web security after 7 years in incident response.Continue reading on Medium »
Read more...
Forget zero-days. Forget writing 500-line Python scripts. Here’s the blunt reality of web security after 7 years in incident response.Continue reading on Medium »
Read more...
Medium
How a 19-Year-Old Made $2,500 in 10 Minutes (And Why Most Bug Bounty Advice Is Garbage)
Forget zero-days. Forget writing 500-line Python scripts. Here’s the blunt reality of web security after 7 years in incident response.
Code Execution via Provisioning Packages
https://www.reddit.com/r/redteamsec/comments/1vf4i03/code_execution_via_provisioning_packages/
submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://ipurple.team/2026/08/04/provisioning-packages/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vf4i03/code_execution_via_provisioning_packages/)
https://www.reddit.com/r/redteamsec/comments/1vf4i03/code_execution_via_provisioning_packages/
submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://ipurple.team/2026/08/04/provisioning-packages/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vf4i03/code_execution_via_provisioning_packages/)
HEVD: From Stack Overflows to Modern Pool Grooming
https://www.reddit.com/r/redteamsec/comments/1vf5ve6/hevd_from_stack_overflows_to_modern_pool_grooming/
submitted by /u/Important_Map6928 (https://www.reddit.com/user/Important_Map6928)
[link] (https://sibouzitoun.tech/labs/from-stack-overflows-to-modern-pool-grooming/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vf5ve6/hevd_from_stack_overflows_to_modern_pool_grooming/)
https://www.reddit.com/r/redteamsec/comments/1vf5ve6/hevd_from_stack_overflows_to_modern_pool_grooming/
submitted by /u/Important_Map6928 (https://www.reddit.com/user/Important_Map6928)
[link] (https://sibouzitoun.tech/labs/from-stack-overflows-to-modern-pool-grooming/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vf5ve6/hevd_from_stack_overflows_to_modern_pool_grooming/)
API Recon — Mapping Every Hidden Endpoint
What’s up everyone! Nitin here 👋Continue reading on Medium »
Read more...
What’s up everyone! Nitin here 👋Continue reading on Medium »
Read more...
Built a self-hosted CVE + IOC intelligence tool "BRIEFR", first module of a bigger self-hosted SIEM idea I scoped back down to size
https://www.reddit.com/r/redteamsec/comments/1vfj83p/built_a_selfhosted_cve_ioc_intelligence_tool/
<!-- SC_OFF -->I wanted to build a self hosted, open source SIEM, and understood i punched above my weight & realized it is highly complicated, so i broke it down into multiple independent(hopefully) modules, log ingestion & normalization/enrichment, threat intel, log management, threat hunting, policy monitoring, so this is my first module i built as threat intel plane, track latest CVEs and keep myself updated. so I built BRIEFR. If this tool saves an hour of someone's time, i'm more than happy :) **What BRIEFR does:** * Pulls from NVD, CISA KEV, FIRST EPSS, and a few exploit feeds * Scores each CVE against your tech stack with a weighted formula so that one can see the reasoning behind. * Correlates CVEs that share real threat-intel evidence. * IOC lookup (IP/hash/domain) using free-tier VirusTotal, AbuseIPDB, MalwareBazzar and URLHaus * Pulls in Sigma Community rules from SigmaHQ and SIEM query starters tied to ATT&CK **On the AI question, since I know it'll come up:** a few narrow tasks (like PDF summarization) routed through free-tier LLM APIs with failover between providers. The actual scoring, correlation, and detection logic is deterministic code, no AI making the calls/decisions on what's risky. I also want to be upfront that I used Cursor/Claude heavily throughout the build and directed the architecture, design and review. **Current state of BRIEFR:** this is early alpha and my first ever released tool. I run it daily myself with no major issues, but there will be rough edges, no docker-compose for the full app yet (Postgres+pgvector is containerized, the app itself is native linux for now), and I'm sure there are things a more experienced analyst will spot that I haven't. Self-host guide and full docs are linked below if you want to actually try it, or there's a live demo with sample data if you just want to look first. Big Picture: https://projectjupiter.in (https://projectjupiter.in/) Live demo (no install/sample data): https://briefrdemo.projectjupiter.in (https://briefrdemo.projectjupiter.in/) Docs: https://docs.projectjupiter.in (https://docs.projectjupiter.in/) Source: https://github.com/Soldier0x0/briefr I'm genuinely interested in what an experienced analyst thinks is missing or wrong about the approach, that's more useful to me right now. I know some stuff from docs might be overkill, but as i made it for myself and how i would like to have/learn, so i designed it to my taste and needs. Note: I have worked as SysOps engineer for servers that handle SIEM log ingestion & parsing, then i moved to threat hunting due to my interest in security, and i have nearly 3.8 yrs of experience overall in IT, so my views might not be broad, but the only reason i am posting this here is because this is the first project i have thought about AND completed, in forever, as a person with ADHD and other stuff, this is a big achievement for me, even if the tool is crap for others, i completely understand, and i am very open to suggestions :)
Have a great day. <!-- SC_ON --> submitted by /u/Soldier0x00 (https://www.reddit.com/user/Soldier0x00)
[link] (https://github.com/Soldier0x0/briefr) [comments] (https://www.reddit.com/r/redteamsec/comments/1vfj83p/built_a_selfhosted_cve_ioc_intelligence_tool/)
https://www.reddit.com/r/redteamsec/comments/1vfj83p/built_a_selfhosted_cve_ioc_intelligence_tool/
<!-- SC_OFF -->I wanted to build a self hosted, open source SIEM, and understood i punched above my weight & realized it is highly complicated, so i broke it down into multiple independent(hopefully) modules, log ingestion & normalization/enrichment, threat intel, log management, threat hunting, policy monitoring, so this is my first module i built as threat intel plane, track latest CVEs and keep myself updated. so I built BRIEFR. If this tool saves an hour of someone's time, i'm more than happy :) **What BRIEFR does:** * Pulls from NVD, CISA KEV, FIRST EPSS, and a few exploit feeds * Scores each CVE against your tech stack with a weighted formula so that one can see the reasoning behind. * Correlates CVEs that share real threat-intel evidence. * IOC lookup (IP/hash/domain) using free-tier VirusTotal, AbuseIPDB, MalwareBazzar and URLHaus * Pulls in Sigma Community rules from SigmaHQ and SIEM query starters tied to ATT&CK **On the AI question, since I know it'll come up:** a few narrow tasks (like PDF summarization) routed through free-tier LLM APIs with failover between providers. The actual scoring, correlation, and detection logic is deterministic code, no AI making the calls/decisions on what's risky. I also want to be upfront that I used Cursor/Claude heavily throughout the build and directed the architecture, design and review. **Current state of BRIEFR:** this is early alpha and my first ever released tool. I run it daily myself with no major issues, but there will be rough edges, no docker-compose for the full app yet (Postgres+pgvector is containerized, the app itself is native linux for now), and I'm sure there are things a more experienced analyst will spot that I haven't. Self-host guide and full docs are linked below if you want to actually try it, or there's a live demo with sample data if you just want to look first. Big Picture: https://projectjupiter.in (https://projectjupiter.in/) Live demo (no install/sample data): https://briefrdemo.projectjupiter.in (https://briefrdemo.projectjupiter.in/) Docs: https://docs.projectjupiter.in (https://docs.projectjupiter.in/) Source: https://github.com/Soldier0x0/briefr I'm genuinely interested in what an experienced analyst thinks is missing or wrong about the approach, that's more useful to me right now. I know some stuff from docs might be overkill, but as i made it for myself and how i would like to have/learn, so i designed it to my taste and needs. Note: I have worked as SysOps engineer for servers that handle SIEM log ingestion & parsing, then i moved to threat hunting due to my interest in security, and i have nearly 3.8 yrs of experience overall in IT, so my views might not be broad, but the only reason i am posting this here is because this is the first project i have thought about AND completed, in forever, as a person with ADHD and other stuff, this is a big achievement for me, even if the tool is crap for others, i completely understand, and i am very open to suggestions :)
Have a great day. <!-- SC_ON --> submitted by /u/Soldier0x00 (https://www.reddit.com/user/Soldier0x00)
[link] (https://github.com/Soldier0x0/briefr) [comments] (https://www.reddit.com/r/redteamsec/comments/1vfj83p/built_a_selfhosted_cve_ioc_intelligence_tool/)
CVE-2026-69243 PoC: aiohttp request smuggling through a rejected WebSocket upgrade
https://www.reddit.com/r/redteamsec/comments/1vfp76j/cve202669243_poc_aiohttp_request_smuggling/
<!-- SC_OFF -->TL;DR: CVE-2026-69243 — on aiohttp ≤3.14.1, a rejected WebSocket upgrade leaves the request body sitting in the parser tail, and aiohttp then feeds it back as a pipelined request. Behind the Nginx WebSocket config from the official docs, Nginx logs one request and aiohttp processes two. First public PoC, in Python and Rust, plus the lab. Impact here is blind handler invocation, not response disclosure. Hey hey you all, it's me again So, The aiohttp advisory (GHSA-mfx4-hv73-q22v (https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v), CVE-2026-69243 (https://advisories.gitlab.com/pypi/aiohttp/CVE-2026-69243/), fixed in 3.14.2) described request smuggling "using an edge case in the WebSocket upgrade procedure" and noted no public exploit code existed, so i took it as a challenge and built a lab to reproduce it and work out what the actual impact is behind a proxy. The cause is that a request with `Connection: Upgrade`, `Upgrade: websocket` and a `Content-Length` body makes the C parser return llhttp's "skip body" signal, because an upgrade means the rest of the connection should be another protocol, but that holds only if the upgrade actually happens, when its rejected it returns a normal response with the connection staying HTTP but the body was never consumed, it sits in `_message_tail` and gets fed back into the parser as a pipelined request. `await request.read()` returns zero bytes on that request, The body is withheld below the handler layer, so you cannot drain it from application code. Patching or stripping upgrade headers at the proxy are some options. So I tested three Nginx configurations. The one straight out of the Nginx WebSocket documentation is the one that produces the desync, Nginx logs one request, aiohttp processes two. A smuggled request also bypassed `location /admin { deny all; }`. In this topology the second response is absorbed by the proxy, so it ends up being a blind handler invocation, the same payload against 3.14.2 produces one backend request. Lab is seven containers with the aiohttp versions pinned by build arg, PoCs in Python and Rust with byte-identical payloads enforced in CI, plus the detection side (what the desync looks like in Nginx logs). Write-up: glitchedcat.com (https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/)
Lab + PoC: https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling Disclosure: I'm the author of both. Reporter credit for the bug goes to shivams0099, fix by Dreamsorcerer. <!-- SC_ON --> submitted by /u/FrozenSuricats (https://www.reddit.com/user/FrozenSuricats)
[link] (https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vfp76j/cve202669243_poc_aiohttp_request_smuggling/)
https://www.reddit.com/r/redteamsec/comments/1vfp76j/cve202669243_poc_aiohttp_request_smuggling/
<!-- SC_OFF -->TL;DR: CVE-2026-69243 — on aiohttp ≤3.14.1, a rejected WebSocket upgrade leaves the request body sitting in the parser tail, and aiohttp then feeds it back as a pipelined request. Behind the Nginx WebSocket config from the official docs, Nginx logs one request and aiohttp processes two. First public PoC, in Python and Rust, plus the lab. Impact here is blind handler invocation, not response disclosure. Hey hey you all, it's me again So, The aiohttp advisory (GHSA-mfx4-hv73-q22v (https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v), CVE-2026-69243 (https://advisories.gitlab.com/pypi/aiohttp/CVE-2026-69243/), fixed in 3.14.2) described request smuggling "using an edge case in the WebSocket upgrade procedure" and noted no public exploit code existed, so i took it as a challenge and built a lab to reproduce it and work out what the actual impact is behind a proxy. The cause is that a request with `Connection: Upgrade`, `Upgrade: websocket` and a `Content-Length` body makes the C parser return llhttp's "skip body" signal, because an upgrade means the rest of the connection should be another protocol, but that holds only if the upgrade actually happens, when its rejected it returns a normal response with the connection staying HTTP but the body was never consumed, it sits in `_message_tail` and gets fed back into the parser as a pipelined request. `await request.read()` returns zero bytes on that request, The body is withheld below the handler layer, so you cannot drain it from application code. Patching or stripping upgrade headers at the proxy are some options. So I tested three Nginx configurations. The one straight out of the Nginx WebSocket documentation is the one that produces the desync, Nginx logs one request, aiohttp processes two. A smuggled request also bypassed `location /admin { deny all; }`. In this topology the second response is absorbed by the proxy, so it ends up being a blind handler invocation, the same payload against 3.14.2 produces one backend request. Lab is seven containers with the aiohttp versions pinned by build arg, PoCs in Python and Rust with byte-identical payloads enforced in CI, plus the detection side (what the desync looks like in Nginx logs). Write-up: glitchedcat.com (https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/)
Lab + PoC: https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling Disclosure: I'm the author of both. Reporter credit for the bug goes to shivams0099, fix by Dreamsorcerer. <!-- SC_ON --> submitted by /u/FrozenSuricats (https://www.reddit.com/user/FrozenSuricats)
[link] (https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vfp76j/cve202669243_poc_aiohttp_request_smuggling/)