How I Got My NASA Hall of Fame: A Unique Twist on Google Dorking
https://vanshrathorebughunter.medium.com/how-i-got-my-nasa-hall-of-fame-a-unique-twist-on-google-dorking-a954193b317f?source=rss------bug_bounty-5
https://vanshrathorebughunter.medium.com/how-i-got-my-nasa-hall-of-fame-a-unique-twist-on-google-dorking-a954193b317f?source=rss------bug_bounty-5
How I Got My NASA Hall of Fame: A Unique Twist on Google Dorking
LinkedIn:- https://www.linkedin.com/in/vansh-rathore-cybersecurity/Continue reading on Medium »
Read more...
LinkedIn:- https://www.linkedin.com/in/vansh-rathore-cybersecurity/Continue reading on Medium »
Read more...
How a 19-Year-Old Made $2,500 in 10 Minutes (And Why Most Bug Bounty Advice Is Garbage)
Forget zero-days. Forget writing 500-line Python scripts. Here’s the blunt reality of web security after 7 years in incident response.Continue reading on Medium »
Read more...
Forget zero-days. Forget writing 500-line Python scripts. Here’s the blunt reality of web security after 7 years in incident response.Continue reading on Medium »
Read more...
Medium
How a 19-Year-Old Made $2,500 in 10 Minutes (And Why Most Bug Bounty Advice Is Garbage)
Forget zero-days. Forget writing 500-line Python scripts. Here’s the blunt reality of web security after 7 years in incident response.
Code Execution via Provisioning Packages
https://www.reddit.com/r/redteamsec/comments/1vf4i03/code_execution_via_provisioning_packages/
submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://ipurple.team/2026/08/04/provisioning-packages/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vf4i03/code_execution_via_provisioning_packages/)
https://www.reddit.com/r/redteamsec/comments/1vf4i03/code_execution_via_provisioning_packages/
submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://ipurple.team/2026/08/04/provisioning-packages/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vf4i03/code_execution_via_provisioning_packages/)
HEVD: From Stack Overflows to Modern Pool Grooming
https://www.reddit.com/r/redteamsec/comments/1vf5ve6/hevd_from_stack_overflows_to_modern_pool_grooming/
submitted by /u/Important_Map6928 (https://www.reddit.com/user/Important_Map6928)
[link] (https://sibouzitoun.tech/labs/from-stack-overflows-to-modern-pool-grooming/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vf5ve6/hevd_from_stack_overflows_to_modern_pool_grooming/)
https://www.reddit.com/r/redteamsec/comments/1vf5ve6/hevd_from_stack_overflows_to_modern_pool_grooming/
submitted by /u/Important_Map6928 (https://www.reddit.com/user/Important_Map6928)
[link] (https://sibouzitoun.tech/labs/from-stack-overflows-to-modern-pool-grooming/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vf5ve6/hevd_from_stack_overflows_to_modern_pool_grooming/)
API Recon — Mapping Every Hidden Endpoint
What’s up everyone! Nitin here 👋Continue reading on Medium »
Read more...
What’s up everyone! Nitin here 👋Continue reading on Medium »
Read more...
Built a self-hosted CVE + IOC intelligence tool "BRIEFR", first module of a bigger self-hosted SIEM idea I scoped back down to size
https://www.reddit.com/r/redteamsec/comments/1vfj83p/built_a_selfhosted_cve_ioc_intelligence_tool/
<!-- SC_OFF -->I wanted to build a self hosted, open source SIEM, and understood i punched above my weight & realized it is highly complicated, so i broke it down into multiple independent(hopefully) modules, log ingestion & normalization/enrichment, threat intel, log management, threat hunting, policy monitoring, so this is my first module i built as threat intel plane, track latest CVEs and keep myself updated. so I built BRIEFR. If this tool saves an hour of someone's time, i'm more than happy :) **What BRIEFR does:** * Pulls from NVD, CISA KEV, FIRST EPSS, and a few exploit feeds * Scores each CVE against your tech stack with a weighted formula so that one can see the reasoning behind. * Correlates CVEs that share real threat-intel evidence. * IOC lookup (IP/hash/domain) using free-tier VirusTotal, AbuseIPDB, MalwareBazzar and URLHaus * Pulls in Sigma Community rules from SigmaHQ and SIEM query starters tied to ATT&CK **On the AI question, since I know it'll come up:** a few narrow tasks (like PDF summarization) routed through free-tier LLM APIs with failover between providers. The actual scoring, correlation, and detection logic is deterministic code, no AI making the calls/decisions on what's risky. I also want to be upfront that I used Cursor/Claude heavily throughout the build and directed the architecture, design and review. **Current state of BRIEFR:** this is early alpha and my first ever released tool. I run it daily myself with no major issues, but there will be rough edges, no docker-compose for the full app yet (Postgres+pgvector is containerized, the app itself is native linux for now), and I'm sure there are things a more experienced analyst will spot that I haven't. Self-host guide and full docs are linked below if you want to actually try it, or there's a live demo with sample data if you just want to look first. Big Picture: https://projectjupiter.in (https://projectjupiter.in/) Live demo (no install/sample data): https://briefrdemo.projectjupiter.in (https://briefrdemo.projectjupiter.in/) Docs: https://docs.projectjupiter.in (https://docs.projectjupiter.in/) Source: https://github.com/Soldier0x0/briefr I'm genuinely interested in what an experienced analyst thinks is missing or wrong about the approach, that's more useful to me right now. I know some stuff from docs might be overkill, but as i made it for myself and how i would like to have/learn, so i designed it to my taste and needs. Note: I have worked as SysOps engineer for servers that handle SIEM log ingestion & parsing, then i moved to threat hunting due to my interest in security, and i have nearly 3.8 yrs of experience overall in IT, so my views might not be broad, but the only reason i am posting this here is because this is the first project i have thought about AND completed, in forever, as a person with ADHD and other stuff, this is a big achievement for me, even if the tool is crap for others, i completely understand, and i am very open to suggestions :)
Have a great day. <!-- SC_ON --> submitted by /u/Soldier0x00 (https://www.reddit.com/user/Soldier0x00)
[link] (https://github.com/Soldier0x0/briefr) [comments] (https://www.reddit.com/r/redteamsec/comments/1vfj83p/built_a_selfhosted_cve_ioc_intelligence_tool/)
https://www.reddit.com/r/redteamsec/comments/1vfj83p/built_a_selfhosted_cve_ioc_intelligence_tool/
<!-- SC_OFF -->I wanted to build a self hosted, open source SIEM, and understood i punched above my weight & realized it is highly complicated, so i broke it down into multiple independent(hopefully) modules, log ingestion & normalization/enrichment, threat intel, log management, threat hunting, policy monitoring, so this is my first module i built as threat intel plane, track latest CVEs and keep myself updated. so I built BRIEFR. If this tool saves an hour of someone's time, i'm more than happy :) **What BRIEFR does:** * Pulls from NVD, CISA KEV, FIRST EPSS, and a few exploit feeds * Scores each CVE against your tech stack with a weighted formula so that one can see the reasoning behind. * Correlates CVEs that share real threat-intel evidence. * IOC lookup (IP/hash/domain) using free-tier VirusTotal, AbuseIPDB, MalwareBazzar and URLHaus * Pulls in Sigma Community rules from SigmaHQ and SIEM query starters tied to ATT&CK **On the AI question, since I know it'll come up:** a few narrow tasks (like PDF summarization) routed through free-tier LLM APIs with failover between providers. The actual scoring, correlation, and detection logic is deterministic code, no AI making the calls/decisions on what's risky. I also want to be upfront that I used Cursor/Claude heavily throughout the build and directed the architecture, design and review. **Current state of BRIEFR:** this is early alpha and my first ever released tool. I run it daily myself with no major issues, but there will be rough edges, no docker-compose for the full app yet (Postgres+pgvector is containerized, the app itself is native linux for now), and I'm sure there are things a more experienced analyst will spot that I haven't. Self-host guide and full docs are linked below if you want to actually try it, or there's a live demo with sample data if you just want to look first. Big Picture: https://projectjupiter.in (https://projectjupiter.in/) Live demo (no install/sample data): https://briefrdemo.projectjupiter.in (https://briefrdemo.projectjupiter.in/) Docs: https://docs.projectjupiter.in (https://docs.projectjupiter.in/) Source: https://github.com/Soldier0x0/briefr I'm genuinely interested in what an experienced analyst thinks is missing or wrong about the approach, that's more useful to me right now. I know some stuff from docs might be overkill, but as i made it for myself and how i would like to have/learn, so i designed it to my taste and needs. Note: I have worked as SysOps engineer for servers that handle SIEM log ingestion & parsing, then i moved to threat hunting due to my interest in security, and i have nearly 3.8 yrs of experience overall in IT, so my views might not be broad, but the only reason i am posting this here is because this is the first project i have thought about AND completed, in forever, as a person with ADHD and other stuff, this is a big achievement for me, even if the tool is crap for others, i completely understand, and i am very open to suggestions :)
Have a great day. <!-- SC_ON --> submitted by /u/Soldier0x00 (https://www.reddit.com/user/Soldier0x00)
[link] (https://github.com/Soldier0x0/briefr) [comments] (https://www.reddit.com/r/redteamsec/comments/1vfj83p/built_a_selfhosted_cve_ioc_intelligence_tool/)
CVE-2026-69243 PoC: aiohttp request smuggling through a rejected WebSocket upgrade
https://www.reddit.com/r/redteamsec/comments/1vfp76j/cve202669243_poc_aiohttp_request_smuggling/
<!-- SC_OFF -->TL;DR: CVE-2026-69243 — on aiohttp ≤3.14.1, a rejected WebSocket upgrade leaves the request body sitting in the parser tail, and aiohttp then feeds it back as a pipelined request. Behind the Nginx WebSocket config from the official docs, Nginx logs one request and aiohttp processes two. First public PoC, in Python and Rust, plus the lab. Impact here is blind handler invocation, not response disclosure. Hey hey you all, it's me again So, The aiohttp advisory (GHSA-mfx4-hv73-q22v (https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v), CVE-2026-69243 (https://advisories.gitlab.com/pypi/aiohttp/CVE-2026-69243/), fixed in 3.14.2) described request smuggling "using an edge case in the WebSocket upgrade procedure" and noted no public exploit code existed, so i took it as a challenge and built a lab to reproduce it and work out what the actual impact is behind a proxy. The cause is that a request with `Connection: Upgrade`, `Upgrade: websocket` and a `Content-Length` body makes the C parser return llhttp's "skip body" signal, because an upgrade means the rest of the connection should be another protocol, but that holds only if the upgrade actually happens, when its rejected it returns a normal response with the connection staying HTTP but the body was never consumed, it sits in `_message_tail` and gets fed back into the parser as a pipelined request. `await request.read()` returns zero bytes on that request, The body is withheld below the handler layer, so you cannot drain it from application code. Patching or stripping upgrade headers at the proxy are some options. So I tested three Nginx configurations. The one straight out of the Nginx WebSocket documentation is the one that produces the desync, Nginx logs one request, aiohttp processes two. A smuggled request also bypassed `location /admin { deny all; }`. In this topology the second response is absorbed by the proxy, so it ends up being a blind handler invocation, the same payload against 3.14.2 produces one backend request. Lab is seven containers with the aiohttp versions pinned by build arg, PoCs in Python and Rust with byte-identical payloads enforced in CI, plus the detection side (what the desync looks like in Nginx logs). Write-up: glitchedcat.com (https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/)
Lab + PoC: https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling Disclosure: I'm the author of both. Reporter credit for the bug goes to shivams0099, fix by Dreamsorcerer. <!-- SC_ON --> submitted by /u/FrozenSuricats (https://www.reddit.com/user/FrozenSuricats)
[link] (https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vfp76j/cve202669243_poc_aiohttp_request_smuggling/)
https://www.reddit.com/r/redteamsec/comments/1vfp76j/cve202669243_poc_aiohttp_request_smuggling/
<!-- SC_OFF -->TL;DR: CVE-2026-69243 — on aiohttp ≤3.14.1, a rejected WebSocket upgrade leaves the request body sitting in the parser tail, and aiohttp then feeds it back as a pipelined request. Behind the Nginx WebSocket config from the official docs, Nginx logs one request and aiohttp processes two. First public PoC, in Python and Rust, plus the lab. Impact here is blind handler invocation, not response disclosure. Hey hey you all, it's me again So, The aiohttp advisory (GHSA-mfx4-hv73-q22v (https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v), CVE-2026-69243 (https://advisories.gitlab.com/pypi/aiohttp/CVE-2026-69243/), fixed in 3.14.2) described request smuggling "using an edge case in the WebSocket upgrade procedure" and noted no public exploit code existed, so i took it as a challenge and built a lab to reproduce it and work out what the actual impact is behind a proxy. The cause is that a request with `Connection: Upgrade`, `Upgrade: websocket` and a `Content-Length` body makes the C parser return llhttp's "skip body" signal, because an upgrade means the rest of the connection should be another protocol, but that holds only if the upgrade actually happens, when its rejected it returns a normal response with the connection staying HTTP but the body was never consumed, it sits in `_message_tail` and gets fed back into the parser as a pipelined request. `await request.read()` returns zero bytes on that request, The body is withheld below the handler layer, so you cannot drain it from application code. Patching or stripping upgrade headers at the proxy are some options. So I tested three Nginx configurations. The one straight out of the Nginx WebSocket documentation is the one that produces the desync, Nginx logs one request, aiohttp processes two. A smuggled request also bypassed `location /admin { deny all; }`. In this topology the second response is absorbed by the proxy, so it ends up being a blind handler invocation, the same payload against 3.14.2 produces one backend request. Lab is seven containers with the aiohttp versions pinned by build arg, PoCs in Python and Rust with byte-identical payloads enforced in CI, plus the detection side (what the desync looks like in Nginx logs). Write-up: glitchedcat.com (https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/)
Lab + PoC: https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling Disclosure: I'm the author of both. Reporter credit for the bug goes to shivams0099, fix by Dreamsorcerer. <!-- SC_ON --> submitted by /u/FrozenSuricats (https://www.reddit.com/user/FrozenSuricats)
[link] (https://glitchedcat.com/posts/cve-2026-69243-poc-aiohttp-websocket-upgrade-smuggling/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vfp76j/cve202669243_poc_aiohttp_request_smuggling/)
UK AISI Releases Report Shaking the Cybersecurity Field
https://www.reddit.com/r/redteamsec/comments/1vg1n20/uk_aisi_releases_report_shaking_the_cybersecurity/
<!-- SC_OFF -->The UK Artificial Intelligence Security Institute (UK AISI) published surprising findings in its August 4th report from security tests conducted on Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol models. The report reveals significant behaviours observed in agents, including: - Creating fake online identities to manipulate systems, - Writing malicious code and injection attacks to persuade human users to give their consent, - Supply-chain attacks targeting open-source software, - Attempts to gain unauthorized network access by exceeding boundaries, - Collaboration between independent agents. AI is no longer just a tool; it's evolving into an actor that attempts to deceive systems and even manipulate humans. Securing LLM-based architectures and autonomous agents is becoming increasingly complex. We are now seriously observing agents' "deception" tendencies. You can access the details of the report via the link. <!-- SC_ON --> submitted by /u/CivanOnur (https://www.reddit.com/user/CivanOnur)
[link] (https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing) [comments] (https://www.reddit.com/r/redteamsec/comments/1vg1n20/uk_aisi_releases_report_shaking_the_cybersecurity/)
https://www.reddit.com/r/redteamsec/comments/1vg1n20/uk_aisi_releases_report_shaking_the_cybersecurity/
<!-- SC_OFF -->The UK Artificial Intelligence Security Institute (UK AISI) published surprising findings in its August 4th report from security tests conducted on Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol models. The report reveals significant behaviours observed in agents, including: - Creating fake online identities to manipulate systems, - Writing malicious code and injection attacks to persuade human users to give their consent, - Supply-chain attacks targeting open-source software, - Attempts to gain unauthorized network access by exceeding boundaries, - Collaboration between independent agents. AI is no longer just a tool; it's evolving into an actor that attempts to deceive systems and even manipulate humans. Securing LLM-based architectures and autonomous agents is becoming increasingly complex. We are now seriously observing agents' "deception" tendencies. You can access the details of the report via the link. <!-- SC_ON --> submitted by /u/CivanOnur (https://www.reddit.com/user/CivanOnur)
[link] (https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing) [comments] (https://www.reddit.com/r/redteamsec/comments/1vg1n20/uk_aisi_releases_report_shaking_the_cybersecurity/)
how do i get a junior pentesting job in europe
https://www.reddit.com/r/Pentesting/comments/1veaurt/how_do_i_get_a_junior_pentesting_job_in_europe/
<!-- SC_OFF -->I live in Egypt, i started with some web development and then got into security, i solved all portswigger labs and so far I've got 25 valid paid bug bounty submissions including 4 critical and 3 high while the rest is between medium and low, no CTF experience or CVEs or certificates I want to move into pentesting professionally, i'm targeting europe market and i did some research, as far as i understand is that for a junior role i need to have eJPT and a bug bounty portfolio is that actually it or i need other things to be competitive in that market? any tips or advice is greatly appreciated <!-- SC_ON --> submitted by /u/iamZorc_ (https://www.reddit.com/user/iamZorc_)
[link] (https://www.reddit.com/r/Pentesting/comments/1veaurt/how_do_i_get_a_junior_pentesting_job_in_europe/) [comments] (https://www.reddit.com/r/Pentesting/comments/1veaurt/how_do_i_get_a_junior_pentesting_job_in_europe/)
https://www.reddit.com/r/Pentesting/comments/1veaurt/how_do_i_get_a_junior_pentesting_job_in_europe/
<!-- SC_OFF -->I live in Egypt, i started with some web development and then got into security, i solved all portswigger labs and so far I've got 25 valid paid bug bounty submissions including 4 critical and 3 high while the rest is between medium and low, no CTF experience or CVEs or certificates I want to move into pentesting professionally, i'm targeting europe market and i did some research, as far as i understand is that for a junior role i need to have eJPT and a bug bounty portfolio is that actually it or i need other things to be competitive in that market? any tips or advice is greatly appreciated <!-- SC_ON --> submitted by /u/iamZorc_ (https://www.reddit.com/user/iamZorc_)
[link] (https://www.reddit.com/r/Pentesting/comments/1veaurt/how_do_i_get_a_junior_pentesting_job_in_europe/) [comments] (https://www.reddit.com/r/Pentesting/comments/1veaurt/how_do_i_get_a_junior_pentesting_job_in_europe/)
Claude code for CVE hunting
https://www.reddit.com/r/Pentesting/comments/1vebifw/claude_code_for_cve_hunting/
<!-- SC_OFF -->I have been using claude code to help me with CVE hunting, I am using skill file from claude s GitHub repo for code review and for creating poc the agents are doing all the stuff I bought claude pro cause I wanted to learn how I can integrate ai in my workflow, since oss is easy have i have the source code I started hunting in it. used sonnet because opus and fable both were being flagged so I switched to sonnet So far I have burned around 700k tokens on 8 repos with finding and validating 11 high and critical vulns in around 4-5 hours. To all the pps out there I wanted to ask is this good, and how can I improve this how can I build with my own methodology anyone can help or guide me with some resources <!-- SC_ON --> submitted by /u/Impressive-Room728 (https://www.reddit.com/user/Impressive-Room728)
[link] (https://www.reddit.com/r/Pentesting/comments/1vebifw/claude_code_for_cve_hunting/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vebifw/claude_code_for_cve_hunting/)
https://www.reddit.com/r/Pentesting/comments/1vebifw/claude_code_for_cve_hunting/
<!-- SC_OFF -->I have been using claude code to help me with CVE hunting, I am using skill file from claude s GitHub repo for code review and for creating poc the agents are doing all the stuff I bought claude pro cause I wanted to learn how I can integrate ai in my workflow, since oss is easy have i have the source code I started hunting in it. used sonnet because opus and fable both were being flagged so I switched to sonnet So far I have burned around 700k tokens on 8 repos with finding and validating 11 high and critical vulns in around 4-5 hours. To all the pps out there I wanted to ask is this good, and how can I improve this how can I build with my own methodology anyone can help or guide me with some resources <!-- SC_ON --> submitted by /u/Impressive-Room728 (https://www.reddit.com/user/Impressive-Room728)
[link] (https://www.reddit.com/r/Pentesting/comments/1vebifw/claude_code_for_cve_hunting/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vebifw/claude_code_for_cve_hunting/)
WILL PENTESTING BE FULLY REPLACED ?
https://www.reddit.com/r/Pentesting/comments/1veclz7/will_pentesting_be_fully_replaced/
<!-- SC_OFF -->Hello everyone, I have a query as I am currently studying and conducting penetration testing concurrently. Will artificial intelligence replace penetration testing? As When I do assesments and take help of Ai, It tends to perform really well in real world scenerios. <!-- SC_ON --> submitted by /u/MealSquare4408 (https://www.reddit.com/user/MealSquare4408)
[link] (https://www.reddit.com/r/Pentesting/comments/1veclz7/will_pentesting_be_fully_replaced/) [comments] (https://www.reddit.com/r/Pentesting/comments/1veclz7/will_pentesting_be_fully_replaced/)
https://www.reddit.com/r/Pentesting/comments/1veclz7/will_pentesting_be_fully_replaced/
<!-- SC_OFF -->Hello everyone, I have a query as I am currently studying and conducting penetration testing concurrently. Will artificial intelligence replace penetration testing? As When I do assesments and take help of Ai, It tends to perform really well in real world scenerios. <!-- SC_ON --> submitted by /u/MealSquare4408 (https://www.reddit.com/user/MealSquare4408)
[link] (https://www.reddit.com/r/Pentesting/comments/1veclz7/will_pentesting_be_fully_replaced/) [comments] (https://www.reddit.com/r/Pentesting/comments/1veclz7/will_pentesting_be_fully_replaced/)
MoneyPilot’s payment system is fully broken, no jailbreak needed, wild that nobody there seems to care.
https://www.reddit.com/r/Pentesting/comments/1velcaz/moneypilots_payment_system_is_fully_broken_no/
https://www.reddit.com/r/Pentesting/comments/1velcaz/moneypilots_payment_system_is_fully_broken_no/
<!-- SC_OFF -->been looking at MoneyPilot, the class action app blowing up on social media right now, and their backend has a serious flaw in how it verifies subscription payments. Bottom line, it’s possible to unlock the paid subscription and add ons without actually paying, and it’s not some local device trick, it’s saved server side. Confirmed it shows active from a totally clean app install and on their website too, so this isn’t client side at all. Not sharing specifics since I don’t want this getting reproduced by anyone else, but wanted to flag it given how aggressively they’re advertising right now, a lot of people are signing up. Reported directly to them first, no security contact exists, support just loops back to itself. Anyone dealt with a company like this that has basically zero security presence? proof of vuln (look at the start of the year) <!-- SC_ON --> submitted by /u/ghstedd (https://www.reddit.com/user/ghstedd)
[link] (https://i.redd.it/9doouc3pb7hh1.jpeg) [comments] (https://www.reddit.com/r/Pentesting/comments/1velcaz/moneypilots_payment_system_is_fully_broken_no/)
[link] (https://i.redd.it/9doouc3pb7hh1.jpeg) [comments] (https://www.reddit.com/r/Pentesting/comments/1velcaz/moneypilots_payment_system_is_fully_broken_no/)
MCP-SCANNER(DEMO)
https://www.reddit.com/r/Pentesting/comments/1vepr9o/mcpscannerdemo/
<!-- SC_OFF -->Follow-up on the MCP scanner from last week, here's a browser-based demo of the static analysis piece, no install needed. Paste in an MCP server file (or use the pre-filled example), get real findings for shell exec, hardcoded secrets, unsafe deserialization, arbitrary file writes, and more. Runs fully client-side, nothing sent anywhere. https://ankursingh0604.github.io/mcp-scanner-demo/ Still working on live probing over HTTP/SSE and more host adapters. Happy to scan real MCP servers for anyone building on this, learned a lot from the feedback here last time. <!-- SC_ON --> submitted by /u/KookyTax5493 (https://www.reddit.com/user/KookyTax5493)
[link] (https://www.reddit.com/r/Pentesting/comments/1vepr9o/mcpscannerdemo/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vepr9o/mcpscannerdemo/)
https://www.reddit.com/r/Pentesting/comments/1vepr9o/mcpscannerdemo/
<!-- SC_OFF -->Follow-up on the MCP scanner from last week, here's a browser-based demo of the static analysis piece, no install needed. Paste in an MCP server file (or use the pre-filled example), get real findings for shell exec, hardcoded secrets, unsafe deserialization, arbitrary file writes, and more. Runs fully client-side, nothing sent anywhere. https://ankursingh0604.github.io/mcp-scanner-demo/ Still working on live probing over HTTP/SSE and more host adapters. Happy to scan real MCP servers for anyone building on this, learned a lot from the feedback here last time. <!-- SC_ON --> submitted by /u/KookyTax5493 (https://www.reddit.com/user/KookyTax5493)
[link] (https://www.reddit.com/r/Pentesting/comments/1vepr9o/mcpscannerdemo/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vepr9o/mcpscannerdemo/)
How I learn to read CVE Reports ?
https://www.reddit.com/r/Pentesting/comments/1vetn7g/how_i_learn_to_read_cve_reports/
<!-- SC_OFF -->What is the use of CVE Anlysis and how I can read and analyze the details and make a report of it. In my understanding it is kind of case studies related to vulnerablities. <!-- SC_ON --> submitted by /u/Ashamed-Let-2179 (https://www.reddit.com/user/Ashamed-Let-2179)
[link] (https://www.reddit.com/r/Pentesting/comments/1vetn7g/how_i_learn_to_read_cve_reports/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vetn7g/how_i_learn_to_read_cve_reports/)
https://www.reddit.com/r/Pentesting/comments/1vetn7g/how_i_learn_to_read_cve_reports/
<!-- SC_OFF -->What is the use of CVE Anlysis and how I can read and analyze the details and make a report of it. In my understanding it is kind of case studies related to vulnerablities. <!-- SC_ON --> submitted by /u/Ashamed-Let-2179 (https://www.reddit.com/user/Ashamed-Let-2179)
[link] (https://www.reddit.com/r/Pentesting/comments/1vetn7g/how_i_learn_to_read_cve_reports/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vetn7g/how_i_learn_to_read_cve_reports/)
Databricks
https://www.reddit.com/r/Pentesting/comments/1veu0oi/databricks/
<!-- SC_OFF -->Any testing methodologies for databricks pentesting <!-- SC_ON --> submitted by /u/Appropriate-Fox3551 (https://www.reddit.com/user/Appropriate-Fox3551)
[link] (https://www.reddit.com/r/Pentesting/comments/1veu0oi/databricks/) [comments] (https://www.reddit.com/r/Pentesting/comments/1veu0oi/databricks/)
https://www.reddit.com/r/Pentesting/comments/1veu0oi/databricks/
<!-- SC_OFF -->Any testing methodologies for databricks pentesting <!-- SC_ON --> submitted by /u/Appropriate-Fox3551 (https://www.reddit.com/user/Appropriate-Fox3551)
[link] (https://www.reddit.com/r/Pentesting/comments/1veu0oi/databricks/) [comments] (https://www.reddit.com/r/Pentesting/comments/1veu0oi/databricks/)