Dark-Moon v1.4.0
https://kitploit.com/en/posts/github-ascit31-dark-moon-v140
Autonomous AI pentesting engine, continuous offensive security across web, cloud, AD & Kubernetes. Agentic reasoning + real exploit execution deliver proof-based vulnerabilities. Privacy gateway: the LLM never sees your real IPs, hosts, creds or paths (deterministic placeholders rehydrated locally), nothing leaves your perimeter.
https://kitploit.com/en/posts/github-ascit31-dark-moon-v140
Autonomous AI pentesting engine, continuous offensive security across web, cloud, AD & Kubernetes. Agentic reasoning + real exploit execution deliver proof-based vulnerabilities. Privacy gateway: the LLM never sees your real IPs, hosts, creds or paths (deterministic placeholders rehydrated locally), nothing leaves your perimeter.
opencti v7.260907.0
https://kitploit.com/en/posts/github-opencti-platform-opencti-72609070
Open Cyber Threat Intelligence Platform
https://kitploit.com/en/posts/github-opencti-platform-opencti-72609070
Open Cyber Threat Intelligence Platform
I Wasn’t Hunting an Email Bug. I Just Changed One Word.
Hi, I’m El7xoot, a Bug Hunter and Security Researcher focused on web applications and APIs.Continue reading on Medium »
Read more...
Hi, I’m El7xoot, a Bug Hunter and Security Researcher focused on web applications and APIs.Continue reading on Medium »
Read more...
Medium
I Wasn’t Hunting an Email Bug. I Just Changed One Word (ATO).
Hi, I’m El7xoot, a Bug Hunter and Security Researcher focused on web applications and APIs.
Advanced Vulnerabilities Part 2: Cross-Chain, Signatures & Upgradeable Pitfalls
Series: Web3 Security Zero se Advance 🛡️ | Article #22 By HackerMD | 32 min readContinue reading on Medium »
Read more...
Series: Web3 Security Zero se Advance 🛡️ | Article #22 By HackerMD | 32 min readContinue reading on Medium »
Read more...
Medium
Advanced Vulnerabilities Part 2: Cross-Chain, Signatures & Upgradeable Pitfalls
Series: Web3 Security Zero se Advance 🛡️ | Article #22 By HackerMD | 32 min read
How I Could Have Shut Down Every Restaurant in Europe With One Click
I found a Broken Access Control vulnerability that could let one restaurant modify another restaurant’s delivery zones.Continue reading on Medium »
Read more...
I found a Broken Access Control vulnerability that could let one restaurant modify another restaurant’s delivery zones.Continue reading on Medium »
Read more...
Medium
How I Could Have Shut Down Every Restaurant in Europe With One Click
I found a Broken Access Control vulnerability that could let one restaurant modify another restaurant’s delivery zones.
DOM XSS Deep Dive: Sources, Sinks, and Backwards Tracing
https://kd-200.medium.com/dom-xss-deep-dive-sources-sinks-and-backwards-tracing-9253fdb8975c?source=rss------bug_bounty-5
https://kd-200.medium.com/dom-xss-deep-dive-sources-sinks-and-backwards-tracing-9253fdb8975c?source=rss------bug_bounty-5
Hello, I am Nitin.Continue reading on Medium » (https://kd-200.medium.com/dom-xss-deep-dive-sources-sinks-and-backwards-tracing-9253fdb8975c?source=rss------bug_bounty-5)
How Did I Find a Subdomain Takeover in a HackerOne Program?
https://medium.com/@jakalalokesh07/how-did-i-find-a-subdomain-takeover-in-a-hackerone-program-2f2ba3b3adf6?source=rss------bug_bounty-5
https://medium.com/@jakalalokesh07/how-did-i-find-a-subdomain-takeover-in-a-hackerone-program-2f2ba3b3adf6?source=rss------bug_bounty-5
How a forgotten DNS record led me to an unclaimed Heroku applicationContinue reading on Medium » (https://medium.com/@jakalalokesh07/how-did-i-find-a-subdomain-takeover-in-a-hackerone-program-2f2ba3b3adf6?source=rss------bug_bounty-5)
LaZagne Explained | How Saved Passwords Can Be Exposed During Pentesting
https://medium.com/@pentesterclubpvtltd/lazagne-explained-how-saved-passwords-can-be-exposed-during-pentesting-9d8ebf9550b8?source=rss------bug_bounty-5
https://medium.com/@pentesterclubpvtltd/lazagne-explained-how-saved-passwords-can-be-exposed-during-pentesting-9d8ebf9550b8?source=rss------bug_bounty-5
Modern operating systems and applications make life easier by remembering passwords, credentials, tokens, Wi-Fi keys, SSH information…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/lazagne-explained-how-saved-passwords-can-be-exposed-during-pentesting-9d8ebf9550b8?source=rss------bug_bounty-5)
Insecure Firestore Security Rules & PII Exposure
After poking with firebase R/WRealtime Database (Unauthenticated): https://REDACTED.firebaseio.com/.json (Access Denied)Storage Bucket (Unauthenticated): https://firebasestorage.googleapis.com/v0/b/REDACTED.appspot.com/o (Access Denied)Firestore (Unauthenticated): https://firestore.googleapis.com/v1/projects/REDACTED/databases/(default)/documents (Access Denied)Auth Action / Callback URLs: Testing against https://REDACTED.firebaseapp.com/_/auth/action?mode=verifyEmail... resulted in errors/failed states. I moved to cli and got hit for /user endpointDescription & Root CauseInsecure Firestore Rules: The /users collection lacks proper ownership verification (request.auth.uid == resource.id). Any user who creates a standard, low-privilege account can query the Firestore REST API to extract all registered user records, including sensitive PII.Exposed Credentials / Endpoints: The Firebase API key and project identifiers are exposed in client-side configuration URLs, enabling direct interaction with Firebase backend services.Mail Bombing Vector: The Identity Toolkit API (sendOobCode) lacks strict rate-limiting, allowing malicious actors to flood arbitrary email addresses with automated password reset notifications.3. Steps to Reproduce At first i got that valid api from password reset link I got project ID/name from deep diving in js and fuzzingStep 1: Obtain a Low-Privilege Authentication Token Register a test user via the Firebase Auth REST API to obtain a valid JWT:curl -s -X POST 'https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=API_KEY_HERE' \ -H 'Content-Type: application/json' \ -d '{"email":"email protected","password":"TestPassword123!","returnSecureToken":true}' Extract the idToken from the response JSON and save it:export TOKEN="<token>"Step 2: Dump the Entire /users Collectioncurl -s "https://firestore.googleapis.com/v1/projects/REDACTED\_PROJECT\_ID/databases/(default)/documents/users" \ -H "Authorization: Bearer $TOKEN" Result: The server returns a JSON payload containing the complete database of user details, documents, Bio, every PII’s that is of high impact and that paves path for further attack vector’s.Step 3: Password Reset Mail Bombingfor i in {1..10}; do curl -s -X POST 'https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=API_KEY_HERE' \ -H 'Content-Type: application/json' \ -d '{"requestType": "PASSWORD_RESET", "email": "email protected", "clientType": "CLIENT_TYPE_WEB"}' echo "Request $i sent" sleep 0.5 done4. ImpactAccount Takeover / Phishing Risk: Exposed user directory data facilitates targeted phishing campaigns and impersonation.Mail Bombing: Unthrottled password reset requests flood target inboxes, degrading service reliability and user trust.Enforce Firestore Security Rules: Update rules in the Firebase Console to restrict read/write access so users can only access their own user documents: match /users/{userId} { allow read, write: if request.auth != null && request.auth.uid == userId; }Implement Rate Limiting: Apply rate limits and CAPTCHA challenges to authentication and password reset endpoints (sendOobCode) via Firebase App Check or backend proxies to prevent abuse and mail bombing. Originally published at https://noob6t5.hashnode.dev on August 22, 2026. Insecure Firestore Security Rules & PII Exposure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
After poking with firebase R/WRealtime Database (Unauthenticated): https://REDACTED.firebaseio.com/.json (Access Denied)Storage Bucket (Unauthenticated): https://firebasestorage.googleapis.com/v0/b/REDACTED.appspot.com/o (Access Denied)Firestore (Unauthenticated): https://firestore.googleapis.com/v1/projects/REDACTED/databases/(default)/documents (Access Denied)Auth Action / Callback URLs: Testing against https://REDACTED.firebaseapp.com/_/auth/action?mode=verifyEmail... resulted in errors/failed states. I moved to cli and got hit for /user endpointDescription & Root CauseInsecure Firestore Rules: The /users collection lacks proper ownership verification (request.auth.uid == resource.id). Any user who creates a standard, low-privilege account can query the Firestore REST API to extract all registered user records, including sensitive PII.Exposed Credentials / Endpoints: The Firebase API key and project identifiers are exposed in client-side configuration URLs, enabling direct interaction with Firebase backend services.Mail Bombing Vector: The Identity Toolkit API (sendOobCode) lacks strict rate-limiting, allowing malicious actors to flood arbitrary email addresses with automated password reset notifications.3. Steps to Reproduce At first i got that valid api from password reset link I got project ID/name from deep diving in js and fuzzingStep 1: Obtain a Low-Privilege Authentication Token Register a test user via the Firebase Auth REST API to obtain a valid JWT:curl -s -X POST 'https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=API_KEY_HERE' \ -H 'Content-Type: application/json' \ -d '{"email":"email protected","password":"TestPassword123!","returnSecureToken":true}' Extract the idToken from the response JSON and save it:export TOKEN="<token>"Step 2: Dump the Entire /users Collectioncurl -s "https://firestore.googleapis.com/v1/projects/REDACTED\_PROJECT\_ID/databases/(default)/documents/users" \ -H "Authorization: Bearer $TOKEN" Result: The server returns a JSON payload containing the complete database of user details, documents, Bio, every PII’s that is of high impact and that paves path for further attack vector’s.Step 3: Password Reset Mail Bombingfor i in {1..10}; do curl -s -X POST 'https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=API_KEY_HERE' \ -H 'Content-Type: application/json' \ -d '{"requestType": "PASSWORD_RESET", "email": "email protected", "clientType": "CLIENT_TYPE_WEB"}' echo "Request $i sent" sleep 0.5 done4. ImpactAccount Takeover / Phishing Risk: Exposed user directory data facilitates targeted phishing campaigns and impersonation.Mail Bombing: Unthrottled password reset requests flood target inboxes, degrading service reliability and user trust.Enforce Firestore Security Rules: Update rules in the Firebase Console to restrict read/write access so users can only access their own user documents: match /users/{userId} { allow read, write: if request.auth != null && request.auth.uid == userId; }Implement Rate Limiting: Apply rate limits and CAPTCHA challenges to authentication and password reset endpoints (sendOobCode) via Firebase App Check or backend proxies to prevent abuse and mail bombing. Originally published at https://noob6t5.hashnode.dev on August 22, 2026. Insecure Firestore Security Rules & PII Exposure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
SkillSpector v2.11.1
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Read more...
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Read more...
When Pre-Account Takeover Actually Means Pre-Account Takeover
بِسْمِ اللَّهِ رَبِّ الْعَالَمِينَ، وَالصَّلَاةُ وَالسَّلَامُ عَلَى رَسُولِنَا الْأَمِينِ.Continue reading on Medium »
Read more...
بِسْمِ اللَّهِ رَبِّ الْعَالَمِينَ، وَالصَّلَاةُ وَالسَّلَامُ عَلَى رَسُولِنَا الْأَمِينِ.Continue reading on Medium »
Read more...
Medium
When Pre-Account Takeover Actually Means Pre-Account Takeover
بِسْمِ اللَّهِ رَبِّ الْعَالَمِينَ، وَالصَّلَاةُ وَالسَّلَامُ عَلَى رَسُولِنَا الْأَمِينِ.
I Found a Tiny Filename Bypass That Broke a “Safe” Loader — and Earned $$$
Continue reading on Medium »
Read more...
Continue reading on Medium »
Read more...
Medium
I Found a Tiny Filename Bypass That Broke a “Safe” Loader — and Earned $ $$$
I Found a Tiny Filename Bypass That Broke a “Safe” Loader — and Earned $ $$$ السلام عليكم ورحمة الله وبركاتة Sometimes the best security findings start with a …
choosing college degree
https://www.reddit.com/r/Pentesting/comments/1w9ll85/choosing_college_degree/
<!-- SC_OFF -->I’m 18 years old and have been doing bug bounties since I was 15. I earned my CPTS and eJPT certifications I’m finishing my last in year in high school and getting ready for college. I’m trying to decide if I want to get a bachelor’s degree in Computer Science or Cybersecurity. I feel like cybersecurity bachelor’s programs focus on fundamentals, not advanced techniques. I’m also interested in AI because I want to get deep in AI red teaming. <!-- SC_ON --> submitted by /u/Capital-Rub269 (https://www.reddit.com/user/Capital-Rub269)
[link] (https://www.reddit.com/r/Pentesting/comments/1w9ll85/choosing_college_degree/) [comments] (https://www.reddit.com/r/Pentesting/comments/1w9ll85/choosing_college_degree/)
https://www.reddit.com/r/Pentesting/comments/1w9ll85/choosing_college_degree/
<!-- SC_OFF -->I’m 18 years old and have been doing bug bounties since I was 15. I earned my CPTS and eJPT certifications I’m finishing my last in year in high school and getting ready for college. I’m trying to decide if I want to get a bachelor’s degree in Computer Science or Cybersecurity. I feel like cybersecurity bachelor’s programs focus on fundamentals, not advanced techniques. I’m also interested in AI because I want to get deep in AI red teaming. <!-- SC_ON --> submitted by /u/Capital-Rub269 (https://www.reddit.com/user/Capital-Rub269)
[link] (https://www.reddit.com/r/Pentesting/comments/1w9ll85/choosing_college_degree/) [comments] (https://www.reddit.com/r/Pentesting/comments/1w9ll85/choosing_college_degree/)
Scoping our firm's first pentest engagement: Looking for methodology and ROE advice for a small team.
https://www.reddit.com/r/Pentesting/comments/1w9ogwn/scoping_our_firms_first_pentest_engagement/
<!-- SC_OFF -->Hey everyone, Our small MSP/IT firm is expanding our offerings and preparing to execute our very first client penetration testing engagement. I am looking for some technical and operational advice to make sure we scope and execute this correctly. Our Setup: We have a two-person team handling this new service: Technical Lead (Me): I have a background in IT networking and hold my Sec+. I have foundational pentesting knowledge (labs, CTFs) but this will be my first time leading a live commercial engagement. GRC Lead: My colleague (also Sec+) is handling the administrative side. He has already drafted up a solid SOW (Statement of Work) and ROE (Rules of Engagement), so we have the legal/compliance side reasonably locked down. The Proposed Plan: We are planning to start the engagement with a phishing campaign, followed by a White Box pentest. Currently, we are letting the client select their exact testing scope from the following menu: [ ] External Network Penetration Test [ ] Internal Network Penetration Test [ ] Active Directory Assessment [ ] Web Application Penetration Test Questions for the Community: Scope Reality Check: Is this menu of services too broad for a newly established two-man team? Should we restrict our first few engagements to just Internal/External Network testing? Methodology: For a White Box approach, what frameworks (e.g., PTES, OWASP) do you recommend we strictly adhere to for a first-time engagement? Risk Management: What are the most common beginner pitfalls when transitioning from lab environments to live production networks? What technical guardrails should we put in place to ensure we don't accidentally knock over their services? Reporting: Any recommendations on reporting templates or tools that help deliver real business value, rather than just handing them a glorified vulnerability scan output? Any advice on tools, scoping, or managing client expectations would be massively appreciated. Thanks! <!-- SC_ON --> submitted by /u/PsychologicalMud59 (https://www.reddit.com/user/PsychologicalMud59)
[link] (https://www.reddit.com/r/Pentesting/comments/1w9ogwn/scoping_our_firms_first_pentest_engagement/) [comments] (https://www.reddit.com/r/Pentesting/comments/1w9ogwn/scoping_our_firms_first_pentest_engagement/)
https://www.reddit.com/r/Pentesting/comments/1w9ogwn/scoping_our_firms_first_pentest_engagement/
<!-- SC_OFF -->Hey everyone, Our small MSP/IT firm is expanding our offerings and preparing to execute our very first client penetration testing engagement. I am looking for some technical and operational advice to make sure we scope and execute this correctly. Our Setup: We have a two-person team handling this new service: Technical Lead (Me): I have a background in IT networking and hold my Sec+. I have foundational pentesting knowledge (labs, CTFs) but this will be my first time leading a live commercial engagement. GRC Lead: My colleague (also Sec+) is handling the administrative side. He has already drafted up a solid SOW (Statement of Work) and ROE (Rules of Engagement), so we have the legal/compliance side reasonably locked down. The Proposed Plan: We are planning to start the engagement with a phishing campaign, followed by a White Box pentest. Currently, we are letting the client select their exact testing scope from the following menu: [ ] External Network Penetration Test [ ] Internal Network Penetration Test [ ] Active Directory Assessment [ ] Web Application Penetration Test Questions for the Community: Scope Reality Check: Is this menu of services too broad for a newly established two-man team? Should we restrict our first few engagements to just Internal/External Network testing? Methodology: For a White Box approach, what frameworks (e.g., PTES, OWASP) do you recommend we strictly adhere to for a first-time engagement? Risk Management: What are the most common beginner pitfalls when transitioning from lab environments to live production networks? What technical guardrails should we put in place to ensure we don't accidentally knock over their services? Reporting: Any recommendations on reporting templates or tools that help deliver real business value, rather than just handing them a glorified vulnerability scan output? Any advice on tools, scoping, or managing client expectations would be massively appreciated. Thanks! <!-- SC_ON --> submitted by /u/PsychologicalMud59 (https://www.reddit.com/user/PsychologicalMud59)
[link] (https://www.reddit.com/r/Pentesting/comments/1w9ogwn/scoping_our_firms_first_pentest_engagement/) [comments] (https://www.reddit.com/r/Pentesting/comments/1w9ogwn/scoping_our_firms_first_pentest_engagement/)
Best beginner certs for web?
https://www.reddit.com/r/Pentesting/comments/1w9sxxj/best_beginner_certs_for_web/
<!-- SC_OFF -->I'm a high school student and I'm trying to get some certs to build up my Portfolio for college apps as well as internships, etc.. I've already got eJPT and done pentesting on THM for about 6-8 months. I am comfortable with most easy and most medium rooms. I've also done a bunch of labs on portswigger. I've been debating between PWPP and eWPT for my next cert, are these okay for a beginner/intermediate level (I know the basics of the OWASP top 10 and web pentesting). Are there any other certs suggested? <!-- SC_ON --> submitted by /u/Vivid_Reward_8008 (https://www.reddit.com/user/Vivid_Reward_8008)
[link] (https://www.reddit.com/r/Pentesting/comments/1w9sxxj/best_beginner_certs_for_web/) [comments] (https://www.reddit.com/r/Pentesting/comments/1w9sxxj/best_beginner_certs_for_web/)
https://www.reddit.com/r/Pentesting/comments/1w9sxxj/best_beginner_certs_for_web/
<!-- SC_OFF -->I'm a high school student and I'm trying to get some certs to build up my Portfolio for college apps as well as internships, etc.. I've already got eJPT and done pentesting on THM for about 6-8 months. I am comfortable with most easy and most medium rooms. I've also done a bunch of labs on portswigger. I've been debating between PWPP and eWPT for my next cert, are these okay for a beginner/intermediate level (I know the basics of the OWASP top 10 and web pentesting). Are there any other certs suggested? <!-- SC_ON --> submitted by /u/Vivid_Reward_8008 (https://www.reddit.com/user/Vivid_Reward_8008)
[link] (https://www.reddit.com/r/Pentesting/comments/1w9sxxj/best_beginner_certs_for_web/) [comments] (https://www.reddit.com/r/Pentesting/comments/1w9sxxj/best_beginner_certs_for_web/)