Today's Bug Bounty Blogs #20

1)How I found a Broken Access Control by Reading API docs!
https://medium.com/@sanjaith3hacker/how-i-found-a-broken-access-control-by-reading-api-docs-e34219224076

2)Ultimate FFUF Cheatsheet: Advanced Fuzzing Tactics for Pro Bug Hunters!
https://medium.com/h7w/ultimate-ffuf-cheatsheet-advanced-fuzzing-tactics-for-pro-bug-hunters-492598750150

3)TryHackme — Jack Write up
https://bevijaygupta.medium.com/tryhackme-jack-write-up-fab8279fb15d

4)Tryhackme’s mKingdom Writeup by Alan Lundy
https://medium.com/@alanlundy23/tryhackmes-mkingdom-writeup-by-alan-lundy-afbc32278d97

5)Hardening Basics Part 1 TryHackme
https://systemweakness.com/hardening-basics-part-1-tryhackme-14ff5672d3d6

6)DriftingBlues: 6 Vulnhub Walkthrough
https://medium.com/@rzashirinov38/driftingblues-6-vulnhub-walkthrough-8db6ecdb3b46

7)Forensics Writeups | BlackHat MEA CTF Qualification 2024
https://medium.com/@mfaizanars/forensics-writeups-blackhat-mea-ctf-qualification-2024-648651defb26

Are you the author of these blogs? feel free to take the credit of yours, thanks for putting the efforts.

Contact me to get your blog featured on the next edition.

Today's Bug Bounty Blogs #21

1)Meta Bug Bounty — Fuzzing “netconsd” for fun and profit — part 3
https://blog.fadyothman.com/meta-bug-bounty-fuzzing-netconsd-for-fun-and-profit-part-3-127bb01d6756

2)Automating Subdomain Enumeration to Discover Critical Vulnerabilities
https://shubhamrooter.medium.com/automating-subdomain-enumeration-to-discover-critical-vulnerabilities-aa6158d35a8f

3)Google Dorks for Bug Bounty Part 3: Exposing Hidden Admin Panels & Login Portals
https://enigma96.medium.com/google-dorks-for-bug-bounty-part-3-exposing-hidden-admin-panels-login-portals-52b600e3f10b

4)OverTheWire Bandit: Levels 14–33 Complete Walkthrough
https://medium.com/@KpCyberInfo/overthewire-bandit-levels-14-33-complete-walkthrough-dd36accef2f4

5)Log4j Exploit Lab: Reverse Shell with JNDI Exploit Kit
https://medium.com/@josh.beck2006/log4j-exploit-lab-reverse-shell-with-jndi-exploit-kit-21f015204e29

6)New methods of recon with OrwaGodfather
https://www.youtube.com/watch?v=5RyODeBjar4

7)SpideyX - A Web Reconnaissance Penetration Testing tool for Penetration Testers and Ethical Hackers that included with multiple mode with asynchronous concurrne performance.
https://github.com/RevoltSecurities/Spideyx

Today's Bug Bounty Blogs #25

1)From an Android Hook to RCE: $5000 Bounty
https://blog.voorivex.team/from-an-android-hook-to-rce-5000-bounty

2)SOQL injection in SalesForce earned me $$$$$
https://rooted0x01.medium.com/soql-injection-in-salesforce-apex-earned-me-903e3e9d8268

3)OAuth Non-Happy Path to ATO
https://blog.voorivex.team/oauth-non-happy-path-to-ato

4)Breaking Down Multipart Parsers: File upload validation bypass
https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/

5)visit these website
https://lostsec.xyz/
https://ahmed-tarek.gitbook.io/sec-notes

6)The Blueprint to Your First $1,000+ Bounty
https://www.youtube.com/watch?v=8DnphDtFt3Y

7)Subdomain Enumeration ALL KINDS!
https://www.youtube.com/watch?v=6gY8cA3onkg

8)OTX_AlienVault_URL The OTX Scraper is a Bash script designed to fetch URLs associated with a given domain from AlienVault's Open Threat Exchange (OTX) platform.
https://github.com/Suryesh/OTX_AlienVault_URL

9)ex-param is an automated tool designed for finding reflected parameters for XSS vulnerabilities.
https://github.com/rootDR/ex-param

10)QuickSSRF - CAIDO Plugin
https://github.com/caido-community/quickssrf

Today's Bug Bounty Blogs #27

1)How I Found My First Bug (RXSS)
https://medium.com/@a0xtrojan/how-i-found-my-first-bug-rxss-2ac44e94d628

2)Crack the Code: Master Default Admin Panel Passwords to Boost Your Bug Bounty Rewards
https://medium.com/infosecmatrix/a-list-of-default-admin-panel-passwords-to-boost-your-bug-bounty-67af4c4f45b2

3)Weird JavaScript files 🥴
https://infosecwriteups.com/weird-javascript-files-7e6e7296e914

4)Web Cache Poisoning: Exploiting Trust in Cached Content
https://osintteam.blog/web-cache-poisoning-exploiting-trust-in-cached-content-362bb7c0d901

5)Bug Bounty Hunting Prerequisites
https://it4chis3c.medium.com/bug-bounty-hunting-prerequisites-964560919547

6)Ehxb | The Hidden Gateway CTF TryHackMe WriteUp
https://medium.com/@Ehxb/ehxb-the-hidden-gateway-ctf-tryhackme-writeup-a88fffdc98cb

7)eJPT : Host & Network Penetration Testing: Exploitation CTF 1
https://medium.com/@murat_kuzucu/ejpt-host-network-penetration-testing-exploitation-ctf-1-85cd5078e400

8)eJPT Host & Network Penetration Testing: Exploitation CTF 2
https://medium.com/@murat_kuzucu/ejpt-host-network-penetration-testing-exploitation-ctf-2-055d2969f1fe

9)Try Hack Me — Brains Write-up
https://medium.com/@cyberboar/try-hack-me-brains-write-up-9a32e6b4d5d1

10)HTB: Sightless Writeup / Walkthrough
https://medium.com/@pk2212/htb-sightless-writeup-walkthrough-ea6f492c0b3c

Join These Channels For More:

@TheCyberMonks
@HundredxSecurity
@HackstackSecurity
@thecybersecuritychannel

SOC 2 Trust Services Criteria Checklist

Map your Security, Availability, Integrity, Confidentiality & Privacy controls with this simple, practical guide.

https://hetmehta.com/soc2-tsc

Powershell For Hackers: Exploitation Essentials

Practical guide on how to use PowerShell for hacking and penetration testing.

https://hetmehta.com/posts/powershell-for-hackers

10 FREE courses with certificates to boost your SIEM skills!
https://x.com/hetmehtaa/status/1912962144729203108

WTF is SOC 2 Compliance?

https://hetmehta.com/posts/wtf-soc2/