Clint Gibler wrote a summary of each AI talk from BSidesLV, Black Hat, and DEF CON 2024 so if you want to quickly get up to speed and see what’s going on without spending hours on each talk, check out his TL;DR....
#80
Next.js and cache poisoning: a quest for the black hole
Incredible, how sometimes adding a single header like x-middleware-prefetch: 1 can cause a website to be DoSed for everyone. This is an actual technique used by @zhero___ and described in this blogpost. Or, more specifically, one of three different cache poisoning...
Universal Code Execution by Chaining Messages in Browser Extensions
I feel like browser extensions have a lot of capabilities and are very juicy targets, yet I don’t think many people focus on them. Once I have more time, I’ll take a look at a few of them in-scope of some bug bounty programs. Especially since this blogpost by...
Chaining Three Bugs to Access All Your ServiceNow Data
Assetnote blogposts are amazing! Not only do you learn what the bug was but you even get to know the whole architecture of the target technology. From this one, you go all the way from injecting XML tags, through bypassing a blocklist, up to template injection and...
Monke’s Guide to Bug Bounty Methodology
Monke disclosed his whole bug bounty methodology and included many interesting topics like program selection, scope selection or tools used but also important non-technical aspects like mental health and collaboration....
The X-Correlation between Frans & RCE – Research Drop – @fransrosen & @ctbbpodcast
On the Critical Thinking podcast, Frans Rosen dropped research about exploiting parts of the application that I always ignore - the correlation headers like Request-ID, which resulted in crazy findings! For example, sending this x-request-id header resulted in the...
Use lemma to run your tools with a click from the browser
lemma is a tool developed by defparam which allows you to run CLI tools on an AWS lambda. It has two main benefits. One is that it can seamlessly distribute your workload across different workers. The other is that it has a web interface to run CLI tools from within...