/Hive Five #14 · Apr 12, 2021
"Don't think or judge, just listen." ― Sarah Dessen
/The Bee's Knees 🐝
The headline picks from this issue. The full issue has more.
-
Contextual Content Discovery: You've forgotten about the API endpoints
Presented at BSides Canberra 2021, slides available: PDF & Keynote (with videos). For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications, specifically APIs. Enter Kiterunner.
Read : Contextual Content Discovery: You've forgotten about the API endpoints -
Breaking GitHub Private Pages for $35k
This was actually the first report that paid out for me on HackerOne. At $35,000, it’s also the highest bounty I’ve received so far from HackerOne (and I believe the highest GitHub has paid out to date). A lot of bugs seem to be a mix of both luck and intuition.,
Read : Breaking GitHub Private Pages for $35k -
Embrace the Grind
There’s this card trick Jacob saw that he still think about all the time. It’s a simple presentation (which he's further simplified here for clarity): a volunteer chooses a card and seals the card in an envelope. Then the magician invites the volunteer to choose some tea.
Read : Embrace the Grind -
Mentoring the Upcoming Generation of Bug Bounty Hunters with Hakluke
find out more about his story, how he got into cybersecurity, the importance of fostering keen minds in the industry, the right hacker mindset, interesting tidbits from his work with Bugcrowd, and much more.
Read : Mentoring the Upcoming Generation of Bug Bounty Hunters with Hakluke -
I Built a TV That Plays All of Your Private YouTube Videos
Due to the lack of CSRF protection, a malicious website can play any video/playlist on a YouTube TV via the lounge API in the name of the victim.
Read : I Built a TV That Plays All of Your Private YouTube Videos