/Hive Five #47 · Dec 6, 2021
Parkinson’s Law
/The Bee's Knees 🐝
The headline picks from this issue. The full issue has more.
-
Exploiting Vulnerabilities in a TLD Registrar to Takeover Tether, Google, and Amazon
The way in which an attacker could compromise any domain under the “.to” TLD.
Read : Exploiting Vulnerabilities in a TLD Registrar to Takeover Tether, Google, and Amazon -
Craftsmanship and My Father — MacSparky
Craftsmanship means caring about what you create.
Read : Craftsmanship and My Father — MacSparky -
Discovering Full Read SSRF in Jamf (CVE-2021-39303 & CVE-2021-40809)
When assessing an attack surface, they came across an instance of Jamf Pro installed on premise. To them, when they saw this paradigm of deploying Jamf Pro to the internet and having it externally exposed, their security research team was quite curious about potential vulnerabilities that existed within it. Advisory: Jamf Pro SSRF - CVE-2021-39303 & CVE-2021-40809.
Read : Discovering Full Read SSRF in Jamf (CVE-2021-39303 & CVE-2021-40809) -
Hakluke - Creating the Perfect Bug Bounty Automation
Luke is addicted to building bug bounty automation. He's built a full bug bounty automation framework from the ground up 3 times now. It has become better every time, but he's still not happy.
Read : Hakluke - Creating the Perfect Bug Bounty Automation -
Proxy Agent — a tool for mobile penetration testers
Earlier in March this year, they introduced Autowasp — A Burp Suite extension that integrates Burp issues logging with OWASP’s Web Security Testing Guide (WSTG) to streamline the security testing flow for penetration testers, particularly those working on web applications.
Read : Proxy Agent — a tool for mobile penetration testers