Calling Bullshit

/The Bee's Knees 🐝

The headline picks from this issue. The full issue has more.

1. /01

   DON'T call yourself a hacker...

   John Hammond answers Premier's tweet, referencing the blog post Your Value Comes From Your Output by Daniel Miessler.

   Watch : DON'T call yourself a hacker...
2. /02

   How to do Code Review - The Offensive Security Way

   In this session, we will explore how source code analysis can lead to finding vulnerabilities in large enterprise codebases.

   Watch : How to do Code Review - The Offensive Security Way
3. /03

   The Cyber Plumber's Handbook

   This repo contains the PDF book The Cyber Plumber's Handbook - The definitive guide to Secure Shell (SSH) tunneling, port redirection, and bending traffic like a boss.

   Read : The Cyber Plumber's Handbook
4. /04

   Stealing administrative JWT's through post auth SSRF (CVE-2021-22056)

   The advisory for this issue can be found here. The CVE for this issue is CVE-2021-22056.

   Read : Stealing administrative JWT's through post auth SSRF (CVE-2021-22056)
5. /05

   Abusing Reverse Proxies, Part 1: Metadata

   Many cloud service providers offer a "metadata" service on their virtual machines. These services offer sensitive details about the instance and cloud operating environment. Metadata services offer REST APIs to programmatically retrieve this data. Abusing Reverse Proxies, Part 2: Internal Access.

   Read : Abusing Reverse Proxies, Part 1: Metadata