Dirty dancing, Reversing Malware, and Dorking on Steroids

/The Bee's Knees 🐝

The headline picks from this issue. The full issue has more.

1. /01

   Account hijacking using "dirty dancing" in sign-in OAuth-flows

   About ten years ago, when bug bounties were just getting started, Frans was inspired by Nir Goldshlager and Egor Homakov’s multiple blog posts about account hijacking related to OAuth.

   Read : Account hijacking using "dirty dancing" in sign-in OAuth-flows
2. /02

   alh4zr3d talks about his background, Red Teaming, Security Certificates and more

   Watch : alh4zr3d talks about his background, Red Teaming, Security Certificates and more
3. /03

   Reversing Malware - Also How is APT 29 Successful with This Phishing Technique

   Watch : Reversing Malware - Also How is APT 29 Successful with This Phishing Technique
4. /04

   Someone tried to hack samczsun with a crypto stealer

   Learn about how the attack works, how to protect yourself, and some basic malware analysis.

   Read : Someone tried to hack samczsun with a crypto stealer
5. /05

   Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135)

   TL;DR Jira is vulnerable to SSRF which requires authentication to exploit. There are multiple ways to create user accounts on Jira in order to exploit this issue depending on the configuration of the Jira instance.

   Read : Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135)