🐝 Hive Five 196 - How To Make $100k Bug Hunting in 2025

Hi friends,

Greetings from the hive!

After a short detour, we're back to regular scheduling. The OG newsletter outline is back. Last week's issue didn't feel the same.

While curating for this newsletter, the following quote by Sahil stood out to me: "The same things that make you 'weird' as a kid are what will make you successful as an adult. Your unique blend of interests, hobbies, and eccentricities attract lucky events into your life."

Let's take this week by swarm!

🐝 The Bee's Knees

1. HeroCTF v6 Writeups covering: Express, Chromium cache partitioning, Service Worker hijacking through the Cache API, and Webpack DOM clobbering. MORE

2. The 2024 Best Inventions list, curated by editors from Time magazine, showcases innovative products and technologies across various categories. Google's NotebookLM is one of the winners. MORE

3. How a programmer with over three decades of experience writes code using Cursor. The real value is changing how you code. MORE

4. CVE-2024-8956, CVE-2024-8957: How to Steal a 0-Day RCE (With a Little Help from an LLM). MORE

5. How to earn $100,000 as a bug bounty hunter in 2025. MORE

Table of Contents

• 🐝 The Bee's Knees

• 📰 Updates

• 💼 Work

• 🌎 Community

• 🍄 Level up

• 🛠 Explore

• 📈 Learned something?

📰 Updates

🍯 My work

🚨 News

1. At GitHub Universe, Microsoft announced Anthropic’s Claude 3.5 Sonnet, Google’s Gemini 1.5 Pro, and OpenAI’s o1-preview and o1-mini are coming to GitHub Copilot—bringing a new level of choice to every developer. MORE

2. Ivan Zhao, the founder of Notion, held a 1-hour keynote at the company's first in-person conference, announcing 8 new launches that are sure to captivate the audience. The one that stood out to me the most was their email client. MORE

3. New payloads in PortSwigger's URL Validation Bypass Cheat Sheet. MORE

✅ Changelog

1. OWASP Noir, a static analysis tool, has just released version 0.18.1, introducing passive scan, status code flags, and more. MORE

2. The release of version 2.2.4 of the gau tool contains several fixes and a merge request. MORE

3. uro v1.0.1 makes the declutters URL lists tool 80x faster. MORE

4. Arjun, a tool for discovering HTTP parameters, has released version 2.2.7, introducing two new flags and several fixes. MORE

5. The latest Burp feature update added some features, including the ability to use Bambdas to perform match / replace in the Proxy. MORE

💼 Work

💰 Career

1. Chompie is starting a new offensive research team at X-Force and is hiring a security researcher. MORE

2. Ivan on their career move to Meta's WhatsApp: "I don’t want to spend the next 10 years of my life perfecting detection capabilities in the desktop world when the smart kids spent their last 10 years exiting it." MORE

3. Ania Wysocka built a business that scaled to $2m in revenue with a staff of zero. She founded Rootd, the world’s leading app for managing panic attacks. MORE

4. Why David Quit his high-paying Wall Street job to revive his family's struggling air filter business, embarking on a mission to build a world-leading indoor air quality company. MORE

5. A step-by-step approach to landing two six-figure remote Gov tech jobs in two weeks. MORE

🚀 Productivity

1. Marc Andreessen shares personal anecdotes of Elon Musk's remarkable effectiveness, shedding light on how he achieves so much. MORE

2. Cartographer is a powerful tool that leverages evolving Natural Language Processing (NLP) models to search through your document bases right from the comfort of your text editor. MORE

3. A Neovim markdown setup, including all plugins and tips for taking markdown notes. MORE

4. Some problems have straightforward solutions, while others require immense effort, resources, and coordination to overcome their complexity. Focus on simple but difficult problems. MORE

5. This guide covers 20 essential Gmail settings to transform your inbox experience. From disabling annoying nudges to setting up efficient swipe actions on mobile. MORE

🌎 Community

🎉 Celebrate

1. Firefox celebrates 20 years, and everyone who has used it is vital in making the internet better. Thank you! MORE

2. NahamSec reported an RCE to Meta this weekend and has received an initial "good find". Exciting! MORE

3. STÖK announced his exciting new role on the security team at Visma. Love it! MORE

4. Bugcrowds secured $50M in growth capital from Silicon Valley Bank. Boom! MORE

⚡️ Timeline

1. People complain about bug bounty payout disputes, but nobody forces them to participate. Payout levels are often pre-defined, so if they still choose to proceed, it is their own decision. MORE

2. Katie had a medical emergency while in the US, which they have now recovered from. However, the experience was frightening, as dealing with medical issues in the US can be difficult. MORE

💛 Follow
Awesome accounts to follow. Randomly selected from my curated Twitter lists.

1. @kepano | kepano | making Obsidian.

2. @niemand_sec | Niemand | Independent Security Consultant - Founder at SwordBytesSec - Ex immunityinc.

3. @seanyeoh | sean | appsec @ bytedance | former assetnote.

4. @bitquark | bitquark.

5. sunilyedla2 | Sunil Yedla | Trying to make the Internet a safer place by helping companies find security loopholes.

🍄 Level up

📰 Read

1. Certificate Error Mishandling: Misuse and Abuse of the SslErrorHandler Class. This class should be used cautiously, perhaps, at most, for simply logging SSL errors somewhere. MORE

2. From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code. MORE

3. What Are My OPTIONS? CyberPanel v2.3.6 pre-auth RCE. MORE

4. Writes and Write-Nots. Paul observes that many people struggle with writing, and predicts that in a couple of decades, there will be few who can write. MORE

5. Give Me the Green Light Part 1: Hacking Traffic Control Systems. Andrew shares their findings dealing with traffic controllers and other traffic systems. MORE | PART 2

💡 Tips

1. TIL you can use ChatGPT in iOS Shortcuts. MORE

2. Reset your dopamine and change your life by learning the power of brain chemicals from neuroscientist TJ Power. MORE

3. Tip by ZwinK: "If you get a 403 or 401 on an API path, try url encoding parts of the path or add one of these to the end of path /, ?, #, %2f, %3f. Or, add // or %2f%2f. Sometimes it throws off the access control logic and lets you in." MORE

🧠 Wisdom

1. 3 Exercises to Reverse Out Shoulder Pain. MORE

2. Sam Altman on the best path to proficiency being straightforward practice, not overly complex preparatory work. MORE

3. What "Follow Your Dreams" Misses. In his commencement speech at Harvey Mudd in 2024, Grant Sanderson urged graduates to remain adaptable, view passion as fuel, and follow opportunities instead of dreams. MORE

4. The fight-or-flight response is an automatic physiological reaction to perceived threats, preparing the body to either confront or flee from danger. A more accurate sequence might be Freeze, Flight, Fight, Fright. MORE

5. NFL quarterback Jayden Daniels uses VR every morning to simulate live reps that include moving in the pocket and throwing into tight windows. MORE

📚 Resources

1. A wide range of more than 100 powerful BadUSB scripts exclusively designed for Mac OS & the Flipper Zero device. MORE

2. Resources for learning Kubernetes, Docker, Cloud Native tech, and cloud computing. Find certification suggestion guides, children’s books that explain cloud concepts simply, and more. MORE

3. The Hacker News community shares their favorite text-based adventure games. MORE

4. XSS WAF Bypass: One payload for all. MORE

5. Everyone should take advantage of these free online resources: free online courses, educational videos, and open-source software. MORE

🛠 Explore

🧰 Tools

1. You-Get is a tiny command-line utility to download media contents (videos, audio, images) from the Web, in case there is no other handy way to do it. MORE

2. GlazeWM is a tiling window manager for Windows inspired by i3wm. MORE

3. Automatically detect potential vulnerabilities and analyze repository metrics to prioritize open-source security research targets MORE

4. Code-based QR code generator. MORE

5. Python tool for scanning Microsoft Outlook PST files to detect potentially sensitive information and security risks. MORE

🎥 Watch

1. Web Dev Challenge #7: Build an app that’s haunted. Make it spooky, make it creepy. Joel Hooks, Douglas Rogers, Danny Thompson, and Jason Lengstorf took on the challenge. MORE

2. How Union Square Ventures Built an AI Brain for Venture Capital. MORE

3. Lina Lau's talk at BSides Canberra 2024 she shares that you can be an iOS hacker: Stack Pivots and JOP/ROPs. MORE

4. A comparison between Github Spark, v0, and Bolt.new that allow you to prompt, run, edit, and deploy full-stack web apps. MORE

5. Justin and MatanBer delve into browser extensions. They talk about the structure and threat models and cover things like service workers, extension pages, and isolated worlds. MORE

🎵 Listen

1. Scott Hanselman and Mark Russinovich explore AI's evolving role, from boosting coding productivity with tools like GitHub Copilot to pondering the pitfalls of over-reliance on AI, as it reshapes education and professions. MORE

2. The DevZero Podcast discussed key decisions, communication, and what drives effective engineering teams. MORE

3. Unorthodox frameworks for growing your product, career, and impact by Bangaly Kaba (Director of Product YouTube, ex-Instagram, ex-Facebook, ex-Instacart). MORE

🌐 Technology

1. AI at its best, adding 'bolt.new' in front of a GitHub repo starts building it right away. This allows you to begin working on the project immediately. MORE

2. Best Free Fonts is a curated selection of free fonts, including serif, sans serif, script, and monospace varieties. MORE

3. Angela Jin recently departed her role as Head of Programs & Contributor Experience at Automattic and stepped away from the WordPress project. MORE

4. mymind is a private workspace to save one's most cherished notes, images, quotes, and highlights, enhanced with AI to aid memory without the burden of categorization. MORE

5. Six techniques to create a great user experience for shell scripts, including providing clear error messages, using interactive prompts, and incorporating helper functions. MORE

👀 Interesting

1. Book Cover Review provides a platform for authors and publishers to receive professional feedback on their book covers. MORE

2. Colorango offers a collection of free, printable coloring pages for all ages, covering a wide range of themes from animals to seasonal designs. MORE

3. 77 cocktail recipes visualized. MORE

4. How Vinyl Records Are Made (feat. Third Man Records). MORE

5. TimeGuessr is a web-based game that challenges players to guess the time shown in a series of images. MORE

💭 Quote

📈 Learned something?

Until next week, take care of yourself and each other,

Bee 🐝

^{This newsletter may contain affiliate links that support its costs. These links lead to tools, courses, and resources that I've personally found helpful.}