- Hive Five
- Posts
- Hive Five #25 β Open redirects, experience, and being okay
Hive Five #25 β Open redirects, experience, and being okay
![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,format=auto,onerror=redirect,quality=80/uploads/asset/file/178fb102-ddf1-4180-88fc-bbd1e4a83bc5/photo-1474452926969-af7bfdb9ca39.jpeg)
Photo by Paul Pastourmatzis / Unsplash
Hi friends,
Greetings from the hive!
I hope you had a great weekend. No big updates from me this week. I've started running every day, before I usually took 1 or 2 rest days. I'm also continuing to work on my systems and habits.
Let's take this week by swarm!
π The Bee's Knees
LiveOverflow asks: What are the top arguments why pure "Open Redirects" should be classified as a vulnerability?
Seven years of the GitHub Security Bug Bounty program: Security is core to GitHubβs mission and their Product Security Engineering team is focused on continuously driving improvements to how GitHub develops secure software.
How to solve a challenge from Intigriti in under 60 minutes: Twelve hours before the deadline, the latest XSS challenge from Intigriti was only solved by 14 people. Many people ask them how do they solve those challenges so quickly and the answer to that question is probably experience.
Being Okay With Not Being Okay: Getting Candid with Ben Sadeghipour β NahamSec.
My Experience For 2 Years In Bug Bounty Hunting: Ahmad Halabi summarizes their experience during their Bug Bounty journey that they started 2 years ago.
Get $100 to try DigitalOcean. The go-to VPS for bug bounty hunters. I use it for all of my own recon and automation needs, plus it also doubles as a VPN. They have every cloud resource you need at an affordable price.
π₯ Buzzworthy
β Changelog
honoki/bbrf-server: Update to the bbrf-server image, which now installs with a reverse proxy that compresses data over the wire.
InjuredAndroid - CTF: the walk-throughs now include the solution for flag 18.
π Events
Mazin Ahmed is speaking at Bsides Amman: about their ongoing research on cloud security, starting with: Attack Vectors on Terraform Environments! Save the date: July 3rd.
NIST is requesting comments by August 9 on their recommendations for federal vulnerability disclosure: This is important, Jack Cable says. Help our government out by sharing your feedback.
π Celebrate
Naomi not Niomi: announces the launch of their new nonprofit, Cybersecurity Gatebreakers Foundation (@cybersecuritygb), dedicated to closing the "demand gap" in cybersecurity. Amazing!
Rocky Bandana: receives a $5,000 bug bounty from Apple. Congrats!
Kishore Krishna: had their first day at the office as a Security Consultant. Woot!
Shaun: received some awesome swag from the BBC. Cool!
meg: celebrates their journey to having a MS in cyber, a CISSP, working on a leading cyber team, and having a cybersecurity brand that is 30K strong. Let's go!
π° Jobs
π° Articles
How to get the max out of an IDOR?: If you stick to a specific target, you will be able to understand the functionality in depth, and this knowledge provides you the opportunity to make the most out of a specific bug, since different endpoints means multiple reports.
How We Are Able To Hack Any Company By Sending Message - $20,000 Bounty [CVE-2021β34506].
LEXSS: Bypassing Lexical Parsing Security Controls: TL;DR By using special HTML tags that leverage HTML parsing logic, it is possible to achieve cross-site scripting (XSS) even in instances where lexical parsers are used to nullify dangerous content.
Building XSS Polyglots: XSS polyglots are quite popular among beginners and lazy XSS testers since they only require a single copy and paste.
Lightning Components: A treatise on Apex Security from an External Perspective: The power of custom development on the Salesforce platform using its proprietary programming language, Apex, is undeniable.
π Resources
Infosec House: A curated list of resources and tools for both offensive/defensive security operations.
barrracud4/image-upload-exploits: This repository contains various old image exploits (2016 - 2019) for known vulnerabilities in image processors.
awesome-apisec: A collection of awesome API Security tools and resources.
π₯ Videos
SQL Injection - Lab #12 - Blind SQL injection with conditional errors
SQL Injection - Lab #13 - Blind SQL injection with time delays.
d0nut's stream highlights June 14, 2021: As requested, he tried to throw together some highlights from the stream on June 14th, 2021.
π΅ Audio
We Hack Purple Podcast Episode 38 API Security Best Practices.
Stephen Tobolowsky - Episode 905: You know Stephen Tobolowsky from Groundhog Day, Memento and Silicon Valley, but did you know he recorded with Stevie Ray Vaughan when Stevie was 14?
Get $100 to try DigitalOcean - The go-to VPS for bug bounty hunters. I use it for all of my own recon and automation needs, plus it also doubles as a VPN. They have every cloud resource you need at an affordable price.
![](https://media.beehiiv.com/cdn-cgi/image/format=auto,onerror=redirect/uploads/publication/logo/041e3b57-4217-4b9d-b575-a9e3e4931e4a/thumb_hive_logo__4_.png)
Subscribe to the Hive Five to read the rest.
Become a paying subscriber of the Hive Five to get access to this post and other subscriber-only content.
Already a paying subscriber? Sign In