🐝 Hive Five 54 – Calling Bullshit

Bee Gagliardi
January 23, 2022

Hi friends,

Greetings from the hive!

I hope you had a good weekend. I'm continuing on my self-improvement journey and added journaling to my arsenal.

When was the last time you did something for the first time?

Let's take this week by swarm!

🐝 The Bee's Knees

DON'T call yourself a hacker...: John Hammond answers Premier's tweet, referencing the blog post Your Value Comes From Your Output by Daniel Miessler.
How to do Code Review - The Offensive Security Way: In this session, we will explore how source code analysis can lead to finding vulnerabilities in large enterprise codebases.
The Cyber Plumber's Handbook: This repo contains the PDF book The Cyber Plumber's Handbook - The definitive guide to Secure Shell (SSH) tunneling, port redirection, and bending traffic like a boss.
Stealing administrative JWT's through post auth SSRF (CVE-2021-22056): The advisory for this issue can be found here. The CVE for this issue is CVE-2021-22056.
Abusing Reverse Proxies, Part 1: Metadata: Many cloud service providers offer a "metadata" service on their virtual machines. These services offer sensitive details about the instance and cloud operating environment. Metadata services offer REST APIs to programmatically retrieve this data. Abusing Reverse Proxies, Part 2: Internal Access.

Get $100 to try DigitalOcean. The go-to VPS for bug bounty hunters. I use it for all of my own recon and automation needs, plus it also doubles as a VPN. They have every cloud resource you need at an affordable price.

Bounty Hunters hackathon: Make an awesome new hacking tool, share it with us and the world, and win a cash prize.
Secure Software Summit 2022: Inaugural Secure Software Summit, which brings together leading innovators and practitioners of secure software development on January 27, 2022.

Best choice you made for your career?: Casey asks.
Ubisoft is hiring Security Architects.
NCCGroup hiring Senior Security Consultant: Join their Hardware and Embedded Systems team.
AssetNote is hiring a Security Researcher: Remote, full time.
Cloud Architect job: If you've got experience with Cloud Native architecture and want to research and work with emerging technology, this might be a good opportunity. Location: Hyderabad, India.

The Tale of a Click leading to RCE: In today’s industry, we often hear that humans may weaken a company’s security leading to a potential breach.
Cosmos Team Created a Custom Exploit for CVE-2021-35211: Learn more about fuzzing, see it in action, and start using it in your own projects.
Debugging a Java application with decompiled source code: When reviewing a local Java-based target for vulnerabilities the first thing they do is decompile the class files into Java with the aid of several decompilers such as CFR, Procyon, etc, then load it into an IDE.
CVE-2021-45467: CWP CentOS Web Panel – preauth RCE: CentOS Web Panel or commonly known as CWP is a popular web hosting management software, used by over 200,000 unique servers, that can be found on Shodan or Census.
security.txt adoption in Switzerland: Recently, @ant0inet (Antoine) tweeted about a cursory scan they did against the .ch TLD to determine how many security.txt files are hosted on the .ch zone.

Favorite talks selected by speakers themselves: Great question by Ian Coldwater!
Craziest pentest stories: Luke Tucker wants to know the gnarliest thing you’ve seen or experienced with a client or found while bug hunting.
Bug Bounty standards: This repository is a list of situations that occur in bug bounty programs and how they should be handled.
Horrifying PDF experiments.
OSINT tools collection: @cyb_detective shares different services, techniques, tricks and notes about OSINT and more.

Visual application security testing with ZAP and Simon Bennetts: Keith Hoodlet, Field Security Architect, chats with Simon Bennetts about OWASP Zed Attack Proxy (ZAP) the world's most used open source web application security tool.
Finding security vulnerabilities with GitHub's new code search: GitHub is about to publicly release a brand new code search - Luke got to try out the early access version and it's scary. But awesome.
Introduction to Fuzzing: Binary Exploitation (Spike, Boo-Fuzz, Boo-Gen, and Custom Scripts): Busra Demir publishes another educational video on exploit development.
How To Get Into An Incident Response Career.
Easy IDOR hunting with Autorize.

Become a paying subscriber of Premium to get access to this post and other subscriber-only content.

Upgrade

Already a paying subscriber? Sign In.

• Join a private Discord COMMUNITY: Engage in chat, uplift one another, grow together, and explore shared interests.
• Access to COMPLETE HIVE ARCHIVE: Unlock a treasure trove of tools, resources, videos, and audio, catering to all your needs.
• EXCLUSIVE & BONUS content: Delve into hundreds of curated links that didn't make it into the newsletter.
• MEMBER-ONLY events: Take part in digital meetups, focus sessions, and more.
• Deep DISCOUNTS on paid content.
• Experience continuously added NEW BENEFITS.