Auditing GitHub Repo Wikis for Fun and Profit

Download github-wiki-auditor.py here The types of issues you see when managing a bug bounty program vary widely, but every now and then a trend appears where multiple researchers submit the same issue. One day I received several reports regarding...

Read More

Building Your Own XSS Hunter in AWS

XSS Hunter is a tool for finding cross-site scripting (XSS) vulnerabilities, including the elusive blind XSS. A web version of the tool is available at https://xsshunter.com but as an employee or researcher you may be worried about sending...

Read More

Detecting SSRF Using AWS Services

Server Side Request Forgery (SSRF) is a fun vulnerability, its impact ranges from information disclosure via service detection to root. There are lots of good resources about SSRF out there, acunetix has a good blog post for understanding...

Read More

Captive Portal WiFi Phishing with OpenWrt

As companies and organizations are becoming more aware of security risks and implementing proper protections it can be difficult for pentesters and red teams to gain access to a network. Social engineering is a great way to accomplish that...

Read More