| 1 |
2FA Bypass Techniques |
| 2 |
Regular Expression Denial Of Service |
| 3 |
SAML Vulnerabilities |
| 4 |
Unauthenticated & Exploitable JIRA Vulnerabilities |
| 5 |
Client-Side Template Injection(CSTI) |
| 6 |
Cross-Site Leaks (XS-Leaks) |
| 7 |
Cross-Site Script Includes (XSSI) |
| 8 |
JSON Padding Attacks |
| 9 |
JSON Attacks |
| 10 |
Abusing Hop-by-Hop Headers |
| 11 |
Cache Poisoned Denial of Service (CPDos) |
| 12 |
Unicode Normalization |
| 13 |
WebSocket Vulns (Part-1) |
| 14 |
WebSocket Vulns (Part-2) |
| 15 |
WebSocket Vulns (Part-3) |
| 16 |
Web Cache Deception Attack |
| 17 |
Session Puzzling Attack |
| 18 |
Mass Assignment Attack |
| 19 |
HTTP Parameter Pollution |
| 20 |
GraphQL Series (Part-1) |
| 21 |
GraphQL Vulnerabilities (Part-2) |
| 22 |
GraphQL WrapUp (Part-3) |
| 23 |
Password Reset Token Issues |
| 24 |
My previous works |
| 25 |
Salesforce Security Misconfiguration (Part-1) |
| 26 |
Salesforce Security Misconfiguration (Part-2)) |
| 27 |
Salesforce Configuration Review (Wrap) |
| 28 |
Common Business Logic Issues: Part-1 |
| 29 |
Common Business Logic Issues (Part-2) |
| 30 |
Common Business Logic Issues (Wrap) |
| 31 |
Captcha Bypass Techniques |
| 32 |
Pentesting Kibana Service |
| 33 |
Pentesting Docker Registry |
| 34 |
HTML Scriptless Attacks / Dangling Markup Attacks (Part - 1) |
| 35 |
HTML Scriptless Attacks / Dangling Markup Attacks (Wrap) |
| 36 |
Pentesting Rsync Service |
| 37 |
CRLF Injection |
| 38 |
Pentesting FTP Service |
| 39 |
OpenID Connect Implementation Issues |
| 40 |
Cookie Based Authentication Vulnerabilities |
| 41 |
Cobalt Vulnerability Wiki - Resource |
| 42 |
Race Conditions |
| 43 |
SMTP Open Relay Attack |
| 44 |
Pentesting BACNet |
| 45 |
API Security Tips |
| 46 |
Pentesting SSH - Talk |
| 47 |
CORS Misconfiguration |
| 48 |
Incomplete Trailing Escape Pattern Issue |
| 49 |
Pivoting & Exploitation in Docker Environments - Talk |
| 50 |
Detect Complex Code Patterns using Semantic grep - Talk |
| 51 |
Student Roadmap to Become a Pentester - Talk |
| 52 |
Hacking How-To Series - Playlist |
| 53 |
JS Prototype Pollution |
| 54 |
JSON Deserialization Attacks |
| 55 |
Android App Dynamic Analysis using House |
| 56 |
Testing IIS Servers |
| 57 |
Secure Code Review - Talk |
| 58 |
JSON Interoperability Vulnerabilities - Research Blog |
| 59 |
HTTP Desync Attacks - Talk |
| 60 |
XSLT Injection |
| 61 |
Bypassing AWS Policies - Talk |
| 62 |
Source Code Review Guidelines - Resource |
| 63 |
All of the Threats: Intelligence, Modelling and Hunting - Talk |
| 64 |
Hidden Property Abuse (HPA) attack in Node.js - Talk |
| 65 |
HTTP Request Smuggling in 2020 - Talk |
| 66 |
Dependecy Confusion Attack - Blog |
| 67 |
Format String Vulnerabilities - Webinar |
| 68 |
Mobile Application Dynamic Analysis - Webinar |
| 69 |
Insecure Deserialization - Talk |
| 70 |
Web Cache Entanglement - Talk + Blog |
| 71 |
OWASP AMASS - Bootcamp |
| 72 |
Offensive Javascript Techniques for Red Teamers |
| 73 |
Basic CMD for Pentesters - Cheatsheet |
| 74 |
Investigating and Defending Office 365 - Talk |
| 75 |
WinjaCTF 2021 Solutions - Blog |
| 76 |
Kubernetes Security: Attacking and Defending K8s Clusters - Talk |
| 77 |
AWS Cloud Security - Resources |
| 78 |
WAF Evasion Techniques - Blog |
| 79 |
File Inclusion - All-in-One |
| 80 |
DockerENT Insights - Tool Demo Talk |
| 81 |
ImageMagick - Shell injection via PDF password : Research Blog |
| 82 |
Offensive GraphQL API Pentesting - Talk |
| 83 |
Bug Bounties with Bash - Talk |
| 84 |
Chrome Extensions Code Review - Talk |
| 85 |
Server-Side Template Injection - Talk |
| 86 |
Exploiting GraphQL - Blog |
| 87 |
Exploiting Email Systems - Talk |
| 88 |
Hacking with DevTools - Tutorial |
| 89 |
Common Android Application Vulnerabilities - Talk |
| 90 |
SAML XML Injection - Research Blog |
| 91 |
Finding Access Control & Authorization Issues with Burp - Blogs |
| 92 |
OAuth 2.0 Misimplementation, Vulnerabilities, and Best Practices - Talk |
| 93 |
JWT Attacks - Talk |
| 94-102 |
Random Readings |
| 103 |
Attacking Ruby on Rails Applications - Whitepaper |
| 104 |
Pentesting a Chrome Extension: Real Life Case Study - Blog |
| 105 |
XXE Simplified - Blog |
| 106 |
Web Hacking Pro Tips #9 with @zseano - Talk |
| 107 |
JS Prototype Pollution - Blog |
| 108 |
XSS via GraphQL Endpoint - Blog |
| 109 |
WS-2016-7107: CSRF tokens in Spring and the BREACH attack - Blog |
| 110 |
AWS SSRF Metadata Leakage - Blog |
| 111 |
Burp Suite Extension Development - Blog |
| 112-115 |
Random Readings |
| 116 |
Hacking OAuth Apps Pt-1 - Tutorial |
| 117 |
Portable Data exFiltration: XSS for PDFs - Blog |
| 118 |
PoC code and a case study on Task Hijacking in Android explaining how and why it works. (aka StrandHogg) - Blog |
| 119 |
OAuth - Flawed CSRF Protection - Tutorial |
| 120 |
Hacking Electron Apps with Electronegativity - Talk |
| 121 |
Awesome ElectronJS Hacking Resources |
| 122 |
Pentesting Blockchain Solutions - Tutorial |
| 123-124 |
Random Readings |
| 125 |
Oversized XML Attack - Wiki |
| 126 |
XML Complexity Attack in Soap Header - Wiki |
| 127 |
Web Service Attacks [Remaining] - Wiki |
| 128 |
Domain Hijacking Via Logic Error - Gandi And Route 53 Vulnerability - Blog |
| 129 |
Automating Recon with Axiom - Talk |
| 130 |
Testing Extensions in Chromium Browsers - Blog |
| 131 |
iOS Pentesting Series Pt. - 1 - Tutorial |
| 132 |
DNS Based Out of Band Blind SQL injection in Oracle — Dumping data - Blog |
| 133 |
GitDorker Talk - Talk |
| 134 |
Mobisec 2020 Slides - Slides & Videos |
| 135 |
Web App Pentesting in Angular Context - Blog |
| 136 |
RCE in Homebrew - Blog |
| 137 |
WordPress Plugin Security Testing Cheat Sheet - Wiki |
| 138 |
JavaScript prototype pollution: practice of finding and exploitation - Blog |
| 139 |
HowTo: intercept mutually-authenticated TLS communications of a Java thick client - Blog |
| 140 |
UBERNETES NAMESPACES ISOLATION - WHAT IT IS, WHAT IT ISN'T, LIFE, UNIVERSE AND EVERYTHING - Blog |
| 141 |
Frag Attacks - Wiki |
| 142 |
Free Automated Recon Using GH Actions - Talk |
| 143 |
DAY[0] Episode 66 - BlackHat USA, Pre-Auth RCEs, and JSON Smuggling - Talk |
| 144 |
Bug hunter adventures - Talk |
| 145 |
Static Analysis of Client-Side JS Code - Blog |
| 146 |
Method Confusion In Go SSTIs Lead To File Read And RCE - Blog |
| 147 |
Finding and Exploiting Unintended Functionality in Main Web App APIs - Blog |
| 148 |
SecuriTEA & Crumpets - Episode 6 - Gareth Heyes - Hackvertor - Talk |
| 149 |
GraphQL CSRF - Blog |
| 150 |
Deep dive into ART(Android Runtime) for dynamic binary analysis - Talk |
| 151 |
13 Nagios Vulnerabilities - Blog |
| 152 |
Frida Scripting Guide - Blog |
| 153 |
Android Exported Activities and how to exploit them - Talk |
| 154 |
XXE-scape through the front door: circumventing the firewall with HTTP request smuggling - Blog |
| 155 |
Turning Blind RCE into Good RCE via DNS Exfiltration using Collabfiltrator - Blog |
| 156 |
XSS in AWS Console - Blog |
| 157 |
Adventures into HTTP2 and HTTP3 - Blog |
| 158 |
AppCache's forgotten tales - Blog |
| 159 |
CVE-2021-33564 Argument Injection in Ruby Dragonfly - Blog |
| 160 |
DevSecOps 100 - Introductory Couse [Free] - Course |
| 161 |
Unexpected Execution: Wild Ways Code Execution can Occur in Python - Talk |
| 162 |
Retrieving AWS security credentials from the AWS console - Blog |
| 163 |
Object Injection to SQL Injection & NoSql Injection Cheatsheet - Blog |
| 164 |
HTTP Parameter Pollution - Blog |
| 165 |
XXE Workshop - Labs |
| 166 |
How to Analyze Code for Vulnerabilities - Talk |
| 167 |
Testing 2FA - Blog |
| 168 |
Your E-Mail Validation Logic is Wrong - Blog |
| 169 |
Active Scanning Techniques - Blog |
| 170 |
Bypassing 2FA using OpenId Misconfiguration - Blog |
| 171 |
Security Shorts - Talk |
| 172 |
The JavaScript Bridge in Modern Desktop Applications - Blog |
| 173 |
Advanced Web Application Penetration Testing JWT Security Issues - Blog |
| 174 |
Quick Analysis for the SSID Format String Bug - Blog |
| 175 |
Live GitLab Ask a Hacker with Bug Bounty Hunter (vakzz) William Bowling (Public) - Talk |
| 176 |
iOS App Testing Through Burp on Corellium - blog |
| 177 |
Blind XSS: setup your self-hosted XSS Hunter with the PwnMachine - Blog |
| 178 |
Attacking GraphQL's Autocorrect - Blog |
| 179 |
Apex Security Whitepaper - Paper + Labs |
| 180 |
Django SSTI - Blog |
| 181 |
Pen-Testing Salesforce SAAS Application - Blog |
| 182 |
How to solve an XSS challenge from Intigriti in under 60 minutes - Blog |
| 183 |
How to get the max out of an IDOR? - Blog |
| 184 |
Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464) - Blog |
| 185 |
Some ways to find more IDOR - Blog |
| 186 |
A supply-chain breach: Taking over an Atlassian account - Blog |
| 187 |
alert() is dead, long live print() - Blog |
| 188 |
Hacker Heroes #3 - @TomNomNom (Interview) - Talk |
| 189 |
SSRF in ColdFusion/CFML Tags and Functions - Blog |
| 190 |
$25,000 Facebook postMessage account takeover vulnerability - Video |
| 191 |
Pentester Diaries Ep6: The Importance of Report Writing - Talk |
| 192 |
Introduction to Web Cache Poisoning - Blog |
| 193 |
Intercepting Flutter iOS Application - Blog |
| 194 |
Credential stuffing in Bug bounty hunting - Blog |
| 195 |
What is a Browser Security Sandbox?! (Learn to Hack Firefox) - Video |
| 196 |
WILSON Cloud Respwnder - Blog |
| 197 |
$20,000 RCE in GitLab via 0day in exiftool metadata processing library CVE-2021-22204 - Video |
| 198 |
Padding Oracle Attacks - Video |
| 199 |
Demystifying the state of kubernetes cluster security - Video |
| 200 |
Two One-liners for Quick ColdFusion Static Analysis Security Testing - Blog |
| 201 |
So many different techniques to learn here! [CTF walkthrough] - Video |
| 202 |
UDP Technology IP Camera vulnerabilities - Blog |
| 203 |
Exploiting the Sudo Baron Samedit vulnerability (CVE-2021-3156) on VMWare vCenter Server 7.0 - Blog |
| 204 |
Reflected XSS Through Insecure Dynamic Loading - Blog |
| 205 |
Stored XSS via Mermaid Prototype Pollution vulnerability - Blog |
| 206 |
Getting Partial AWS Account IDs for any Cloudfront Website - Blog |
| 207 |
Remote code execution in cdnjs of Cloudflare - Blog |
| 208 |
Docker Security Series - Series |
| 209 |
REvil Vanishes! - Chrome Zero-Day Vulnerability, iOS WiFi SSID Bug, Patch Tuesday Review - Talk |
| 210 |
How to Build a Phishing Engagement – Coding TTP’s - Webcast |
| 211 |
Deep Link Exploitation: Introduction & Open/unvalidated Redirection - Blog |
| 212 |
Exploiting Android WebView Vulnerabilities - Blog |
| 213 |
WooCommerce Unauthenticated SQL Injection Vulnerability - Blog |
| 214 |
Traversing My Way in the Internal Network - Talk |
| 215 |
How I Found Multiple Bugs On FaceBook In 1 Month And a Part For My Methodology & Tools - Blog |
| 216 |
Pre-Auth RCE in ManageEngine OPManager - Blog |
| 217 |
Guest Blog Post - Attacking the DevTools - Blog |
| 218 |
Kubernetes Hardening Guide - Blog |
| 219 |
Introducing hallucinate: One-stop TLS traffic inspection and manipulation using dynamic instrumentation - Blog |
| 220 |
Do Not use alert(1) in XSS - Blog |
| 221 |
A Look Into zseano's Thoughts When Testing a Target - Video |
| 222 |
Zimbra 8.8.15 - Webmail Compromise via Email - Blog |
| 223 |
Security XML Implementation across the Web - Blog |
| 224 |
Potential remote code execution in PyPi - Blog |
| 225 |
XXE Case Studies - Blog |
| 226 |
HackerTools - NoSQLMap - Blog |
| 227 |
Learn with @sec_r0: Attacks and Defenses to Docker & Kubernetes - Talk |
| 228 |
Source Zero Con Talks - Talks |
| 229 |
DevOps for Hackers with Hands-On Labs w/ Ralph May - Talks |
| 230 |
Advanced Recon Guide - Blog |
| 231 |
Just Gopher It: Escalating a Blind SSRF to RCE for $15k - Blog |
| 232 |
Stealing Bitcoin with Cross-Site Request Forgery (Ride the Lightning + Umbrel) - Blog |
| 233 |
Modify in-flight data to payment provider Smart2Pay - Blog |
| 234 |
Hacker Heroes #9 - RobinZekerNiet (Interview) - Talk |
| 235 |
Learn with @HolyBugx: Demystifying Cookies and Tokens - Talk |
| 236 |
Hacker Tools: ReNgine – Automatic recon - Blog |
| 237 |
FROM PWN2OWN 2021: A NEW ATTACK SURFACE ON MICROSOFT EXCHANGE - Blog |
| 238 |
How to Hack Apple ID - Blog |
| 239 |
Insecure Features in PDFs - Blog |
| 240 |
Burp Upload Scanner - Blog |
| 241 |
Adobe Reader - PDF callback via XSLT stylesheet in XFA - Blog |
| 242 |
A Curious Exploration of Malicious PDF Documents - Blog |
| 243 |
Common mistakes when using permissions in Android - Blog |
| 244 |
iOS Pentesting 101 - Blog |
| 245 |
API Tokens: A Tedious Survey - Blog |
| 246 |
Cross-Site Request Forgery (CSRF) Complete Guide - Video |
| 247 |
HTTP Desync Attack Explained With Paper - Video |
| 248 |
AWS ReadOnlyAccess: Not Even Once - Blog |
| 249 |
Understanding Salesforce Flows and Common Security Risks - Blog |
| 250 |
Python context free payloads in Mako templates - Blog |
| 251 |
CVE-2021-26084 Remote Code Execution on Confluence Servers |
| 252 |
Introduction to smart contract security and hacking in Ethereum |
| 253 |
Automating Authorization Testing: AuthMatrix – Part 1 |
| 254 |
Go Fuzz Yourself – How to Find More Vulnerabilities in APIs Through Fuzzing |
| 255 |
More secure Facebook Canvas : Tale of $126k worth of bugs that lead to Facebook Account Takeovers |
| 256 |
Smart Contract Security Verification Standard |
| 257 |
Remote File Inclusion Zines by @sec_r0 |
| 258 |
GitHub Actions check-spelling community workflow - GITHUB_TOKEN leakage via advice.txt symlink |
| 259 |
Write-Up on Facebook Bug |
| 260 |
Mass assignment and learning new things |
| 261 |
A different way to attack certain reverse proxies |
| 262 |
Introducing Process Hiving & RunPE |
| 263 |
IAM Vulnerable - An AWS IAM Privilege Escalation Playground |
| 264 |
Complete Jailbreak Chart |
| 265 |
OWASP Top 10 2021 |
| 266 |
Powershell for Pentesters |
| 267 |
How to search for XSS (with blacklisted HTML tags) |
| 268 |
How to learn anything in Computer Science or Cybersecurity - Security Simplified |
| 269 |
Reused VMWare exploits & Escaping Azure Container Instances [Bug Bounty Podcast] |
| 270 |
Docker Hacking |
| 271 |
Getting Started in Blockchain Security and Smart Contract Auditing - Beau Bullock |
| 272 |
HacktivityCon |
| 273 |
CrikeyCon 2021 - Shubham Shah - Hacking on Bug Bounties for Five Years |
| 274 |
Beginners Guide to 0day/CVE AppSec Research |
| 275 |
VULNERABILITY DIGGING WITH CODEQL |
| 276 |
OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers |
| 277 |
Post Exploitation - Transferring Files To Windows Targets |
| 278 |
SecuriTEA & Crumpets - Episode 12 - Ksenia Peguero |
| 279 |
Talk: Absolute AppSec Ep. #147 - James Kettle (@albinowax), Security Research |
| 280 |
A Flickr CSRF, GitLab, & OMIGOD, Azure again? [Bug Bounty Podcast] |
| 281 |
NETGEAR smart switches, SpookJS, & Parallels Desktop [Binary Exploitation Podcast] |
| 282 |
Unusual Applications of OpenAI in Cybersecurity + How to get into CTFs |
| 283 |
SiegeCast "COBALT STRIKE BASICS" with Tim Medin and Joe Vest |
| 284 |
An Attacker's Approach to Pentesting IBM Cloud - fwd:cloudsec 2021 |
| 285 |
echo "Shell Injection" |
| 286 |
Exploiting Jinja SSTI with limited payload size. |
| 287 |
Fuzzing WebSocket messages on Burpsuite |
| 288 |
Thinking About Simple SQL Injections |
| 289 |
Training XSS Muscles |
| 290 |
"A tale of making internet pollution free" - Exploiting Client-Side Prototype Pollution in the wild |
| 291 |
Chasing a Dream:: Pre-authenticated Remote Code Execution in Dedecms |
| 292 |
Multiple bugs allowed malicious Android Applications to takeover Facebook/Workplace accounts |
| 293 |
Ping'ing XMLSec |
| 294 |
10 Types of Web Vulnerabilities that are Often Missed |
| 295 |
CVE-2021–35215, SolarWinds Orion Deserialization to RCE. |
| 296 |
Bachelor's thesis on HTTP Request Smuggling |
| 297 |
Stored XSS in markdown via the DesignReferenceFilter |
| 298 |
Building a POC for CVE-2021-40438 |
| 299 |
Turbo Intruder: Embracing the billion-request attack |
| 300 |
How to conduct a basic security code review - Security Simplified |
| 301 |
How to Analyze Code for Vulnerabilities using Joern |
| 302 |
Azure Privilege Escalation via Service Principal Abuse |
| 303 |
CREATING A MALICIOUS AZURE AD OAUTH2 APPLICATION |
| 304 |
0-Day Hunting (Chaining Bugs/Methodology) |
| 305 |
Discourse SNS webhook RCE |
| 306 |
Android Exploits 101 Workshop |
| 307 |
SHELLS AND SOAP: WEBSPHERE DESERIALIZATION TO RCE |
| 308 |
PHP-FPM LOCAL ROOT VULNERABILITY |
| 309 |
Support Board 3.3.4 Arbitrary File Deletion to Remote Code Execution |
| 310 |
SuDump: Exploiting suid binaries through the kernel |
| 311 |
Attacking and Securing CI/CD Pipeline |
| 312 |
Exploiting Protobuf Webapps |
| 313 |
CookieMonster |
| 314 |
Get shells with JET, the Jolokia Exploitation Toolkit |
| 315 |
Android security checklist: WebView |
| 316 |
5 Ways to Exploit a Domain Takeover Vulnerability |
| 317 |
Create a proxy DLL with artifact kit |
| 318 |
How to search for XXE! |
| 319 |
Defeating Android Certificate Pinning with Frida |
| 320 |
What can I do with Open Redirect with OAuth? |
| 321 |
Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond |
| 322 |
T-Reqs: HTTP Request Smuggling with Differential Fuzzing |
| 323 |
ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough |
| 324 |
MULTIPLE CONCRETE CMS VULNERABILITIES ( PART1 – RCE ) |
| 325 |
Android App Hacking Workshop |
| 326 |
Secondary Contexts Slides |
| 327 |
HTTP/2 request smuggling (explained using beer) |
| 328 |
Scanning for hardcoded secrets in source code - Security Simplified |
| 329 |
Staying sane in bug bounties |
| 330 |
How Your E-book Might Be Reading You: Exploiting EPUB Reading Systems |
| 331 |
Attacking SAML implementations |
| 332 |
Uniscan: An RFI, LFI, and RCE Vulnerability Scanner |
| 333 |
JavaScript type confusion: Bypassed input validation (and how to remediate) |
| 334 |
Multiple Vulnerabilities in ResourceSpace |
| 335 |
Unboxing BusyBox – 14 new vulnerabilities uncovered by Claroty and JFrog |
| 336 |
Zero-Day Disclosure: Palo Alto Networks GlobalProtect VPN CVE-2021-3064 |
| 337 |
Simple SSRF Allows Access To Internal Assets |
| 338 |
Multiple Resource by XVNPW Blog |
| 339 |
WordPress Plugin Confusion: How an update can get you pwned |
| 340 |
RCE with SSRF and File Write as an exploit chain on Apache Guacamole |
| 341 |
Grafana CVE-2021-43798 |
| 342 |
Data Exfiltration via CSS + SVG Font |
| 343 |
The Pen Testing Tools We’re Thankful for in 2021 |
| 344 |
HitCon CTF Challenges by Orange |
| 345-363 |
Random Readings |
| 364 |
Metasploit Basics for Hackers |
| 365 |
NCC Group’s Cryptopals Guided Tour! |