Archive

[HackerNotes Ep.79] The State of CSS Injection - Leaking Text Nodes & HTML Attributes

[HackerNotes Ep.79] The State of CSS Injection - Leaking Text Nodes & HTML Attributes

We're back with some weekly security including RCE via browser extensions, CSPT and a metric ton of CSS injection tips, tricks and techniques for you.

gr3pme
gr3pme
Full Time Bug Bounty Blueprint

Full Time Bug Bounty Blueprint

How to go Full-Time Bug Bounty: The Blueprint

gr3pme
gr3pme
[HackerNotes Ep. 78] Less Writing, More Hacking - Reporting Efficiency Techniques

[HackerNotes Ep. 78] Less Writing, More Hacking - Reporting Efficiency Techniques

Weekly security research, WAF bypasses and better reporting. Check it out in this HackerNotes post.

gr3pme
gr3pme
[HackerNotes Ep. 77] Bug Bounty Mental - Practical Tips for Staying Sharp & Motivated

[HackerNotes Ep. 77] Bug Bounty Mental - Practical Tips for Staying Sharp & Motivated

We've got fresh writeups including some MongoDB injections, ORMs, and exploits in Kakao and iOS before pivoting into staying motivated and avoiding burnout while hunting.

gr3pme
gr3pme
[HackerNotes Ep. 76] Match & Replace - HTTP Proxies' Most Underrated Feature

[HackerNotes Ep. 76] Match & Replace - HTTP Proxies' Most Underrated Feature

HackerNotes is back with some tasty exploit writeups, HackerOne AWC news and some match & replace tips for your next bug hunt.

gr3pme
gr3pme
[HackerNotes Ep. 74] Supply Chain Attack Primer - Popping RCE Without an HTTP Request

[HackerNotes Ep. 74] Supply Chain Attack Primer - Popping RCE Without an HTTP Request

Check out all things supply chain and dependency confusion below.

gr3pme
gr3pme
[HackerNotes Ep. 73] Sandboxed IFrames and WAF Bypasses

[HackerNotes Ep. 73] Sandboxed IFrames and WAF Bypasses

Content from NahamCon, WAF Bypasses, iFrame research and more!

gr3pme
gr3pme
[HackerNotes Ep. 72] Research TLDRs & Smuggling Payloads in Well Known Data Types

[HackerNotes Ep. 72] Research TLDRs & Smuggling Payloads in Well Known Data Types

Justin and Joel discuss some hot research from the past couple months. This includes ways to smuggle payloads in phone numbers and IPv6 Addresses, the NextJS SSRF, the PDF.JS PoC drop, and a GitHub Enterprise Indirect Method Information bug. Also, we have an attack vector featured from Monke!

gr3pme
gr3pme
[HackerNotes Ep. 71] More VDP Chats & AI Bias Bounty Strats with Keith Hoodlet

[HackerNotes Ep. 71] More VDP Chats & AI Bias Bounty Strats with Keith Hoodlet

Keith Hoodlet joins the guys to weigh in on the VDP Debate, followed by AI bias bounties and some of the techniques he used to claim first place in the recent DoD AI bug bounty program.

gr3pme
gr3pme
[HackerNotes Ep. 70]: NahamCon and CSP Bypasses Everywhere

[HackerNotes Ep. 70]: NahamCon and CSP Bypasses Everywhere

Metas' bug bounty program, NahamCon, CI/CD security and CSP bypasses.

gr3pme
gr3pme
[HackerNotes Ep. 69]: Johan Carlsson - 3 Month Check-in on Full-time Bug Bounty.

[HackerNotes Ep. 69]: Johan Carlsson - 3 Month Check-in on Full-time Bug Bounty.

CSP Bypasses in GitHub, GitLab Pipeline Criticals, Tips for Full-Time Bug Bounty, and a Browser Behavior Gadget with Johan Carls

gr3pme
gr3pme
[HackerNotes Ep. 68]: 0-days & HTMX-SS with Mathias

[HackerNotes Ep. 68]: 0-days & HTMX-SS with Mathias

Mathias is back with some fresh HTMX research, including CSP bypass using HTMX triggers, converting client-side response header injection to XSS, and bypassing HTMX disable. Some cool behaviour in Cloudflares image optimization functionality is also dropped to achieve partial open redirect.

gr3pme
gr3pme
FirstBack
12345
Next Last